joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4462c0
Capabilities:
Delete file
Enumerate files on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x539482
mov eax, dword fs:[0]
push eax
sub esp, 0x298
mov eax, dword [0x575494]
xor eax, esp
mov dword [esp + 0x290], eax
push ebx
push esi
push edi
mov eax, dword [0x575494]
xor eax, esp
push eax
lea eax, [esp + 0x2a8]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
xor esi, esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x2b0], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
add eax, 0x2c
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2b0], 2
call fcn.00508010
push 0x54ede0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x54ede0
lea edi, [esp + 0x20]
call fcn.00507dd0
push 0x553b34
mov eax, edi
push eax
lea ecx, [esp + 0x48]
push ecx
call fcn.00508260
push 0x553b38
push eax
lea edx, [esp + 0x24]
push edx
mov byte [esp + 0x2c8], 3
call fcn.00508260
add esp, 0x18
lea ecx, [esp + 0x28]
mov byte [esp + 0x2b0], 4
call fcn.00508010
mov byte [esp + 0x2b0], 3
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4463c2
push eax
call fcn.0051ebab
add esp, 4
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov byte [esp + 0x2b0], 2
mov eax, dword [esp + 0x40]
cmp eax, ebx
je 0x4463db
push eax
call fcn.0051ebab
add esp, 4
mov eax, dword [esp + 0x28]
cmp eax, ebx
jne 0x4463e8
mov eax, 0x54ee24
lea ecx, [esp + 0x4c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x446482
nop
cmp word [esp + 0x78], 0x2e
je 0x44646b
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00508260
add esp, 0xc
lea ecx, [esp + 0x34]
mov byte [esp + 0x2b0], 5
call fcn.00508010
mov byte [esp + 0x2b0], 2
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x446455
push eax
call fcn.0051ebab
add esp, 4
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov esi, dword [esp + 0x34]
mov eax, esi
cmp esi, ebx
jne 0x446464
mov eax, 0x54ee24
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [esp + 0x4c]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x446400
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [esp + 0x2b0], 1
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x44649b
push eax
call fcn.0051ebab
add esp, 4
mov byte [esp + 0x2b0], bl
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x4464b3
push eax
call fcn.0051ebab
add esp, 4
mov dword [esp + 0x2b0], 0xffffffff
cmp esi, ebx
je 0x4464cb
push esi
call fcn.0051ebab
add esp, 4
mov ecx, dword [esp + 0x2a8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x290]
xor ecx, esp
call fcn.0051eb9c
mov esp, ebp
pop ebp
ret 4
Function at 0x4473b0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x537f80
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, edx
xor ebx, ebx
cmp dword [esi + 4], ebx
jle 0x44748a
lea eax, [ebp - 0x24]
push eax
push edi
call fcn.00446da0
mov dword [ebp - 4], ebx
mov eax, dword [esi]
cmp eax, ebx
jne 0x4473ff
mov eax, 0x54ee24
cmp dword [ebp - 0x20], ebx
jle 0x447413
mov ecx, dword [ebp - 0x24]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x447473
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
lea eax, [edi + 0x2c]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00508010
push 0x54ede0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x54ede0
lea edi, [ebp - 0x18]
call fcn.00507dd0
mov eax, dword [esi]
push eax
mov eax, dword [esi + 4]
call fcn.00507dd0
mov esi, dword [ebp - 0x18]
mov eax, esi
cmp esi, ebx
jne 0x44745c
mov eax, 0x54ee24
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], bl
cmp esi, ebx
je 0x447473
push esi
call fcn.0051ebab
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x44748a
push eax
call fcn.0051ebab
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4488c0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push 0
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push 0
lea eax, [ebp - 4]
push eax
xor bl, bl
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
call esi
test eax, eax
jne 0x44890e
push 8
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push eax
lea ecx, [ebp - 4]
push ecx
call esi
test eax, eax
je 0x448985
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push 0
push 0
push 0x8004
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x44892d
xor bl, bl
jmp 0x448985
mov ecx, dword [ebp - 8]
push 0
push 0x10
push 0x576b48
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x448929
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0xc]
push edx
push 0x280010
push eax
push 0x6801
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x448929
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push edx
mov edx, dword [ebp - 0xc]
lea eax, [ebp + 0xc]
push eax
push ecx
push 0
push 1
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
setne bl
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [ebp - 4]
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4489b0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push 0
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push 0
lea eax, [ebp - 4]
push eax
xor bl, bl
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
call esi
test eax, eax
jne 0x4489fe
push 8
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push eax
lea ecx, [ebp - 4]
push ecx
call esi
test eax, eax
je 0x448a71
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push 0
push 0
push 0x8004
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x448a1d
xor bl, bl
jmp 0x448a71
mov ecx, dword [ebp - 8]
push 0
push 0x10
push 0x576b48
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x448a19
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0xc]
push edx
push 0x280010
push eax
push 0x6801
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x448a19
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
lea edx, [ebp + 0xc]
push edx
push eax
push 0
push 1
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
setne bl
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 4]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x449dc0
Capabilities:
Check if file exists

Disassembly:
push ebx
xor bl, bl
test esi, esi
je 0x449e03
cmp word [esi], 0
je 0x449e03
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x449df7
push esi
mov dword [edi], 0
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x449ded
mov al, 1
pop ebx
ret
mov al, bl
mov dword [edi], 2
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
mov al, bl
pop ebx
ret
mov al, bl
mov dword [edi], 0x57
pop ebx
ret
Function at 0x449e10
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x539598
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
xor bl, bl
cmp eax, edi
je 0x449fe3
cmp word [eax], di
je 0x449fe3
push eax
lea esi, [ebp - 0x18]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
call fcn.00507d60
mov eax, dword [ebp + 8]
push eax
mov eax, esi
mov dword [ebp - 4], edi
call fcn.0044a010
mov edi, eax
xor eax, eax
cmp edi, eax
jle 0x449fca
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
lea esp, [esp]
push 0x54ede0
or esi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x449ed1
test edi, edi
js 0x449ed1
mov ecx, dword [ebp - 0x14]
cmp edi, ecx
jge 0x449ed1
add eax, edi
cmp eax, ecx
jg 0x449ed1
mov ebx, dword [ebp - 0x18]
lea eax, [ebx + edi*2]
push 0x54ede0
push eax
call fcn.0052098c
add esp, 8
test eax, eax
je 0x449ed1
sub eax, ebx
sar eax, 1
mov esi, eax
xor ebx, ebx
mov edi, esi
cmp esi, ebx
jle 0x449f15
lea ecx, [ebp - 0x30]
push ecx
mov edx, esi
lea ecx, [ebp - 0x18]
call fcn.00507640
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.00508010
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x30]
lea edi, [esi + 1]
cmp eax, ebx
je 0x449f20
push eax
call fcn.0051ebab
add esp, 4
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
jmp 0x449f20
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x24]
call fcn.00508010
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x449f89
cmp word [ebx], 0
je 0x449f89
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x449f7a
mov esi, dword [ebp + 8]
push ebx
mov dword [esi], 0
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x449f96
mov dword [esi], 2
mov eax, ebx
test ebx, ebx
jne 0x449f5d
mov eax, 0x54ee24
xor bl, bl
test eax, eax
je 0x449fa4
cmp word [eax], 0
je 0x449fa4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x449f9a
mov bl, 1
jmp 0x449faa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov esi, edx
jmp 0x449f52
mov eax, dword [ebp + 8]
mov dword [eax], 0x57
mov esi, eax
jmp 0x449f52
mov bl, 1
jmp 0x449fae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
jmp 0x449faa
mov dword [esi], 0x57
test bl, bl
je 0x449fb6
test edi, edi
jg 0x449e90
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x449fca
push eax
call fcn.0051ebab
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x449fec
push eax
call fcn.0051ebab
add esp, 4
jmp 0x449fec
mov ecx, dword [ebp + 8]
mov dword [ecx], 0x57
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x44a280
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c8
mov eax, dword [0x575494]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, word [ebp + 0xc]
mov dword [ebp - 0x2bc], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, esi
mov dword [ebp - 0x2c0], ecx
mov dword [ebp - 0x2c8], edx
call fcn.00448fc0
test al, al
je 0x44a334
mov ecx, dword [ebp - 0x2c8]
mov edx, dword [ebp - 0x2c0]
push ecx
push edx
push edi
lea eax, [esi + 0x14]
push ebx
mov ebx, dword [ebp - 0x2bc]
mov dword [ebp - 0x2c4], eax
call fcn.00512ad0
mov ebx, eax
test ebx, ebx
je 0x44a336
mov ax, word [ebp - 0x2bc]
push 0x4003
push 0x2b4
lea ecx, [ebp - 0x2b8]
push ecx
push 0
push 0x553d14
mov word [esi + 0x4c], ax
mov dword [esi + 0x50], ebx
mov dword [esi + 0x6c], edi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x44a321
mov edx, dword [ebp - 0x2c4]
push eax
call fcn.00512bb0
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051eb9c
mov esp, ebp
pop ebp
ret 8
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0051eb9c
mov esp, ebp
pop ebp
ret 8

Function at 0x44c8e0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [edi + 0x13c8]
push esi
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea esi, [edi + 0x3c]
call fcn.0051bfd0
pop esi
test al, al
je 0x44c907
push edi
call fcn.0044d540
mov byte [edi + 0x13cc], 0
mov eax, dword [edi + 0x30]
test eax, eax
je 0x44c91f
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
mov ecx, dword [edi + 0x2c]
mov edx, dword [ecx + 4]
mov dword [edi + edx + 0x2c], 6
ret

Function at 0x44ca70
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 0x40]
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x44ca85
push 3
push eax
call edi
jmp 0x44ca93
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + 4]
mov dword [esi + ecx + 0x3c], 6
mov eax, dword [esi + 0xb88]
test eax, eax
je 0x44caa4
push 0
push eax
call edi
jmp 0x44cab8
mov edx, dword [esi + 0xb84]
mov eax, dword [edx + 4]
mov dword [esi + eax + 0xb84], 6
mov eax, dword [esi + 0xe34]
test eax, eax
je 0x44cac9
push 5
push eax
call edi
pop edi
ret
mov ecx, dword [esi + 0xe30]
mov edx, dword [ecx + 4]
mov dword [esi + edx + 0xe30], 6
pop edi
ret

Function at 0x44cae0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 0x40]
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x44caf5
push 9
push eax
call edi
jmp 0x44cb03
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + 4]
mov dword [esi + ecx + 0x3c], 6
mov eax, dword [esi + 0xe34]
test eax, eax
je 0x44cb14
push 0
push eax
call edi
jmp 0x44cb28
mov edx, dword [esi + 0xe30]
mov eax, dword [edx + 4]
mov dword [esi + eax + 0xe30], 6
mov eax, dword [esi + 0xb88]
test eax, eax
je 0x44cb39
push 5
push eax
call edi
pop edi
ret
mov ecx, dword [esi + 0xb84]
mov edx, dword [ecx + 4]
mov dword [esi + edx + 0xb84], 6
pop edi
ret
Function at 0x44cdb0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 2
push ebx
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push esi
lea esi, [edi + 0x26c]
jne 0x44ce13
mov eax, dword [esi + 0x91c]
test eax, eax
je 0x44cdd8
push 0
push eax
call ebx
jmp 0x44cdec
mov eax, dword [esi + 0x918]
mov ecx, dword [eax + 4]
mov dword [esi + ecx + 0x918], 6
mov eax, dword [esi + 0xbc8]
test eax, eax
je 0x44cdfd
push 5
push eax
call ebx
jmp 0x44ce63
mov edx, dword [esi + 0xbc4]
mov eax, dword [edx + 4]
mov dword [esi + eax + 0xbc4], 6
jmp 0x44ce63
mov eax, dword [esi + 0xbc8]
test eax, eax
je 0x44ce24
push 0
push eax
call ebx
jmp 0x44ce38
mov ecx, dword [esi + 0xbc4]
mov edx, dword [ecx + 4]
mov dword [esi + edx + 0xbc4], 6
mov eax, dword [esi + 0x91c]
test eax, eax
je 0x44ce49
push 5
push eax
call ebx
jmp 0x44ce5d
mov eax, dword [esi + 0x918]
mov ecx, dword [eax + 4]
mov dword [esi + ecx + 0x918], 6
cmp dword [ebp + 0xc], 0
jne 0x44ce9a
mov ebx, dword [ebp + 8]
lea eax, [edi + 0xb8]
call fcn.0051c750
mov ebx, dword [ebp + 0x10]
mov ecx, ebx
call fcn.0044e450
mov eax, dword [ebp + 0x14]
mov edx, ebx
sub edx, dword [edi + 0x1448]
sub eax, dword [edi + 0x144c]
mov dword [edi + 0x1428], edx
mov dword [edi + 0x142c], eax
jmp 0x44ce9d
mov ebx, dword [ebp + 0x10]
mov cx, word [edi + 0x13f0]
sub cx, word [edi + 0x13d4]
mov ax, word [edi + 0x13d8]
add cx, word [ebp + 0x14]
add ax, ax
movzx edx, cx
sub bx, ax
mov eax, dword [edi + 0x13c8]
movzx ecx, bx
shl edx, 0x10
or edx, ecx
push edx
mov edx, dword [ebp + 0xc]
push edx
push 5
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x450760
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x541005
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebx + 4], 0x55427c
mov dword [ebx + 0x2c], 0x554284
mov dword [ebx + 0x469b0], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x14], eax
mov byte [ebx + 0x1c], al
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x24], eax
mov dword [ebx + 0x28], eax
mov dword [ebp - 0x10], eax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], eax
mov byte [ebx + 0x38], al
mov dword [ebp - 4], eax
lea eax, [ebx + 0x3c]
push eax
mov dword [ebx], vtable.CHomeClientWnd.0
call fcn.004544f0
lea edi, [ebx + 0xe68]
call fcn.00505370
lea esi, [ebx + 0x12d8]
call fcn.00503fe0
lea ecx, [ebx + 0x154c]
push ecx
mov byte [ebp - 4], 3
call fcn.004ad770
lea esi, [ebx + 0x13e70]
call fcn.004d55a0
lea edx, [ebx + 0x23df4]
push edx
mov byte [ebp - 4], 5
call fcn.0048a9e0
lea eax, [ebx + 0x44604]
push eax
mov byte [ebp - 4], 6
call fcn.00451be0
lea ecx, [ebx + 0x45924]
push ecx
mov byte [ebp - 4], 7
call fcn.00456aa0
xor eax, eax
mov dword [ebx + 0x4697c], eax
mov dword [ebx + 0x46980], eax
mov dword [ebx + 0x46984], eax
mov dword [ebx + 0x46988], eax
mov dword [ebx + 0x4698c], eax
mov dword [ebx + 0x46990], eax
mov dword [ebx + 0x46994], eax
mov dword [ebx + 0x46998], eax
mov dword [ebx + 0x4699c], eax
mov dword [ebx + 0x469a0], eax
mov dword [ebx + 0x469a4], eax
mov byte [ebx + 0x469a8], al
mov dword [ebx + 0x469ac], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x451340
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea edi, [esi + 0x4697c]
push edi
mov ecx, str.BrCcHome.sdd
mov ebx, eax
call fcn.00470370
cmp byte [ebp + 0x18], 0
lea eax, [esi + 0x4698c]
je 0x451372
push str.ScanFuncPage_Mini_Wnd
jmp 0x451377
push str.ScanFuncPage_Wnd
call fcn.005080c0
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x451388
mov eax, 0x54ee24
cmp dword [edi + 8], 0
mov dword [ebp - 4], 0
jle 0x4513bd
test eax, eax
je 0x4513bd
cmp word [eax], 0
je 0x4513bd
mov ecx, dword [edi + 4]
test ecx, ecx
jne 0x4513ab
mov ecx, 0x54ee24
push ecx
push 0
push str.PosiX
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 4], eax
mov ecx, dword [edi + 0x10]
test ecx, ecx
jne 0x4513c9
mov ecx, 0x54ee24
xor edx, edx
mov dword [ebp - 8], edx
cmp dword [edi + 8], edx
jle 0x4513fc
test ecx, ecx
je 0x4513fc
cmp word [ecx], dx
je 0x4513fc
mov eax, dword [edi + 4]
test eax, eax
jne 0x4513e8
mov eax, 0x54ee24
push eax
push 0
push str.PosiY
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 8], eax
mov edx, eax
mov eax, dword [ebp + 0x18]
sub ebx, dword [esi + 0x469a0]
mov ecx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp - 4]
push 1
sub ebx, edx
push ebx
push ecx
mov ecx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push ecx
lea edi, [esi + 0x154c]
mov dword [esi + 0x4699c], edx
call fcn.004ad960
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
push edx
mov edx, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push ecx
push edx
mov edx, dword [ebp - 8]
push eax
add esi, 0x13e70
call fcn.004d57e0
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 4]
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 8]
push ecx
mov ecx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 0xc]
push eax
push ecx
push edx
add edi, 0x23df4
mov eax, ebx
mov edx, esi
call fcn.0048abf0
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edi, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push ebx
push ecx
mov ecx, dword [ebp + 8]
push edi
push edx
add ecx, 0x44604
mov edx, esi
call fcn.00451fa0
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push ebx
push ecx
mov ecx, dword [ebp + 8]
push edi
push edx
add ecx, 0x45924
mov edx, esi
call fcn.00456e60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4514d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [edi + 0x469a4]
push ebx
push esi
test eax, eax
je 0x4515c9
cmp eax, 0x5000000
ja 0x451544
je 0x451519
cmp eax, 0x1000000
je 0x45150c
cmp eax, 0x3000000
jne 0x451588
lea ecx, [edi + 0x1578]
call fcn.0051c6c0
jmp 0x451588
lea ecx, [edi + 0x13e9c]
call fcn.0051c6c0
jmp 0x451588
mov eax, dword [edi + 0x23e24]
test eax, eax
je 0x45152e
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x451588
mov eax, dword [edi + 0x23e20]
mov ecx, dword [eax + 4]
mov dword [edi + ecx + 0x23e20], 6
jmp 0x451588
cmp eax, 0x6000000
je 0x45155f
cmp eax, 0x7000000
jne 0x451588
lea ecx, [edi + 0x45950]
call fcn.0051c6c0
jmp 0x451588
mov eax, dword [edi + 0x44634]
test eax, eax
je 0x451574
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x451588
mov edx, dword [edi + 0x44630]
mov eax, dword [edx + 4]
mov dword [edi + eax + 0x44630], 6
call fcn.00513550
mov esi, eax
test esi, esi
je 0x4515c9
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
push 0xffffffffffffffff
push 0
push 0x830f
push esi
call ebx
push 0xffffffffffffffff
push 0
push 0x8310
push esi
call ebx
push 0xffffffffffffffff
push 0
push 0x8311
push esi
call ebx
push 0xffffffffffffffff
push 0
push 0x8312
push esi
call ebx
mov ebx, dword [ebp + 8]
and ebx, 0x1f000000
cmp ebx, 0x5000000
ja 0x451634
je 0x45161c
cmp ebx, 0x1000000
je 0x451604
cmp ebx, 0x3000000
jne 0x451667
lea esi, [edi + 0x154c]
call fcn.004adb60
mov dword [edi + 0x469a4], ebx
pop esi
pop ebx
pop ecx
pop ebp
ret 4
lea esi, [edi + 0x13e70]
call fcn.004d5910
mov dword [edi + 0x469a4], ebx
pop esi
pop ebx
pop ecx
pop ebp
ret 4
lea esi, [edi + 0x23df4]
call fcn.0048ad10
mov dword [edi + 0x469a4], ebx
pop esi
pop ebx
pop ecx
pop ebp
ret 4
cmp ebx, 0x6000000
je 0x45165c
cmp ebx, 0x7000000
jne 0x451667
lea esi, [edi + 0x45924]
call fcn.004570e0
mov dword [edi + 0x469a4], ebx
pop esi
pop ebx
pop ecx
pop ebp
ret 4
lea esi, [edi + 0x44604]
call fcn.00452220
pop esi
mov dword [edi + 0x469a4], ebx
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x451680
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x532fb8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea esi, [edi + 0x44604]
call fcn.00452680
lea esi, [edi + 0x45924]
call fcn.00452680
xor ebx, ebx
cmp byte [0x57804a], bl
je 0x451733
cmp byte [0x5786b7], bl
je 0x451733
cmp byte [0x5786b8], bl
jne 0x451733
push 0x578092
lea esi, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.00507d60
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x18]
cmp eax, ebx
jne 0x4516fc
mov eax, 0x54ee24
push eax
lea ebx, [edi + 0xe68]
call fcn.005059c0
lea ecx, [edi + 0xe94]
call fcn.0051c6a0
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
call fcn.00507320
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0xe98]
cmp eax, ebx
je 0x451756
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0xe94]
mov ecx, dword [eax + 4]
mov dword [edi + ecx + 0xe94], 6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret