joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410590
Capabilities:
Find taskbar
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x410792
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x415b14
mov edx, 0x4107a8
call fcn.00403770
lea edx, [ebp - 8]
xor eax, eax
call fcn.0040272c
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.004053f4
mov edx, dword [ebp - 4]
mov eax, 0x415ae8
call fcn.00403770
cmp byte [0x415b45], 0
jne 0x4105fb
mov eax, dword [0x415ae8]
push eax
mov ecx, 0x4107e0
mov edx, 0x4107f0
mov eax, 0x80000002
call fcn.004067f8
cmp byte [0x415b45], 0
je 0x41060e
call fcn.00410a48
jmp 0x410777
xor ebx, ebx
push 0
push 0x410830
call sub.user32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
jne 0x41062e
push 0x3e8
call sub.kernel32.dll_Sleep
jmp 0x410610
mov eax, 0x415b14
mov edx, 0x410848
call fcn.00403770
push 0xea60
call sub.kernel32.dll_Sleep
push 0
push 0x410864
push 0
push ebx
call sub.user32.dll_FindWindowExA
mov ebx, eax
push 0x41086c
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
test esi, esi
jne 0x410674
push 0x410878
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
test esi, esi
je 0x4106d9
push 0x410884
push esi
call sub.kernel32.dll_GetProcAddress
test eax, eax
je 0x4106d9
call eax
push 0xbb8
call sub.kernel32.dll_Sleep
push 0
push 0xd
push pe_nt_image_headers32
push ebx
call sub.user32.dll_SendMessageA
push 0x1f4
call sub.kernel32.dll_Sleep
push 0
push 0xd
push 0x101
push ebx
call sub.user32.dll_SendMessageA
push 0xc8
call sub.kernel32.dll_Sleep
mov eax, 0x410894
call fcn.00404db8
push 0x3e8
call sub.kernel32.dll_Sleep
mov eax, 0x415b14
mov edx, 0x4108a4
call fcn.00403770
mov edx, 0x4108c0
mov eax, 0x415b58
mov ecx, 0xbb8
call fcn.0040656c
test al, al
je 0x410777
mov eax, 0x415b14
mov edx, 0x4108f0
call fcn.00403770
call fcn.00410a48
mov eax, dword [0x415b14]
call fcn.00403894
cmp eax, 0x32
jle 0x410734
mov eax, 0x415b14
mov edx, 0x410918
call fcn.00403770
jmp 0x410743
mov eax, 0x415b14
mov edx, 0x410954
call fcn.00403770
call fcn.00412bf4
mov eax, dword [0x415b14]
call fcn.00403894
cmp eax, 0x28
jle 0x410768
mov eax, 0x415b14
mov edx, 0x4109b0
call fcn.00403770
jmp 0x410777
mov eax, 0x415b14
mov edx, 0x4109ec
call fcn.00403770
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x410799
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403740
ret
Function at 0x412de0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a84
xor eax, eax
push ebp
push 0x412eb9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x415b14
mov edx, 0x412ed0
call fcn.00403770
cmp dword [0x415b4c], 0
jne 0x412e21
call fcn.00412d4c
push 2
push 0
push 0
mov eax, dword [0x415b4c]
push eax
call sub.kernel32.dll_SetFilePointer_1
cmp eax, 0xffffffff
jne 0x412e3c
call fcn.00412d4c
lea edx, [ebp - 0xc]
mov al, byte [0x415b46]
call fcn.00405430
push dword [ebp - 0xc]
push 0x412f10
push dword [ebp - 4]
push 0x412f1c
lea eax, [ebp - 4]
mov edx, 4
call fcn.00403954
mov byte [0x415b46], 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00403894
push eax
lea eax, [ebp - 4]
call fcn.00403aec
push eax
mov eax, dword [0x415b4c]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x412e9b
mov dword [ebp - 8], 0xffffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412ec0
lea eax, [ebp - 0xc]
call fcn.0040371c
lea eax, [ebp - 4]
call fcn.0040371c
ret
Function at 0x403630
Capabilities:
Create pipe
Create process on windows
Get thread local storage value
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x140c
call fcn.00410160
mov eax, dword [0x45a9f4]
mov ecx, dword [0x45a484]
push ebx
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x403753
mov edi, dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
mov esi, dword [sym.imp.KERNEL32.dll_GetTimeFormatW]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
cmp dword [0x45a9f4], 0x959
jne 0x40373c
push 0
lea eax, [ebp - 0x408]
push eax
push 0
push 0
push 0
push 0
call edi
push 0
push 0
call ebx
push 0
lea ecx, [ebp - 0xc08]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0
push 0
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edx, [ebp - 0x1408]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0
push 0
push 0
push 0
push 0
push 0
call esi
push 0
lea eax, [ebp - 0x808]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [ebp - 4]
push ecx
call fcn.00403370
add dword [ebp - 4], 8
sub dword [ebp - 8], 1
jne 0x40366e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4052b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44b168]
jne 0x4052ba
repz ret
jmp fcn.00409bfc

Function at 0x40a33e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00408870
and dword [ebp - 4], 0
cmp dword [0x4519b0], 0
mov ebx, eax
jne 0x40a3ef
push 0x401ae8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a4a0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401adc
push edi
call esi
test eax, eax
je 0x40a4a0
push eax
call fcn.004087fe
mov dword [esp], 0x401acc
push edi
mov dword [0x4519b0], eax
call esi
push eax
call fcn.004087fe
mov dword [esp], 0x401ab8
push edi
mov dword [0x4519b4], eax
call esi
push eax
call fcn.004087fe
mov dword [esp], 0x401a9c
push edi
mov dword [0x4519b8], eax
call esi
push eax
call fcn.004087fe
pop ecx
mov dword [0x4519c0], eax
test eax, eax
je 0x40a3ef
push 0x401a84
push edi
call esi
push eax
call fcn.004087fe
pop ecx
mov dword [0x4519bc], eax
mov eax, dword [0x4519bc]
cmp eax, ebx
je 0x40a447
cmp dword [0x4519c0], ebx
je 0x40a447
push eax
call fcn.00408879
push dword [0x4519c0]
mov esi, eax
call fcn.00408879
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a447
test edi, edi
je 0x40a447
call esi
test eax, eax
je 0x40a43e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a43e
test byte [ebp - 0xc], 1
jne 0x40a447
or dword [ebp + 0x10], 0x200000
jmp 0x40a480
mov eax, dword [0x4519b4]
cmp eax, ebx
je 0x40a480
push eax
call fcn.00408879
pop ecx
test eax, eax
je 0x40a480
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a480
mov eax, dword [0x4519b8]
cmp eax, ebx
je 0x40a480
push eax
call fcn.00408879
pop ecx
test eax, eax
je 0x40a480
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4519b0]
call fcn.00408879
pop ecx
test eax, eax
je 0x40a4a0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a4a2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4025d0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d16bb
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5060c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.CXElement.0
call fcn.004050c0
mov ecx, eax
test ecx, ecx
je 0x4026d2
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 4], eax
mov dword [ebp - 4], 0
call fcn.004050c0
mov ecx, eax
test ecx, ecx
je 0x4026dc
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0xc], eax
lea esi, [edi + 0x10]
mov byte [ebp - 4], 1
push 0x1c
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004a2383
xorps xmm0, xmm0
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov eax, dword fs:[0x2c]
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov ecx, dword [eax]
movq qword [edi + 0x28], xmm0
mov dword [edi + 0x28], edi
mov dword [edi + 0x24], vtable.TGeneralObserverObj_class_CXElement_.0
mov eax, dword [0x51bb84]
cmp eax, dword [ecx + 4]
jg 0x4026e6
mov dword [edi + 0x30], 0x506ecc
mov eax, edi
mov dword [edi + 8], 0
mov dword [edi + 0x2c], 0x402ec0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00404ea0
push 0x80004005
call fcn.00404ea0
push 0x51bb84
call fcn.004a269c
add esp, 4
cmp dword [0x51bb84], 0xffffffff
jne 0x4026aa
push 0x4dcb10
mov dword [0x506ecc], 0x64
mov dword [0x506ed0], 0x64
mov byte [0x506ed4], 0
call fcn.004a260b
push 0x51bb84
call fcn.004a264b
add esp, 8
jmp 0x4026aa

Function at 0x404920
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40497b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40497b
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40496a
cmp esi, edx
jae 0x40497b
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x404958
cmp esi, edx
jae 0x40497b
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x40d860
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0xec], 0
je 0x40d8b4
mov eax, dword [esi + 0xe8]
test eax, eax
je 0x40d8b4
push dword [eax + 0x38]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40d8b4
mov eax, dword [esi + 0xe8]
push edi
push 0
push dword [eax + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x38]
mov edi, dword [sym.imp.USER32.dll_GetParent]
call edi
test eax, eax
je 0x40d8b3
push dword [esi + 0x38]
call edi
push eax
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
mov eax, dword [esi + 0xe8]
test eax, eax
je 0x40d8ce
mov dword [esi + 0xe8], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov eax, dword [esi + 0x64]
test eax, eax
je 0x40d8eb
mov dword [esi + 0x64], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x68]
test eax, eax
je 0x40d8ff
mov dword [esi + 0x68], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x6c]
test eax, eax
je 0x40d913
mov dword [esi + 0x6c], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [esi + 0x60]
test ecx, ecx
je 0x40d936
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [esi + 0x60]
test eax, eax
je 0x40d936
mov dword [esi + 0x60], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
pop esi
pop ebp
ret 0x10
Function at 0x412eb0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
mov esi, ecx
mov dword [esp + 0x18], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [esp + 0x10]
mov ecx, esi
push eax
mov eax, dword [esi]
call dword [eax + 0xc8]
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [ebp + 0x14]
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
sub edx, dword [esi + 0x58]
sub ebx, dword [esi + 0x5c]
mov dword [eax], 0
mov eax, dword [esi + 0x16c]
mov ecx, dword [esi + 0x168]
sub eax, ecx
sar eax, 2
imul eax, eax, 0xba2e8ba3
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0xc], 0
test eax, eax
je 0x412fab
xor edi, edi
push ebx
lea eax, [ecx + 8]
push edx
add eax, edi
push eax
call dword [sym.imp.USER32.dll_PtInRect]
mov ebx, dword [ebp + 0x14]
test eax, eax
je 0x412f75
mov eax, dword [esi + 0x168]
cmp dword [edi + eax + 0x20], 0
je 0x412f75
push 1
mov dword [ebx], 1
mov eax, dword [esi + 0x168]
push 0
push 0
push dword [edi + eax + 0x24]
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esi + 0x16c]
add edi, 0x2c
mov ecx, dword [esi + 0x168]
sub eax, ecx
mov edx, dword [esp + 0xc]
sar eax, 2
inc edx
imul eax, eax, 0xba2e8ba3
mov dword [esp + 0xc], edx
cmp edx, eax
jae 0x412fa6
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
jmp 0x412f33
cmp dword [ebx], 0
jne 0x412fb8
mov eax, dword [esi]
mov ecx, esi
push esi
push 0x384
call dword [eax + 0x28]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x421fa0
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x5060c0]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
cmp eax, 0x5f7
je 0x4220a0
cmp eax, 0x5f8
je 0x4220a0
cmp eax, 0x201
jne 0x421fe4
mov ecx, dword [esi + 0x170]
push 2
jmp 0x42212a
cmp eax, 0x202
jne 0x422132
mov eax, dword [esi + 0x58]
mov ecx, dword [esi + 0x5c]
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
mov eax, dword [esi]
mov dword [esp + 0xc], ecx
mov ecx, esi
call dword [eax + 0xc8]
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [esi + 0x60]
sub eax, dword [esi + 0x58]
mov ecx, dword [esp + 4]
add eax, ecx
mov edx, dword [esp + 8]
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 0x64]
sub eax, dword [esi + 0x5c]
add eax, edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x20], eax
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [esp + 0x10]
lea eax, [esp + 0x18]
push dword [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
mov ecx, dword [esi + 0x170]
test eax, eax
mov eax, dword [ecx]
je 0x422099
push 1
call dword [eax + 0x158]
push ecx
mov ecx, esi
call fcn.00420a60
xor eax, eax
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.004a2700
mov esp, ebp
pop ebp
ret 0x14
push 0
jmp 0x42212c
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
mov dword [esp + 0xc], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esi + 0x58]
mov ecx, dword [esi + 0x5c]
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
mov eax, dword [esi]
mov dword [esp + 0x14], ecx
mov ecx, esi
call dword [eax + 0xc8]
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [esi + 0x60]
sub eax, dword [esi + 0x58]
mov ecx, dword [esp + 0xc]
add eax, ecx
mov edx, dword [esp + 0x10]
push dword [esp + 8]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x64]
sub eax, dword [esi + 0x5c]
push dword [esp + 8]
add eax, edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x28], eax
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x24], edx
call dword [sym.imp.USER32.dll_PtInRect]
mov ecx, dword [esi + 0x170]
test eax, eax
je 0x422128
push 1
jmp 0x42212a
push 0
mov eax, dword [ecx]
call dword [eax + 0x158]
mov ecx, dword [esp + 0x24]
xor eax, eax
pop esi
xor ecx, esp
call fcn.004a2700
mov esp, ebp
pop ebp
ret 0x14
Function at 0x422f40
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d2fe5
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5060c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x194], 0
je 0x422fbd
call fcn.004050c0
mov ecx, eax
test ecx, ecx
je 0x423093
mov eax, dword [ecx]
call dword [eax + 0xc]
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
push 0x4e9538
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.00404a20
test al, al
jne 0x423073
push 0
push 0x4e9538
mov ecx, esi
call fcn.00404cd0
jmp 0x423073
call fcn.004050c0
mov ecx, eax
test ecx, ecx
je 0x423093
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 1
push dword [edi + 0x16c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ebx, [eax + 1]
test ebx, ebx
js 0x423089
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, ebx
or eax, ecx
jge 0x423012
push ebx
lea ecx, [ebp - 0x10]
call fcn.00404c30
mov esi, dword [ebp - 0x10]
push ebx
push esi
push dword [edi + 0x16c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, 0xffffffff
jne 0x423031
push dword [esi - 8]
push esi
call fcn.004aec96
add esp, 8
test eax, eax
js 0x423089
cmp eax, dword [esi - 8]
jg 0x423089
xor ecx, ecx
mov dword [esi - 0xc], eax
lea edi, [esi - 0x10]
mov word [esi + eax*2], cx
push edi
call fcn.004047a0
mov esi, dword [ebp + 8]
add eax, 0x10
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov dword [esi], eax
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x423073
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00404ea0
push 0x80004005
call fcn.00404ea0
int3
Function at 0x42aa20
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push edi
mov edi, ecx
cmp dword [edi + 0x84], eax
je 0x42aa89
mov dword [edi + 0x84], eax
push esi
mov esi, dword [edi + 0x34]
cmp esi, dword [edi + 0x38]
je 0x42aa72
mov ecx, dword [esi]
test ecx, ecx
je 0x42aa6a
cmp dword [edi + 0x84], 0
je 0x42aa5f
cmp dword [edi + 0x88], 0
je 0x42aa5f
mov edx, 1
jmp 0x42aa61
xor edx, edx
mov eax, dword [ecx]
push edx
call dword [eax + 0xd4]
add esi, 4
cmp esi, dword [edi + 0x38]
jne 0x42aa40
mov ecx, dword [edi + 0x40]
pop esi
test ecx, ecx
je 0x42aa7f
call fcn.00406940
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x134]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xd0]
mov edx, dword [edi]
mov ecx, edi
test eax, eax
je 0x42aab1
push 5
call dword [edx + 0x13c]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop edi
pop ebp
ret 4
push 0
call dword [edx + 0x13c]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop edi
pop ebp
ret 4

Function at 0x42aad0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push edi
mov edi, ecx
cmp dword [edi + 0x88], eax
je 0x42ab2d
mov dword [edi + 0x88], eax
push esi
mov esi, dword [edi + 0x34]
cmp esi, dword [edi + 0x38]
je 0x42ab22
mov ecx, dword [esi]
test ecx, ecx
je 0x42ab1a
cmp dword [edi + 0x84], 0
je 0x42ab0f
cmp dword [edi + 0x88], 0
je 0x42ab0f
mov edx, 1
jmp 0x42ab11
xor edx, edx
mov eax, dword [ecx]
push edx
call dword [eax + 0xd4]
add esi, 4
cmp esi, dword [edi + 0x38]
jne 0x42aaf0
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x134]
pop esi
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xd0]
mov edx, dword [edi]
mov ecx, edi
test eax, eax
je 0x42ab55
push 5
call dword [edx + 0x13c]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop edi
pop ebp
ret 4
push 0
call dword [edx + 0x13c]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop edi
pop ebp
ret 4

Function at 0x42b420
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
call dword [eax + 0x88]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call fcn.0042c760
mov edx, eax
test edx, edx
jne 0x42b444
mov eax, 0x80004005
pop esi
ret
mov ecx, esi
lea eax, [esi + 0x104]
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
mov ecx, edx
call fcn.0042c6a0
test eax, eax
je 0x42b469
push 0
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [esi + 0x10c], 0
xor eax, eax
pop esi
ret
Function at 0x42b480
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
mov eax, dword [0x5060c0]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x42b4cd
push eax
push ecx
mov eax, esp
push 0
push SysReAllocString
push 0
push ecx
mov dword [eax], 0
mov ecx, esi
mov eax, esp
push edi
mov dword [eax], 0
call fcn.0040c4e0
cmp byte [ebp + 0x1c], 0
je 0x42b4df
mov ecx, dword [esi + 0x30]
lea eax, [ebp + 0xc]
push eax
call fcn.00424400
mov eax, dword [esi]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call dword [eax + 0x8c]
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x42b507
mov eax, dword [ebp + 0xc]
sub ecx, eax
push 1
push dword [esp + 0x18]
push ecx
push dword [ebp + 0x10]
push eax
jmp 0x42b55c
push 0
push edi
mov dword [esp + 0x20], 0x68
call dword [sym.imp.USER32.dll_MonitorFromWindow]
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
mov ebx, dword [esp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [esp + 0x34]
lea eax, [ebx + ecx]
cmp eax, edx
jle 0x42b53d
mov ecx, edx
sub ecx, ebx
mov dword [ebp + 0xc], ecx
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + 0x10]
lea eax, [edi + edx]
cmp eax, dword [esp + 0x38]
jle 0x42b556
mov edx, dword [esp + 0x38]
sub edx, edi
mov dword [ebp + 0x10], edx
push 1
push edi
push ebx
push edx
push ecx
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_MoveWindow]
push 5
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x84]
cmp dword [esi + 0x108], 0
jne 0x42b5c6
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call fcn.0042c760
mov edi, eax
test edi, edi
je 0x42b5e0
cmp dword [esi + 0x10c], 0
je 0x42b5ac
lea ecx, [esi + 0x104]
push ecx
mov ecx, edi
call fcn.0042c6a0
lea eax, [esi + 0x104]
mov ecx, edi
push eax
call fcn.0042c610
mov dword [esi + 0x10c], 1
jmp 0x42b5e0
mov ecx, dword [esi + 0x124]
mov edx, 0x6a4
mov dword [esi + 0x108], 0
call fcn.00430fb0
mov ecx, dword [esp + 0x84]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004a2700
mov esp, ebp
pop ebp
ret 0x18