joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427dc0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4eb17c
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push esi
push edi
mov eax, dword [0x5299c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 8
call fcn.004ab698
mov edi, eax
add esp, 4
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], 0
test edi, edi
je 0x427f58
push 0x34
mov byte [ebp - 4], 1
mov dword [edi], vtable.ThreadPoolHelper.0
call fcn.004ab698
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x427f40
mov edi, dword [0x529170]
lea esi, [eax + 4]
push 0
mov dword [eax], vtable.ThreadPool.0
mov ecx, esi
mov dword [ebp - 0x18], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00432ab0
mov dword [esi], eax
mov esi, dword [ebp - 0x14]
lea eax, [esi + 0xc]
mov byte [ebp - 4], 3
mov dword [ebp - 0x18], eax
mov ecx, eax
mov dword [eax], 0
mov dword [eax + 4], 0
call fcn.00432a70
mov dword [esi + 0xc], eax
lea eax, [esi + 0x1c]
mov byte [ebp - 4], 4
push eax
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x18], eax
test eax, eax
je 0x427f6d
cmp dword [esi + 0x14], 0
mov dword [ebp - 0x10], 0
jle 0x427f27
lea eax, [ebp - 0x18]
push eax
push 4
push esi
push 0x430c50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
je 0x427f6d
push 0
push 0
push 1
push 0
mov byte [ebp - 0x34], 1
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
lea ecx, [esi + 0xc]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x2c], edi
lea eax, [ebp - 0x24]
movups xmm0, xmmword [ebp - 0x34]
push 0
push eax
movups xmmword [ebp - 0x44], xmm0
call fcn.00420c00
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [esi + 0x14]
jl 0x427eb6
mov edi, dword [ebp - 0x1c]
mov eax, edi
mov dword [edi + 4], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor esi, esi
mov eax, edi
mov dword [edi + 4], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor edi, edi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x51c238
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 1
push eax
call fcn.004c283c
int3
Function at 0x428b40
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4eb2c8
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push esi
push edi
mov eax, dword [0x5299c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [ebp - 0x48]
call fcn.00421370
mov eax, dword [esi]
lea ecx, [ebp - 0x48]
push ecx
mov ecx, esi
mov dword [ebp - 4], 0
call dword [eax]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
lea ecx, [ebp - 0x44]
xor edi, edi
call fcn.0042c7b0
mov esi, eax
test esi, esi
je 0x428bc8
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x428bc8
push eax
push esi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], 0x529178
mov dword [ebp - 0x14], 0xffffffff
call fcn.00431000
mov edi, dword [ebp - 0x14]
push esi
call fcn.004d109a
add esp, 4
lea ecx, [ebp - 0x48]
call fcn.00411c80
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42c400
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x5299c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x34]
test eax, eax
je 0x42c435
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esi + 0x34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x34], 0
mov eax, dword [0x53490c]
test eax, eax
je 0x42c44e
push 0
push 1
push 0x8000
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push 0x40
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.004c3810
push dword [edi + 4]
lea eax, [ebp - 0x44]
push 0x4f9b4c
push 0x3f
push eax
call fcn.00408020
add esp, 0x1c
cmp dword [edi + 4], 0x2746
jne 0x42c48d
push 0x4f9b6c
lea eax, [ebp - 0x44]
push 0x3f
push eax
call fcn.00408020
add esp, 0xc
call fcn.0042bd70
lea ecx, [esi + 0x28]
mov eax, dword [eax]
push eax
push 0x2710
push 0x4f9b8c
lea eax, [ebp - 0x44]
push eax
call fcn.00430010
push 0
call fcn.004d2cf9
int3
Function at 0x431000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
test esi, esi
jle 0x431030
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [edi + 4]
movzx eax, byte [edx]
lea edx, [edx + 1]
mov ecx, dword [edi]
xor eax, ecx
movzx eax, al
shr ecx, 8
xor ecx, dword [ebx + eax*4]
mov dword [edi], ecx
sub esi, 1
jne 0x431015
pop ebx
pop edi
pop esi
pop ebp
ret 8
Function at 0x434760
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ebfb0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5299c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
lea ecx, [ebx + 0x15868]
mov dword [ebx], vtable.EventDispatcher.0
mov dword [ebx + 4], vtable.EventDispatcher.1.0
call fcn.00435ce0
mov ecx, 0x3e8
lea edi, [ebx + 0xfe8]
mov dword [ebp - 0x10], ecx
nop
mov eax, dword [edi]
test eax, eax
je 0x4347f0
xor esi, esi
cmp dword [edi - 0xfa0], esi
jle 0x4347e1
mov eax, dword [edi]
mov ecx, dword [eax + esi*4]
test ecx, ecx
je 0x4347d8
cmp dword [ecx + 0x10], 0
je 0x4347d8
mov eax, dword [ecx]
push 0
call dword [eax + 4]
mov eax, dword [edi]
inc esi
cmp esi, dword [edi - 0xfa0]
jl 0x4347c0
push eax
mov eax, dword [ebx + 0x158c4]
call eax
mov ecx, dword [ebp - 0x10]
add esp, 4
add edi, 4
sub ecx, 1
mov dword [ebp - 0x10], ecx
jne 0x4347b0
lea esi, [ebx + 0xbbc8]
mov edi, 0x2710
mov eax, dword [esi]
test eax, eax
je 0x434818
push eax
mov eax, dword [ebx + 0x158c4]
call eax
add esp, 4
mov dword [esi], 0
add esi, 4
sub edi, 1
jne 0x434806
cmp dword [ebx + 0x15814], edi
jle 0x43483f
push dword [ebx + 0x15810]
mov eax, dword [ebx + 0x158c4]
call eax
add esp, 4
mov eax, dword [ebx + 0x15808]
test eax, eax
je 0x434855
push eax
mov eax, dword [ebx + 0x158c4]
call eax
add esp, 4
push 1
push dword [ebx + 0xc]
mov dword [ebx + 0x14], 0
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x434884
push dword [ebx + 0xc]
mov dword [ebx + 8], 2
call esi
mov dword [ebx + 0xc], 0
push dword [ebx + 0x15818]
call esi
push 0x534914
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x534930]
test eax, eax
je 0x4348c4
sub eax, 1
mov dword [0x534930], eax
jne 0x4348c4
mov ecx, dword [0x53492c]
test ecx, ecx
je 0x4348c4
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [0x53492c], 0
push 0x534914
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebx + 0x15868]
mov dword [0x5349ec], 0
call fcn.00434930
mov esi, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea eax, [ebx + 0x1584c]
push eax
call esi
lea eax, [ebx + 0x15834]
push eax
call esi
lea eax, [ebx + 0x1581c]
push eax
call esi
lea ecx, [ebx + 0x1c]
call fcn.00434580
mov dword [ebx + 4], vtable.Utilities::SimpleThread.0
mov dword [ebx], vtable.Utilities::Singleton_class_EventDispatcher__class_Utilities::SingletonCreateUsingNew_.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x439df0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ec84a
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5299c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov dword [eax], vtable.DataTransferObjects::ShoppingCartDTO.0
mov dword [ebp - 4], 0
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
lea ecx, [eax + 0x54]
xorps xmm0, xmm0
movups xmmword [eax + 0x28], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
lea edi, [eax + 0xb4]
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
lea esi, [eax + 0xcc]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
push 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
movups xmmword [eax + 0xc], xmm0
push 0x4f6751
mov byte [ebp - 4], 4
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x30], 0
mov dword [eax + 0x34], 0
mov dword [eax + 0x38], 0
mov dword [eax + 0x3c], 0
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 5
movsd qword [eax + 0x48], xmm0
mov dword [eax + 0x50], 0
call fcn.00403090
mov eax, dword [ebp - 0x10]
xorps xmm0, xmm0
push 0
push 0x4f6751
mov ecx, edi
mov dword [eax + 0x6c], 0
mov dword [eax + 0x70], 0
mov dword [eax + 0x74], 1
mov dword [eax + 0x78], 0
mov dword [eax + 0x7c], 0
mov dword [eax + 0x80], 0
mov dword [eax + 0x84], 0
mov dword [eax + 0x88], 0
mov dword [eax + 0x8c], 0
mov dword [eax + 0xb0], 0
movups xmmword [eax + 0x90], xmm0
movups xmmword [eax + 0xa0], xmm0
call fcn.00403090
push 0
push 0x4f6751
mov ecx, esi
call fcn.00403090
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x440290
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x5299c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 0x124], ebx
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetParent]
push 0
push 0
mov esi, eax
push 0x40c
push esi
mov dword [ebp - 0x118], esi
call dword [sym.imp.USER32.dll_SendMessageA]
xor cl, cl
mov dword [ebp - 0x128], eax
xor edi, edi
mov byte [ebp - 0x111], cl
test eax, eax
jle 0x440484
nop word [eax + eax]
push 0x90
lea eax, [ebp - 0xa8]
mov dword [ebp - 0x120], 0x64
push 0
push eax
mov dword [ebp - 0xac], 0x94
call fcn.004c3810
add esp, 0xc
lea eax, [ebp - 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x44043f
cmp dword [ebp - 0xa8], 6
jb 0x44043f
xorps xmm0, xmm0
mov dword [ebp - 0x11c], 0
push str.comctl32.dll
movlpd qword [ebp - 0x14], xmm0
movlpd qword [ebp - 0xc], xmm0
mov dword [ebp - 0x18], 0x14
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x44043f
push str.DllGetVersion
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x440386
mov esi, 0x80004001
jmp 0x44038e
lea ecx, [ebp - 0x18]
push ecx
call eax
mov esi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
js 0x44039e
mov eax, dword [ebp - 0x14]
jmp 0x4403b0
cmp esi, 0x80004001
je 0x440439
mov eax, dword [ebp - 0x11c]
test esi, esi
mov esi, dword [ebp - 0x118]
js 0x44043f
cmp eax, 6
jb 0x44043f
mov eax, dword [ebp - 0x120]
push 0x5c
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x108]
push 0
push eax
mov dword [ebp - 0x10c], 0x11
call fcn.004c3810
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
push edi
push 0x41d
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x440415
mov ebx, dword [ebp - 0x124]
mov eax, dword [ebp - 0xf0]
cmp eax, dword [ebx + 4]
je 0x440446
inc edi
cmp edi, dword [ebp - 0x128]
jl 0x4402f0
mov al, byte [ebp - 0x111]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ab970
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x118]
mov eax, 0x50
jmp 0x4403c9
test dword [ebp - 0x108], 0x200
je 0x440422
push 0
push edi
push 0x42b
push esi
mov esi, dword [sym.imp.USER32.dll_PostMessageA]
call esi
push 0
push 0x28
push 0x100
push dword [ebx + 4]
call esi
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ab970
mov esp, ebp
pop ebp
ret
mov al, cl
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ab970
mov esp, ebp
pop ebp
ret
Function at 0x453f20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4edf08
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x5299c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 8
mov dword [esi + 0x30], 0
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0x201
mov dword [esi + 0x18], 6
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0xc], 0
call fcn.004ab698
mov edi, eax
add esp, 4
test edi, edi
je 0x453fbd
push 1
mov dword [ebp - 4], 0
call fcn.004a9497
add esp, 4
mov dword [edi + 4], eax
jmp 0x453fbf
xor edi, edi
mov eax, dword [ebp + 8]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], 0
mov edi, dword [edi + 4]
mov ecx, edi
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], edi
mov eax, dword [edi]
call dword [eax + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 2
push eax
call fcn.0040cd00
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
mov eax, dword [edx + 0x20]
call eax
mov bl, al
mov dword [ebp - 4], 3
test edi, edi
je 0x454021
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 8]
test eax, eax
je 0x454021
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [esi + 0x38], 0
mov dword [ebp - 4], 0xffffffff
mov byte [esi + 0x40], bl
jne 0x454044
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
and eax, 0x13
or eax, 4
mov dword [esi + 0xc], eax
and ecx, eax
jne 0x454067
cmp byte [ebp + 0xc], 0
je 0x454053
push esi
call fcn.004a9738
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test cl, 4
je 0x454073
mov esi, str.ios_base::badbit_set
jmp 0x454083
test cl, 2
mov esi, str.ios_base::failbit_set
mov eax, str.ios_base::eofbit_set
cmove esi, eax
lea eax, [ebp - 0x1c]
push 1
push eax
call fcn.0040ed60
add esp, 8
lea ecx, [ebp - 0x30]
push eax
push esi
call fcn.0040d1a0
push 0x519130
lea eax, [ebp - 0x30]
push eax
call fcn.004c283c
int3
Function at 0x4546e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4edf98
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x5299c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.Utilities::Singleton_class_Coordinators::DeviceCoordinator__class_Utilities::SingletonCreateInteractionObject_.0
lea esi, [edi + 4]
mov dword [ebp - 4], 0
mov ecx, esi
mov dword [ebp - 0x14], esi
call fcn.00436c60
mov dword [esi], vtable.InteractionObjectImpl.0
mov eax, edi
mov dword [esi + 4], 0x8c
mov dword [esi + 0xc], 0
mov dword [edi], vtable.Coordinators::DeviceCoordinator.0
mov dword [esi], vtable.Coordinators::DeviceCoordinator.1.0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x458c60
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push str.FSS_OPERATORAPP_WAIT_MUTEX
push 1
push 0
mov dword [esi + 4], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], vtable.WindowUtilites::WindowSyncHelper.0
mov dword [ebp - 4], esi
mov dword [esi + 0x24], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi + 0x24], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x458cd7
mov eax, dword [esi + 0x24]
test eax, eax
je 0x458cd7
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x458cd7
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x24], 0
mov dword [esi], vtable.Presentation::AboutDlg.0
mov eax, esi
mov dword [esi + 0x20], vtable.Presentation::AboutDlg.1.0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x459070
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x5299c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push 0x30
push 0
push esi
call fcn.004c3810
push 0x90
lea eax, [ebp - 0x94]
mov dword [ebp - 0x98], 0x94
push 0
push eax
call fcn.004c3810
add esp, 0x18
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4590d3
cmp dword [ebp - 0x94], 6
mov eax, 0x30
jae 0x4590d8
mov eax, 0x2c
mov ecx, dword [ebp + 0x10]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
test ecx, ecx
jne 0x4590f6
push edi
call dword [sym.imp.USER32.dll_GetParent]
or dword [esi + 4], 1
mov ecx, edi
jmp 0x4590f8
mov eax, edi
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0xc], ecx
test eax, eax
je 0x45910c
movups xmm0, xmmword [eax]
movups xmmword [esi + 0x10], xmm0
mov ecx, dword [0x534b98]
mov eax, esi
mov dword [esi + 0x20], ecx
mov ecx, dword [ebp + 0x18]
mov dword [esi + 0x24], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [esi + 0x28], ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004ab970
mov esp, ebp
pop ebp
ret 0x18
Function at 0x459ac0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4eea7e
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5299c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0xc]
mov dword [esi], vtable.DataTransferObjects::PosTerminalDTO.0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov dword [ebp - 4], 0
mov byte [ecx], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
push 0
push 0x4f6751
mov byte [ebp - 4], 2
mov dword [esi + 4], 0
mov dword [esi + 0x24], 0
mov dword [esi + 8], 0
call fcn.00403090
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x472cc0
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 8
push esi
mov esi, ecx
cmp eax, 0x10
je 0x472dbc
cmp eax, 0x20
je 0x472cec
mov eax, dword [ebp + 0x14]
pop esi
mov dword [eax], 0
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [esi + 0xa8]
test ecx, 4
je 0x472da8
test ecx, 0x10
je 0x472d46
push 0x20
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
lea eax, [ebp - 8]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 8], xmm0
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 8]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ScreenToClient]
push dword [ebp - 4]
mov ecx, esi
push dword [ebp - 8]
call fcn.004630b0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov eax, ecx
and eax, 0xf00000
cmp eax, 0x200000
jne 0x472e77
mov eax, ecx
and eax, 0xf000000
cmp eax, 0x2000000
jne 0x472e77
shr ecx, 8
and ecx, 0x3f
sub dword [esi + 0xa4], ecx
mov ecx, esi
call fcn.0047d480
mov ecx, esi
call fcn.0047eb50
mov ecx, esi
call fcn.0047ed40
push 1
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
test dword [esi + 0xa8], 0xc000
jne 0x472e77
push 0x20
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [esi + 0xa8]
test ecx, 2
je 0x472e6c
test ecx, 0x10
je 0x472e16
push 0x10
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
lea eax, [ebp - 8]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 8], xmm0
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 8]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ScreenToClient]
push dword [ebp - 4]
mov ecx, esi
push dword [ebp - 8]
call fcn.004630b0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov eax, ecx
and eax, 0xf00000
cmp eax, 0x300000
jne 0x472e77
mov eax, ecx
and eax, 0xf000000
cmp eax, 0x3000000
jne 0x472e77
shr ecx, 8
and ecx, 0x3f
add dword [esi + 0xa4], ecx
mov ecx, esi
call fcn.0047d480
mov ecx, esi
call fcn.0047eb50
mov ecx, esi
call fcn.0047ed40
push 1
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
test dword [esi + 0xa8], 0xc000
jne 0x472e77
push 0x10
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x478c70
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x1c], 0
push ebx
mov ebx, dword [ebp + 0x18]
push esi
push edi
mov edi, ecx
jne 0x478d9d
mov eax, dword [ebp + 0xc]
cmp eax, 0x110
jne 0x478cb1
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push pe_nt_image_headers32
call fcn.00470080
pop edi
mov dword [ebx], eax
mov eax, 1
pop esi
pop ebx
pop ebp
ret 0x18
mov esi, dword [ebp + 0x10]
mov edx, 1
cmp eax, 0x111
jne 0x478cfd
movzx ecx, si
cmp dx, cx
jne 0x478ce9
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x14]
push edx
shr esi, 0x10
mov ecx, edi
push esi
call fcn.0046f300
pop edi
mov dword [ebx], eax
mov eax, 1
pop esi
pop ebx
pop ebp
ret 0x18
mov edx, 2
cmp dx, cx
jne 0x478cfd
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x14]
push edx
jmp 0x478cd0
lea edx, [edi + 0x28]
cmp eax, 5
jne 0x478d6b
xor eax, eax
test edx, edx
cmove edi, eax
cmp byte [edx + 0x1c], al
je 0x478d3e
push 0xe801
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp esi, 2
jne 0x478d2f
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x478d43
test esi, esi
jne 0x478d3e
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x478d43
cmp esi, 1
je 0x478d8b
mov ecx, dword [ebp + 0x14]
mov eax, ecx
shr eax, 0x10
cwde
push eax
movsx eax, cx
lea ecx, [edi + 0x28]
push eax
call fcn.00466380
pop edi
pop esi
mov dword [ebx], 0
mov eax, 1
pop ebx
pop ebp
ret 0x18
cmp eax, 0x24
jne 0x478d9d
cmp dword [edx + 0x14], 0xffffffff
je 0x478d8b
cmp dword [edx + 0x18], 0xffffffff
je 0x478d8b
mov ecx, dword [ebp + 0x14]
mov eax, dword [edx + 0x14]
mov dword [ecx + 0x18], eax
mov eax, dword [edx + 0x18]
mov dword [ecx + 0x1c], eax
pop edi
pop esi
mov dword [ebx], 0
mov eax, 1
pop ebx
pop ebp
ret 0x18
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0x18

Function at 0x47ca20
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x5299c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x90
lea eax, [ebp - 0xa8]
mov dword [ebp - 0xac], 0x94
push 0
push eax
call fcn.004c3810
add esp, 0xc
lea eax, [ebp - 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x47cadc
cmp dword [ebp - 0xa8], 6
jb 0x47cadc
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0x14
push str.comctl32.dll
xor ebx, ebx
movlpd qword [ebp - 0x14], xmm0
movlpd qword [ebp - 0xc], xmm0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x47cadc
push str.DllGetVersion
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x47caae
mov esi, 0x80004001
jmp 0x47cab6
lea ecx, [ebp - 0x18]
push ecx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
js 0x47cac6
mov ebx, dword [ebp - 0x14]
jmp 0x47cace
cmp esi, 0x80004001
je 0x47cadc
test esi, esi
js 0x47cadc
mov eax, 0x64
cmp ebx, 6
jae 0x47cae1
mov eax, 0x50
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ab970
mov esp, ebp
pop ebp
ret