joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e5d0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x804
mov edx, dword [0x554e0c]
push esi
mov esi, ecx
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x410]
mov dword [esp + 0x40c], edx
rep stosd dword es:[edi], eax
mov ecx, 0xff
lea edi, [esp + 0x10]
mov dword [esp + 0xc], edx
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x40e62a
mov ecx, dword [esi + 4]
lea eax, [esp + 8]
push eax
push 2
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov eax, dword [esp + 8]
lea edx, [esp + 0xc]
push edx
push eax
jmp 0x40e645
mov edx, dword [esi + 4]
lea ecx, [esp + 8]
push ecx
push 0x17
push edx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov ecx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea edx, [esp + 0xc]
lea eax, [esp + 0x40c]
push edx
push 0x547e3c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [esi + 0x34]
mov ecx, dword [esi + 4]
add esp, 0xc
push eax
push 0x3e9
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, dword [esp + 0x814]
mov eax, dword [esp + 0x810]
push edx
push eax
mov ecx, esi
call fcn.0040e380
pop edi
pop esi
add esp, 0x804
ret 8
Function at 0x40e900
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ecx
mov eax, dword [0x5478f4]
push esi
cmp eax, 0xffffffff
jne 0x40e9a8
lea eax, [esp + 4]
xor esi, esi
push eax
push 0x20006
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.SHELL32.dll_SHChangeNotifyRegister
mov dword [0x5478f4], 0
mov dword [esp + 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40e943
mov esi, dword [esp + 4]
call dword [sym.imp.WINMM.dll_timeGetTime]
lea ecx, [esp + 4]
push 4
push ecx
push 4
push 0
push str._________ADMIN_TEST_SoftwareOK
push esi
mov dword [esp + 0x1c], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40e982
test esi, esi
mov dword [0x5478f4], 0
je 0x40e97d
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
pop ecx
ret
push str._________ADMIN_TEST_SoftwareOK
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test esi, esi
mov dword [0x5478f4], 1
je 0x40e9a3
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
pop ecx
ret
Function at 0x410280
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4102c4
mov eax, dword [esp + 4]
mov edx, dword [0x547574]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4102bf
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x4102bf
mov edx, dword [esp + 4]
add edx, 0xfffffff4
push edx
call fcn.00532222
add esp, 4
xor eax, eax
ret 4
test al, 1
je 0x4102ea
mov eax, dword [esp + 4]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
lea ecx, [esp + 4]
jne 0x4102ee
call fcn.00405700
xor eax, eax
ret 4
lea ecx, [esp + 4]
call fcn.00405700
mov eax, 1
ret 4
Function at 0x411510
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [0x554e04]
mov ecx, dword [esp + 4]
push esi
push 2
mov esi, dword [eax + 8]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ax, word [eax + 0xe]
pop esi
ret
Function at 0x412720
Capabilities:
Create process on windows

Disassembly:
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov bl, 1
mov eax, dword [esi + 0x50]
mov ecx, eax
and ecx, 0xc
cmp cl, 0xc
jne 0x41277d
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_GetDlgCtrlID]
push eax
mov dword [esp + 0x10], eax
call edi
mov edx, dword [esi + 4]
mov dword [esp + 0x10], eax
push edx
mov dword [esp + 0x18], 0xfffffffe
call edi
mov edi, eax
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_GetParent]
lea ecx, [esp + 0xc]
push ecx
push edi
push 0x4e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
mov al, bl
pop esi
pop ebx
add esp, 0xc
ret
shr eax, 2
test al, 1
je 0x4127ba
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov edi, eax
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_GetParent]
mov ecx, dword [esi + 4]
and edi, 0xffff
push ecx
push edi
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
mov al, bl
pop esi
pop ebx
add esp, 0xc
ret
mov edx, dword [esi + 0x24]
push 1
push 0
push 0
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
seta bl
test bl, bl
je 0x4127f1
mov al, byte [esi + 0x54]
push 1
or al, 2
push 0
mov byte [esi + 0x54], al
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
mov al, bl
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x4143b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x2c
mov al, 0x6c
push ebx
mov byte [esp + 0x11], al
mov byte [esp + 0x16], al
mov byte [esp + 0x17], al
mov eax, dword [0x547570]
lea ecx, [esp + 0xc]
push ebp
xor ebx, ebx
push esi
test ecx, ecx
push edi
mov byte [esp + 0x18], 0x4b
mov byte [esp + 0x19], 0x65
mov byte [esp + 0x1a], 0x72
mov byte [esp + 0x1b], 0x6e
mov byte [esp + 0x1c], 0x65
mov byte [esp + 0x1e], 0x33
mov byte [esp + 0x1f], 0x32
mov byte [esp + 0x20], 0x2e
mov byte [esp + 0x21], 0x64
mov byte [esp + 0x24], bl
mov dword [esp + 0x10], eax
je 0x414475
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
cmp esi, ebx
je 0x414475
lea eax, [esi + esi + 0xe]
push eax
call fcn.00532695
add esp, 4
cmp eax, ebx
je 0x414475
mov dword [eax], 1
mov word [eax + esi*2 + 0xc], bx
mov dword [eax + 4], esi
mov dword [eax + 8], esi
lea ecx, [esi + 1]
add eax, 0xc
cmp ecx, ebx
mov dword [esp + 0x10], eax
mov esi, eax
jne 0x414450
cmp eax, ebx
jne 0x41446a
push ecx
push eax
lea ecx, [esp + 0x20]
push 0xffffffffffffffff
push ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
jle 0x41446a
mov word [esi + eax*2 - 2], bx
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
call fcn.00405bb0
mov edx, dword [esp + 0x10]
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push edx
call ebp
mov edx, dword [0x547574]
mov esi, eax
mov eax, dword [esp + 0x10]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4144b3
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x4144b3
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.00532222
add esp, 4
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, ebx
je 0x414535
mov al, 0x67
mov cl, 0x73
mov byte [esp + 0x2e], al
mov byte [esp + 0x2f], al
lea eax, [esp + 0x28]
mov byte [esp + 0x28], 0x49
push eax
push esi
mov byte [esp + 0x31], cl
mov byte [esp + 0x32], 0x44
mov byte [esp + 0x33], 0x65
mov byte [esp + 0x34], 0x62
mov byte [esp + 0x35], 0x75
mov byte [esp + 0x38], 0x65
mov byte [esp + 0x39], 0x72
mov byte [esp + 0x3a], 0x50
mov byte [esp + 0x3b], 0x72
mov byte [esp + 0x3c], 0x65
mov byte [esp + 0x3d], cl
mov byte [esp + 0x3e], 0x65
mov byte [esp + 0x3f], 0x6e
mov byte [esp + 0x40], 0x74
mov byte [esp + 0x41], bl
call edi
cmp eax, ebx
je 0x414535
call eax
test eax, eax
je 0x414535
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2c
ret
push str.ntdll.dll
mov dword [esp + 0x18], ebx
call ebp
cmp eax, ebx
je 0x41457c
push str.NtQueryInformationProcess
push eax
call edi
mov esi, eax
cmp esi, ebx
je 0x41457c
push ebx
lea ecx, [esp + 0x18]
push 4
push ecx
push 7
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
jne 0x41457c
cmp dword [esp + 0x14], ebx
je 0x41457c
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2c
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2c
ret
Function at 0x414670
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x40
push esi
push edi
call fcn.00414650
xor edx, edx
mov ecx, 0x11
div ecx
xor edi, edi
mov esi, edx
add esi, ecx
test esi, esi
jle 0x4146b4
call fcn.005332a3
test eax, eax
je 0x4146a2
and eax, 0x8000000f
jns 0x4146a2
dec eax
or eax, 0xfffffff0
inc eax
mov edx, dword [str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
inc edi
cmp edi, esi
mov al, byte [edx + eax]
mov byte [esp + edi + 7], al
jl 0x41468d
lea ecx, [esp + 8]
mov byte [esp + esi + 8], 0xd
mov byte [esp + esi + 9], 0xa
push ecx
mov byte [esp + esi + 0xe], 0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
add esp, 0x40
ret
Function at 0x414be0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x34
mov eax, dword [esp + 0x38]
push ebx
push ebp
mov dword [esp + 0x38], eax
mov dword [0x5550c4], eax
mov eax, dword [esp + 0x44]
xor ebp, ebp
push esi
cmp eax, ebp
push edi
mov dword [esp + 0x20], ebp
mov dword [esp + 0x34], ebp
mov dword [esp + 0x1c], 0x541a28
mov dword [esp + 0x38], ebp
je 0x414c42
call fcn.00480c10
mov ecx, 0x55f604
call fcn.00490110
mov eax, dword [0x54b354]
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
push str.m_lang_id
push 0x547afc
call fcn.0048eb00
add esp, 0x14
mov dword [0x54b354], eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x10], eax
mov dword [esp + 0x24], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x55f3e4
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [0x55f418]
lea eax, [esp + 0x24]
push 0x55f3e4
mov dword [esp + 0x30], edx
mov dword [0x55f418], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [0x55f3b8]
call fcn.004167b0
mov edi, dword [sym.imp.KERNEL32.dll_FindResourceW]
push 5
push 0x1a3
push esi
call edi
push 0xf0
push 0x1a3
push esi
mov ebx, eax
call edi
mov edi, eax
mov dword [esp + 0x4c], ebp
test edi, edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x48], 0xffffffff
je 0x414cdc
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
mov dword [esp + 0x50], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebx, ebx
je 0x414d3a
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebp
push ebx
call fcn.00416340
mov ecx, dword [esp + 0x18]
add esp, 8
mov edi, eax
push 0
push 0x4141a0
push ecx
push edi
push esi
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
cmp edi, ebx
mov dword [esp + 0x48], eax
je 0x414d2b
push edi
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov edi, dword [esp + 0x18]
test ebp, ebp
je 0x414d4d
test edi, edi
je 0x414d4d
mov eax, dword [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esp + 0x48]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
Function at 0x41d6c0
Capabilities:
Get common file path
Hide graphical window

Disassembly:
sub esp, 0x3c
push esi
mov esi, ecx
mov eax, dword [esi + 0x2c]
test eax, eax
jne 0x41d6d4
xor eax, eax
pop esi
add esp, 0x3c
ret
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov eax, dword [esi + 0xc4]
mov ecx, dword [esp + 4]
test eax, eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], ecx
jne 0x41d789
push ebx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, eax
mov ecx, 0xb
xor eax, eax
lea edi, [esp + 0x1c]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
push edx
mov dword [esp + 0x1c], 0x30
mov dword [esp + 0x24], 0x41d670
mov dword [esp + 0x44], str.NotifyWnd_123
call dword [sym.imp.USER32.dll_RegisterClassExW]
push 0
push ebx
push 0
push 0
push 0
push 0
push 0
push 0
push SHChangeNotifyRegister
push 0
push str.NotifyWnd_123
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0
push eax
mov dword [esi + 0xc4], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0xc4]
push esi
push 0xffffffffffffffeb
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
pop edi
pop ebx
mov eax, dword [esi + 0x40]
test eax, eax
je 0x41d79e
push eax
call dword [sym.imp.SHELL32.dll_SHChangeNotifyDeregister]
mov dword [esi + 0x40], 0
mov edx, dword [esi + 0xc4]
lea ecx, [esp + 8]
push ecx
push 1
push 0x400
push 0x201ff
push 2
push edx
call dword [sym.imp.SHELL32.dll_SHChangeNotifyRegister]
mov dword [esi + 0x40], eax
mov eax, 1
pop esi
add esp, 0x3c
ret
Function at 0x41f800
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x24]
push ebx
mov ebx, dword [esp + 0x2c]
push esi
mov esi, ecx
lea edx, [esp + 8]
mov ecx, eax
push edi
and ecx, 0xffff
push edx
shr eax, 0x10
mov dword [ebx], 0
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [esi + 4]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [esp + 0xc]
xor edx, edx
mov dword [esp + 0x18], edx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x1c], edx
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 0x20], edx
lea edx, [esp + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 4]
push edx
push 0
push 0x1111
push eax
mov dword [esp + 0x28], ecx
call edi
lea ecx, [esp + 0x34]
test ecx, ecx
mov ecx, dword [esp + 0x1c]
jne 0x41f889
mov ecx, dword [esp + 0x34]
cmp ecx, 0x10
je 0x41f8ec
mov dword [ebx], 1
mov edx, dword [esi + 4]
push eax
push 9
push 0x110b
push edx
call edi
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
je 0x41f8dd
mov dword [0x55f2a0], 1
mov eax, dword [esi + 0x24]
push 0
push 0x6f
push 0x111
push eax
call edi
pop edi
pop esi
mov dword [0x55f2a0], 0
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
mov ecx, dword [esi + 0x24]
push 0
push 0x6f
push 0x111
push ecx
call edi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x18
ret 0x10
Function at 0x420cf0
Capabilities:
Hide graphical window

Disassembly:
push ecx
push esi
push edi
mov esi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov dword [esi + 0x34], eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x420d09
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0xec]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push eax
call edi
mov ecx, dword [esi + 0x2c]
push 0
push ecx
call edi
lea eax, [esi + 0x50]
sub esp, 8
test eax, eax
mov edi, esp
je 0x420d33
add eax, 4
jmp 0x420d35
xor eax, eax
push eax
lea ecx, [edi + 4]
call fcn.00406370
lea edx, [esp + 0x10]
mov ecx, esi
push edx
mov dword [edi], 0x5419d8
call fcn.00420970
mov eax, dword [esp + 8]
mov ecx, dword [esi + 0xec]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, dword [esi + 0xec]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push 0
push 0xb1
push edx
call edi
mov eax, dword [esi + 0xec]
push 0
push 0
push 0xb7
push eax
call edi
mov ecx, dword [esi + 4]
push 0
push 0x64
push 0x3e8
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov edx, dword [esi + 0xec]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esp + 8]
mov edx, dword [0x547574]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x420ddb
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x420ddb
mov edx, dword [esp + 8]
add edx, 0xfffffff4
push edx
call fcn.00532222
add esp, 4
pop edi
pop esi
pop ecx
ret 4
Function at 0x420df0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
cmp eax, 0x3e8
push edi
mov esi, ecx
jne 0x420e44
mov edi, dword [esi + 0xec]
call dword [sym.imp.USER32.dll_GetFocus]
cmp edi, eax
je 0x420f47
mov eax, dword [esi + 0xec]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call edi
mov ecx, dword [esi + 0x2c]
push 5
push ecx
call edi
mov edx, dword [esi + 4]
push 0x3e8
push edx
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
pop edi
pop esi
pop ebx
ret 0x10
cmp eax, 0x7d0
jne 0x420f47
push eax
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov edi, dword [sym.imp.USER32.dll_GetFocus]
mov ebx, dword [esi + 0xec]
call edi
cmp ebx, eax
je 0x420f47
call edi
mov ecx, dword [esi + 0xec]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push ecx
mov dword [esi + 0x34], eax
call edi
mov edx, dword [esi + 0x2c]
push 0
push edx
call edi
lea eax, [esi + 0x50]
sub esp, 8
test eax, eax
mov edi, esp
je 0x420e9f
add eax, 4
jmp 0x420ea1
xor eax, eax
push eax
lea ecx, [edi + 4]
call fcn.00406370
lea eax, [esp + 0x1c]
mov ecx, esi
push eax
mov dword [edi], 0x5419d8
call fcn.00420970
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0xec]
push ecx
push edx
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [esi + 0xec]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push 0
push 0xb1
push eax
call edi
mov ecx, dword [esi + 0xec]
push 0
push 0
push 0xb7
push ecx
call edi
mov edx, dword [esi + 4]
push 0
push 0x64
push 0x3e8
push edx
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [esi + 0xec]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esp + 0x14]
mov edx, dword [0x547574]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x420f47
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x420f47
mov edx, dword [esp + 0x14]
add edx, 0xfffffff4
push edx
call fcn.00532222
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret 0x10
Function at 0x421960
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x1c
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x8c]
test eax, eax
je 0x42197c
push 0
push eax
call edi
mov eax, dword [esi + 0x90]
test eax, eax
je 0x42198b
push 0
push eax
call edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x421a1c
mov ecx, dword [esi + 4]
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
sub edx, eax
push 0xc
push edx
mov edx, dword [esp + 0x24]
mov edi, dword [sym.imp.USER32.dll_SetWindowPos]
sub edx, ecx
push edx
push eax
mov eax, dword [esi + 0x3c]
push ecx
push 0
mov ecx, dword [eax + 4]
push ecx
call edi
fild dword [esp + 0x1c]
push 0x31
fstp qword [esp + 0x10]
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [esp + 8], eax
fild dword [esp + 8]
fmul qword [0x541e88]
fsubr qword [esp + 0xc]
call fcn.005332c8
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
sub edx, ecx
push 4
push edx
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
sub eax, edx
push eax
mov eax, dword [esi + 0x3c]
push ecx
push edx
mov ecx, dword [eax + 4]
push 0
push ecx
call edi
pop edi
pop esi
add esp, 0x1c
ret 4
Function at 0x423d60
Capabilities:
Hide graphical window

Disassembly:
push ecx
push esi
mov esi, dword [ecx + 0xa0]
test esi, esi
push edi
je 0x423e55
call dword [sym.imp.USER32.dll_GetFocus]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0xec]
push 5
push eax
call edi
mov ecx, dword [esi + 0x2c]
push 0
push ecx
call edi
lea eax, [esi + 0x50]
sub esp, 8
test eax, eax
mov edi, esp
je 0x423da4
add eax, 4
jmp 0x423da6
xor eax, eax
push eax
lea ecx, [edi + 4]
call fcn.00406370
lea edx, [esp + 0x10]
mov ecx, esi
push edx
mov dword [edi], 0x5419d8
call fcn.00420970
mov eax, dword [esp + 8]
mov ecx, dword [esi + 0xec]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, dword [esi + 0xec]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push 0
push 0xb1
push edx
call edi
mov eax, dword [esi + 0xec]
push 0
push 0
push 0xb7
push eax
call edi
mov ecx, dword [esi + 4]
push 0
push 0x64
push 0x3e8
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov edx, dword [esi + 0xec]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esp + 8]
mov edx, dword [0x547574]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x423e61
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x423e61
mov edx, dword [esp + 8]
add edx, 0xfffffff4
push edx
call fcn.00532222
add esp, 4
mov eax, 1
pop edi
pop esi
pop ecx
ret
call fcn.00423bc0
push eax
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
mov eax, 1
pop esi
pop ecx
ret

Function at 0x4251f0
Capabilities:
Check os version

Disassembly:
mov eax, dword [0x548c88]
sub esp, 0x230
cmp eax, 0xffffffff
jne 0x4252bb
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push esi
push edi
mov ecx, 0x45
xor eax, eax
lea edi, [esp + 0xc]
mov dword [0x548c88], 0
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x114
push eax
call ebx
mov eax, dword [esp + 0x10]
mov esi, dword [0x547570]
cmp eax, 5
jb 0x42527d
mov ecx, 0x47
xor eax, eax
lea edi, [esp + 0x120]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x120]
mov dword [esp + 0x120], 0x11c
push ecx
call ebx
mov eax, dword [esp + 0x124]
mov edx, dword [esp + 0x128]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
cmp eax, 6
jb 0x42528c
mov dword [0x548c88], 1
mov ecx, dword [0x547574]
mov edi, dword [0x548c88]
lea eax, [esi - 0xc]
cmp eax, ecx
je 0x4252b6
add esi, 0xfffffff4
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x4252b6
push esi
call fcn.00532222
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x230
ret
Function at 0x425f30
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
lea eax, [esp]
push esi
mov esi, ecx
push edi
push eax
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [esi + 0x54]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov edi, eax
mov eax, dword [esi + 0x54]
push 0
push 0
push 0x1304
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [0x54b34c]
mov dword [esi + 0x40], ecx
mov ecx, dword [0x54b34c]
cmp ecx, 2
jne 0x425f96
cmp eax, 1
jle 0x425f8a
test edi, edi
jne 0x425fa6
mov edx, dword [esi + 0x54]
push 5
push edx
jmp 0x425fa0
test edi, edi
je 0x425fa6
mov eax, dword [esi + 0x54]
push 0
push eax
jmp 0x425fa0
test edi, edi
jne 0x425fa6
mov ecx, dword [esi + 0x54]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.00426070
pop edi
pop esi
add esp, 0x10
ret 8
Function at 0x42a5b0
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x3c
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 4]
test eax, eax
je 0x42a6ab
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
test esi, esi
mov dword [esp + 0xc], esi
je 0x42a6ab
mov ecx, dword [edi + 4]
push ebx
lea eax, [esp + 0x14]
push ebp
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x20]
mov ebp, ecx
sub ecx, dword [esp + 0x1c]
mov ebx, eax
sub eax, edx
mov dword [esp + 0x2c], edx
push ecx
push eax
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push esi
mov dword [esp + 0x2c], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [esp + 0x28]
mov esi, eax
push ecx
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
mov ecx, edi
call fcn.0042c340
mov eax, dword [edi + 0x48]
mov dword [esp + 0x10], 0
test eax, eax
jle 0x42a660
mov edx, dword [esp + 0x10]
push esi
push edx
mov ecx, edi
call fcn.0042b840
mov eax, dword [esp + 0x10]
mov ecx, dword [edi + 0x48]
inc eax
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x42a643
mov eax, dword [edi + 4]
mov edi, dword [sym.imp.USER32.dll_ReleaseDC]
push esi
push eax
call edi
mov ecx, dword [esp + 0x30]
push 0xcc0020
push 0
push 0
sub ebp, ecx
mov ecx, dword [esp + 0x20]
push esi
push ebp
sub ebx, dword [esp + 0x40]
push ebx
push 0
push 0
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
push 0
call edi
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov edx, dword [esp + 0x28]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x3c
ret