joyce8/EMBER2024-capa huggingface dataset:
Function at 0x479420
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x5c7004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x5ce2ec]
push ebx
mov ebx, dword [0x5ce2e8]
push esi
mov dword [ebp - 0x12c], eax
lea esi, [edx + 1]
push edi
lea eax, [ebp - 0x120]
mov dword [ebp - 0x13c], ebx
push eax
call sym.ProcessHacker.exe_PhInitializeAutoPool
lea eax, [ebp - 0x128]
mov dword [ebp - 0x140], esi
push eax
lea eax, [ebp - 0x130]
mov ecx, ebx
push eax
lea edx, [ebp - 0x138]
call fcn.004ed0e0
mov ebx, dword [ebp - 0x128]
lea ecx, [ebp - 0x124]
push ebx
mov edx, esi
call fcn.004ec6c0
xor edi, edi
test ebx, ebx
je 0x479522
jmp 0x4794a0
mov eax, dword [ebp - 0x130]
mov ebx, dword [eax + edi*4]
mov eax, ebx
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4794b0
push dword [0x5cd4f8]
sub eax, edx
sar eax, 1
lea ecx, [eax + eax]
lea eax, [eax*2 + 0xa]
mov dword [ebp - 0x134], ecx
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov esi, eax
xor edx, edx
mov eax, dword [ebp - 0x134]
lea ecx, [esi + 8]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov word [ecx + eax], dx
test ebx, ebx
je 0x479502
push eax
push ebx
push dword [esi + 4]
call fcn.00537fe0
add esp, 0xc
push esi
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov edx, dword [ebp - 0x124]
mov ebx, dword [ebp - 0x128]
mov ecx, dword [edx]
mov dword [ecx + edi*4], eax
inc edi
cmp edi, ebx
jb 0x4794a0
mov edi, edi
jmp 0x479528
mov edx, dword [ebp - 0x124]
mov eax, dword ds:[ebp - 0x12c]
xor esi, esi
mov edi, dword [ebp - 0x138]
mov dword [ebp - 8], 1
cmp dword [eax], esi
jbe 0x47956f
push ebx
push edi
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x13c]
push edx
mov edx, dword [eax + 8]
push 0
mov edx, dword [edx + esi*4]
call fcn.00479260
mov eax, dword [ebp - 0x12c]
inc esi
mov edx, dword [ebp - 0x124]
cmp esi, dword [eax]
jb 0x479544
push edi
push 0
push dword [0x5cd55c]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [ebp - 0x130]
push 0
push dword [0x5cd55c]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [ebp + 0xc]
mov edx, dword [ebp - 0x140]
mov ecx, dword [ebp - 0x124]
push ebx
call fcn.004ec820
mov esi, eax
lea eax, [ebp - 0x120]
push eax
call sym.ProcessHacker.exe_PhDrainAutoPool
push dword [0x5cf03c]
jmp 0x4795c0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea ecx, [ebp - 0x120]
cmp eax, ecx
jne 0x47960f
push dword [ebp - 0x10]
push dword [0x5cf03c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
test eax, eax
je 0x47960f
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4795fa
push eax
push 0
push dword [0x5cd55c]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00534c91
mov esp, ebp
pop ebp
ret 8
push 0xc0000001
call dword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
Function at 0x47fb80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x5c7004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x12c], eax
lea esi, [edx + 1]
push edi
lea eax, [ebp - 0x120]
mov ebx, ecx
push eax
mov dword [ebp - 0x13c], ebx
call sym.ProcessHacker.exe_PhInitializeAutoPool
lea eax, [ebp - 0x128]
mov dword [ebp - 0x140], esi
push eax
lea eax, [ebp - 0x130]
mov ecx, ebx
push eax
lea edx, [ebp - 0x138]
call fcn.004ed0e0
mov ebx, dword [ebp - 0x128]
lea ecx, [ebp - 0x124]
push ebx
mov edx, esi
call fcn.004ec6c0
xor edi, edi
test ebx, ebx
je 0x47fc70
mov eax, dword [ebp - 0x130]
mov ebx, dword [eax + edi*4]
mov eax, ebx
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x47fc00
push dword [0x5cd4f8]
sub eax, edx
sar eax, 1
lea ecx, [eax + eax]
lea eax, [eax*2 + 0xa]
mov dword [ebp - 0x134], ecx
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov esi, eax
xor edx, edx
mov eax, dword [ebp - 0x134]
lea ecx, [esi + 8]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov word [ecx + eax], dx
test ebx, ebx
je 0x47fc52
push eax
push ebx
push dword [esi + 4]
call fcn.00537fe0
add esp, 0xc
push esi
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov edx, dword [ebp - 0x124]
mov ebx, dword [ebp - 0x128]
mov ecx, dword [edx]
mov dword [ecx + edi*4], eax
inc edi
cmp edi, ebx
jb 0x47fbf1
jmp 0x47fc76
mov edx, dword [ebp - 0x124]
mov eax, dword [ebp - 0x12c]
xor esi, esi
mov edi, dword [ebp - 0x138]
mov dword [ebp - 8], 1
cmp dword [eax], esi
jbe 0x47fcbb
nop
push ebx
push edi
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x13c]
push edx
mov edx, dword [eax + 8]
push 0
mov edx, dword [edx + esi*4]
call fcn.0047f9c0
mov eax, dword [ebp - 0x12c]
inc esi
mov edx, dword [ebp - 0x124]
cmp esi, dword [eax]
jb 0x47fc90
push edi
push 0
push dword [0x5cd55c]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [ebp - 0x130]
push 0
push dword [0x5cd55c]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [ebp + 0xc]
mov edx, dword [ebp - 0x140]
mov ecx, dword [ebp - 0x124]
push ebx
call fcn.004ec820
mov esi, eax
lea eax, [ebp - 0x120]
push eax
call sym.ProcessHacker.exe_PhDrainAutoPool
push dword [0x5cf03c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea ecx, [ebp - 0x120]
cmp eax, ecx
jne 0x47fd5b
push dword [ebp - 0x10]
push dword [0x5cf03c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x47fd5b
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x47fd46
push eax
push 0
push dword [0x5cd55c]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00534c91
mov esp, ebp
pop ebp
ret 8
push 0xc0000001
call dword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
Function at 0x482040
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x5c7004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x12c], eax
lea esi, [edx + 1]
push edi
lea eax, [ebp - 0x120]
mov ebx, ecx
push eax
mov dword [ebp - 0x13c], ebx
call sym.ProcessHacker.exe_PhInitializeAutoPool
lea eax, [ebp - 0x128]
mov dword [ebp - 0x140], esi
push eax
lea eax, [ebp - 0x130]
mov ecx, ebx
push eax
lea edx, [ebp - 0x138]
call fcn.004ed0e0
mov ebx, dword [ebp - 0x128]
lea ecx, [ebp - 0x124]
push ebx
mov edx, esi
call fcn.004ec6c0
xor edi, edi
test ebx, ebx
je 0x482130
mov eax, dword [ebp - 0x130]
mov ebx, dword [eax + edi*4]
mov eax, ebx
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4820c0
push dword [0x5cd4f8]
sub eax, edx
sar eax, 1
lea ecx, [eax + eax]
lea eax, [eax*2 + 0xa]
mov dword [ebp - 0x134], ecx
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov esi, eax
xor edx, edx
mov eax, dword [ebp - 0x134]
lea ecx, [esi + 8]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov word [ecx + eax], dx
test ebx, ebx
je 0x482112
push eax
push ebx
push dword [esi + 4]
call fcn.00537fe0
add esp, 0xc
push esi
call sym.ProcessHacker.exe_PhAutoDereferenceObject
mov edx, dword [ebp - 0x124]
mov ebx, dword [ebp - 0x128]
mov ecx, dword [edx]
mov dword [ecx + edi*4], eax
inc edi
cmp edi, ebx
jb 0x4820b1
jmp 0x482136
mov edx, dword [ebp - 0x124]
mov eax, dword [ebp - 0x12c]
xor esi, esi
mov edi, dword [ebp - 0x138]
mov dword [ebp - 8], 1
cmp dword [eax], esi
jbe 0x48217b
nop
push ebx
push edi
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x13c]
push edx
mov edx, dword [eax + 8]
push 0
mov edx, dword [edx + esi*4]
call fcn.00481e80
mov eax, dword [ebp - 0x12c]
inc esi
mov edx, dword [ebp - 0x124]
cmp esi, dword [eax]
jb 0x482150
push edi
push 0
push dword [0x5cd55c]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [ebp - 0x130]
push 0
push dword [0x5cd55c]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [ebp + 0xc]
mov edx, dword [ebp - 0x140]
mov ecx, dword [ebp - 0x124]
push ebx
call fcn.004ec820
mov esi, eax
lea eax, [ebp - 0x120]
push eax
call sym.ProcessHacker.exe_PhDrainAutoPool
push dword [0x5cf03c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea ecx, [ebp - 0x120]
cmp eax, ecx
jne 0x48221b
push dword [ebp - 0x10]
push dword [0x5cf03c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x48221b
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x482206
push eax
push 0
push dword [0x5cd55c]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00534c91
mov esp, ebp
pop ebp
ret 8
push 0xc0000001
call dword [sym.imp.ntdll.dll_RtlRaiseStatus]
int3
Function at 0x48e5e0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5c7004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
call fcn.0048e540
push dword [0x5cd4fc]
push 0xc
call sym.ProcessHacker.exe_PhCreateObject
push 0x28
mov esi, eax
push 4
push dword [0x5cd55c]
mov dword [esi], 0
mov dword [esi + 4], 0xa
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [esi + 8], eax
mov dword [ebp - 0xc], esi
call fcn.0048d520
mov dword ds:[ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0x48e4c0
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
push eax
call dword [sym.imp.USER32.dll_EnumDesktopsW]
mov eax, dword [ebp - 0xc]
xor esi, esi
cmp dword [eax], esi
jbe 0x48e6b6
mov eax, dword ds:[eax + 8]
mov eax, dword [eax + esi*4]
test eax, eax
je 0x48e669
mov eax, dword [eax + 4]
jmp 0x48e66b
xor eax, eax
push eax
push 0
push 0x143
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
cmp edi, 0xffffffff
je 0x48e6ae
push 4
push 4
push dword [0x5cd55c]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ecx, dword [ebp - 0xc]
push eax
push edi
push 0x151
mov ecx, dword [ecx + 8]
push ebx
mov ecx, dword [ecx + esi*4]
mov dword [eax], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0xc]
inc esi
cmp esi, dword [eax]
jb 0x48e656
or esi, 0xffffffff
lea ecx, [eax - 8]
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x48e6cb
call fcn.004c1f60
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], esi
dec esi
jne 0x48e6de
call fcn.004c1f60
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00534c91
mov esp, ebp
pop ebp
ret
Function at 0x490380
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x5c7004]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x48], ecx
mov cl, al
push edi
mov edi, edx
mov byte [ebp - 0x41], al
call fcn.004902e0
xor ecx, ecx
mov dword [ebp - 0x40], 0x3c
mov ebx, eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], esi
test ebx, ebx
je 0x4903da
mov eax, dword [ebx + 4]
jmp 0x4903dc
xor eax, eax
cmp byte [ebp - 0x41], cl
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x38], eax
mov eax, str.runas
cmove eax, ecx
mov dword [ebp - 0x3c], 0x400
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x24], 0xa
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x490422
mov eax, dword [ebp - 8]
test eax, eax
je 0x49041d
push eax
call dword [sym.imp.ntdll.dll_NtClose]
xor esi, esi
jmp 0x490437
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x490437
movzx esi, si
or esi, 0xc0070000
test ebx, ebx
je 0x49044e
lea ecx, [ebx - 8]
or edx, 0xffffffff
lock xadd dword [ecx + 4], edx
dec edx
jne 0x49044e
call fcn.004c1f60
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00534c91
mov esp, ebp
pop ebp
ret 8
Function at 0x49d140
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5c7004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
mov ecx, dword [edi + 0x14]
cmp ecx, dword [0x5cebf8]
jne 0x49d182
mov ecx, edi
call fcn.0049e420
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
cmp ecx, dword [0x5cec00]
jne 0x49d28a
mov eax, dword [edi + 0x24]
sub eax, dword [edi + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 0x28]
sub eax, dword [edi + 0x20]
push ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], eax
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
test ebx, ebx
je 0x49d277
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [ebp - 8]
mov esi, eax
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push esi
mov dword [ebp - 0x1c], eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 1
push esi
mov dword [ebp - 0x18], eax
call dword [sym.imp.GDI32.dll_SetBkMode]
cmp byte [0x5cfdd4], 0
je 0x49d20d
mov ecx, dword [0x5cfce8]
sub ecx, 1
jne 0x49d232
push 0x2b2b2b
jmp 0x49d212
push 0xffffff
push esi
call dword [sym.imp.GDI32.dll_SetDCBrushColor]
push 0x12
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.USER32.dll_FillRect]
push 0xcc0020
push 0
push 0
push esi
push dword [edi + 0x28]
push dword [edi + 0x24]
push dword [edi + 0x20]
push dword [edi + 0x1c]
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [ebp - 0x18]
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push dword ds:[ebp - 0x1c]
call dword [sym.imp.GDI32.dll_DeleteObject]
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
push ebx
push dword [edi + 0x14]
call dword [sym.imp.USER32.dll_ReleaseDC]
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x5cec0c]
xor eax, eax
mov edx, dword [ecx]
test edx, edx
je 0x49d2af
mov ecx, dword [ecx + 8]
jmp 0x49d2a0
mov esi, dword [ecx]
cmp ebx, dword [esi + 0x5c]
je 0x49d2c2
inc eax
add ecx, 4
cmp eax, edx
jb 0x49d2a0
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 0x18]
lea eax, [edi + 0x1c]
push eax
mov ecx, esi
call fcn.0049e5c0
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00534c91
mov esp, ebp
pop ebp
ret
Function at 0x49e420
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5c7004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov eax, dword [edi + 0x24]
sub eax, dword [edi + 0x1c]
push dword [edi + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 0x28]
sub eax, dword [edi + 0x20]
mov dword [ebp - 8], eax
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
test ebx, ebx
je 0x49e597
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [ebp - 8]
mov esi, eax
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push esi
mov dword [ebp - 0x1c], eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 1
push esi
mov dword [ebp - 0x18], eax
call dword [sym.imp.GDI32.dll_SetBkMode]
cmp byte [0x5cfdd4], 0
je 0x49e4c2
mov ecx, dword [0x5cfce8]
sub ecx, 0
je 0x49e4c2
sub ecx, 1
jne 0x49e4eb
push 0xffffff
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0x2b2b2b
jmp 0x49e4d0
push 0
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0xffffff
push esi
call dword [sym.imp.GDI32.dll_SetDCBrushColor]
push 0x12
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.USER32.dll_FillRect]
cmp byte [0x5cec6c], 0
jne 0x49e4fd
cmp byte [0x5cec6e], 0
je 0x49e532
cmp byte [0x5cec6d], 0
je 0x49e51e
lea eax, [ebp - 0x14]
push eax
push eax
push 2
push 1
push esi
push dword [0x5ceca8]
call dword [sym.imp.UxTheme.dll_DrawThemeBackground]
jmp 0x49e532
push 5
call dword [sym.imp.USER32.dll_GetSysColorBrush]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.USER32.dll_FillRect]
push dword [0x5cec1c]
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push 0x25
lea eax, [ebp - 0x14]
push eax
push 4
push str.Back
push esi
call dword [sym.imp.USER32.dll_DrawTextW]
push 0xcc0020
push 0
push 0
push esi
push dword [edi + 0x28]
push dword [edi + 0x24]
push dword [edi + 0x20]
push dword [edi + 0x1c]
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [ebp - 0x18]
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push dword ds:[ebp - 0x1c]
call dword [sym.imp.GDI32.dll_DeleteObject]
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
push ebx
push dword [edi + 0x14]
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword ds:[ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00534c91
mov esp, ebp
pop ebp
ret
Function at 0x49efc0
Capabilities:
Hide graphical window

Disassembly:
cmp dword [0x5cec74], 0
push ebx
push esi
push edi
je 0x49f08e
mov eax, dword [0x5cec0c]
xor ecx, ecx
xor esi, esi
mov dword [0x5cec74], ecx
mov dword [0x5cecb0], ecx
cmp dword [eax], ecx
jbe 0x49f058
lea esp, [esp]
mov eax, dword [eax + 8]
push 0
push ecx
push 3
mov ebx, dword [eax + esi*4]
push ebx
mov edi, dword [ebx + 0xc]
mov ecx, edi
call dword [0x55890c]
call edi
mov edi, dword [ebx + 0x20]
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 3
push eax
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
push dword [ebx + 0x58]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebx + 0x54]
test eax, eax
je 0x49f046
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x5cec0c]
inc esi
cmp esi, dword [eax]
jae 0x49f058
mov ecx, dword [0x5cec74]
jmp 0x49eff0
push 0
push dword [0x5cec7c]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [0x5cebf8]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [0x5cec00]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
jmp fcn.0049ea00
pop edi
pop esi
pop ebx
ret
Function at 0x4a0000
Capabilities:
Get system information on windows

Disassembly:
movsx eax, byte [0x5cd558]
push esi
push edi
mov dword [0x5cecf4], eax
shl eax, 2
push eax
push 4
push dword [0x5cd55c]
mov dword [0x5ced5c], 0
mov dword [0x5ced60], 0
mov dword [0x5cecc0], 0
mov dword [0x5cecc4], 0
mov dword [0x5ced90], 0
mov dword [0x5ced94], 0
mov dword [0x5ced98], 0
mov dword [0x5ced9c], 0
mov dword [0x5ced80], 0
mov dword [0x5ced84], 0
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [0x5cecec], eax
mov eax, dword [0x5cecf4]
lea ecx, [eax*8]
sub ecx, eax
shl ecx, 2
push ecx
push 4
push dword [0x5cd55c]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [0x5cecb8], eax
mov eax, dword [0x5cecf4]
lea eax, [eax + eax*2]
shl eax, 3
push eax
push 4
push dword [0x5cd55c]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [0x5ced70], eax
mov eax, dword [0x5cecf4]
lea esi, [eax + eax*2]
shl esi, 3
push esi
push 4
push dword [0x5cd55c]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ecx, dword [0x5cecf4]
mov edx, eax
mov dword [0x5ced68], edx
mov dword [0x5ceda8], 0
mov dword [0x5ceda0], 0
mov dword [0x5ceda4], 0
mov byte [0x5cedac], 0
mov dword [0x5cedb0], 0
mov dword [0x5cedb4], 0
mov dword [0x5cedb8], 0xffffffff
test ecx, ecx
je 0x4a017c
mov eax, dword [0x5cecb8]
add eax, 4
mov dword [eax + 4], 0
lea eax, [eax + 0x1c]
mov dword [eax - 0x20], 0
mov dword [eax - 0x1c], 0
mov byte [eax - 0x14], 0
mov dword [eax - 0x10], 0
mov dword [eax - 0xc], 0
mov dword [eax - 8], 0xffffffff
sub ecx, 1
jne 0x4a0146
push esi
push edx
push 0
push 0
push 0xb
mov dword [0x5ced54], 0
call dword [sym.imp.ntdll.dll_NtPowerInformation]
mov edi, dword [0x5ced68]
test eax, eax
jns 0x4a01aa
push esi
push 0
push edi
call fcn.00536b00
add esp, 0xc
mov esi, dword [0x5cecf4]
xor ecx, ecx
mov dword [0x5cecd0], ecx
test esi, esi
je 0x4a01d3
lea edx, [edi + 4]
nop
cmp ecx, dword [edx]
cmovb ecx, dword [edx]
lea edx, [edx + 0x18]
sub esi, 1
jne 0x4a01c0
mov dword [0x5cecd0], ecx
pop edi
mov dword [0x5ced88], 0
mov dword [0x5ceccc], 0
pop esi
jmp fcn.004a2540
Function at 0x4a2540
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x5c7004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x100
push 4
push dword [0x5cd55c]
mov dword [ebp - 8], 0x100
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push ebx
push 0x64
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov edi, eax
xor esi, esi
cmp edi, 0xc0000004
jne 0x4a25d4
jmp 0x4a2590
cmp esi, 8
jae 0x4a25f1
push ebx
push 0
push dword [0x5cd55c]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [ebp - 8]
push 4
push dword [0x5cd55c]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push ebx
push 0x64
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov edi, eax
inc esi
cmp edi, 0xc0000004
je 0x4a2590
test edi, edi
js 0x4a25f1
mov eax, edi
mov dword [0x5ced88], ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00534c91
mov esp, ebp
pop ebp
ret
push ebx
push 0
lfence
push dword [0x5cd55c]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00534c91
mov esp, ebp
pop ebp
ret