joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417ef4
Capabilities:
Continue service
Modify service
Persist via windows service
Set registry value
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
xor edi, edi
mov ebx, ecx
mov dword [ebp - 0xc], edi
call fcn.004185c0
push 1
push edi
push edi
mov byte [ebp - 0x10], al
call dword [0x46402c]
mov esi, dword [0x464288]
mov dword [ebp - 8], eax
call esi
push eax
push dword [ebp - 8]
push str.ForceExitService::OpenSCManager_Handle:_x_Error:_d_r_n
push dword [ebp - 0x10]
push ebx
call fcn.0041840b
add esp, 0x14
cmp dword [ebp - 8], edi
je 0x418013
push 0x30130
push str.ZhuDongFangYu
push dword [ebp - 8]
call dword [0x464030]
mov dword [ebp - 4], eax
call esi
push eax
push dword [ebp - 4]
push str.ForceExitService::OpenService_ZhuDongFangYu__Handle:_x_Error:_d_r_n
push dword [ebp - 0x10]
push ebx
call fcn.0041840b
add esp, 0x14
cmp dword [ebp - 4], edi
je 0x41800a
mov ecx, ebx
call fcn.0041801b
push 1
mov ecx, ebx
call fcn.004180b3
mov ecx, ebx
call fcn.0041805f
push edi
mov ecx, ebx
call fcn.00418089
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push 3
push 0xffffffffffffffff
push dword [ebp - 4]
call dword [0x464024]
lea eax, [ebp - 0xc]
push 4
push eax
push 4
push str.Start
push str.SYSTEMCurrentControlSetServicesZhuDongFangYu
push 0x80000002
mov dword [ebp - 0xc], 3
call dword [0x464444]
lea eax, [ebp - 0x2c]
push eax
push 0x8e
push dword [ebp - 4]
call dword [0x464028]
mov dword [ebp - 0xc], eax
call esi
push eax
push dword [ebp - 0xc]
push str.ForceExitService::ControlService___Ret:_d_Error:_d
push dword [ebp - 0x10]
push ebx
call fcn.0041840b
add esp, 0x14
cmp dword [ebp - 0xc], edi
jne 0x418001
call esi
push dword [ebp - 4]
call dword [0x464034]
push dword [ebp - 8]
call dword [0x464034]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41801b
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0xf003f
push esi
push str.SystemCurrentControlSetServicesZhuDongFangYu
push 0x80000002
call dword [0x464018]
test eax, eax
jne 0x41805a
push str.DeleteFlag
push dword [ebp - 4]
call dword [0x46401c]
push 1
pop esi
push dword [ebp - 4]
call dword [0x464020]
mov eax, esi
pop esi
leave
ret
Function at 0x4180e2
Capabilities:
Modify service
Pause service
Persist via windows service
Set registry value
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
xor edi, edi
mov ebx, ecx
mov dword [ebp - 8], edi
call fcn.004185c0
push 1
push edi
push edi
mov byte [ebp - 0x10], al
call dword [0x46402c]
mov esi, dword [0x464288]
mov dword [ebp - 0xc], eax
call esi
push eax
push dword [ebp - 0xc]
push str.Start360KrnlService::OpenSCManager_Handle:_x_Error:_d_r_n
push dword [ebp - 0x10]
push ebx
call fcn.0041840b
add esp, 0x14
cmp dword [ebp - 0xc], edi
je 0x418204
push 1
mov ecx, ebx
call fcn.00418089
push 0x30130
push str.ZhuDongFangYu
push dword [ebp - 0xc]
call dword [0x464030]
mov dword [ebp - 4], eax
call esi
push eax
push dword [ebp - 4]
push str.Start360KrnlService::OpenService_Handle:_x_Error:_d_r_n
push dword [ebp - 0x10]
push ebx
call fcn.0041840b
add esp, 0x14
cmp dword [ebp - 4], edi
je 0x4181fb
push 1
mov ecx, ebx
call fcn.004180b3
lea eax, [ebp - 8]
push 4
push eax
push 4
push str.Start
push str.SYSTEMCurrentControlSetServicesZhuDongFangYu
push 0x80000002
mov dword [ebp - 8], 2
call dword [0x464444]
push edi
push edi
push dword [ebp - 4]
call dword [0x464014]
mov dword [ebp - 8], eax
call esi
push eax
push dword [ebp - 8]
push str.Start360KrnlService::StartService___Ret:_d_Error:_d
push dword [ebp - 0x10]
push ebx
call fcn.0041840b
add esp, 0x14
cmp dword [ebp - 8], edi
je 0x4181f2
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push dword [ebp - 4]
call dword [0x464024]
lea eax, [ebp - 0x2c]
push eax
push 0x8c
push dword [ebp - 4]
call dword [0x464028]
mov dword [ebp - 8], 1
push dword [ebp - 4]
call dword [0x464034]
push dword [ebp - 0xc]
call dword [0x464034]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41820c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
mov esi, ecx
call fcn.004185c0
mov ecx, esi
mov byte [ebp - 4], al
call fcn.0041795b
mov edi, eax
xor eax, eax
test edi, edi
setge al
push eax
push str.RepairService:Service_Status:_d_r_n
push dword [ebp - 4]
push esi
call fcn.0041840b
add esp, 0x10
test edi, edi
jl 0x41824d
push 1
pop eax
jmp 0x418338
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x418336
push ebx
mov ecx, esi
call fcn.0041833f
test eax, eax
je 0x418336
push 0xe
xor eax, eax
pop ecx
lea edi, [ebp - 0x3c]
push str.RepairService:Reinstall_Service__r_n
push dword [ebp - 4]
rep stosd dword es:[edi], eax
xor edi, edi
mov dword [ebp - 0x30], ebx
push esi
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x34], str.open
mov dword [ebp - 0x2c], str.__install
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x3c], 0x40
mov ebx, 0x80004005
call fcn.0041840b
add esp, 0xc
lea eax, [ebp - 0x40]
push eax
call dword [0x46440c]
test eax, eax
je 0x41832d
push 0x2710
push dword [ebp - 8]
call dword [0x464200]
cmp dword [ebp - 8], edi
je 0x4182dd
push dword [ebp - 8]
call dword [0x464280]
mov ecx, esi
call fcn.004180e2
test eax, eax
jne 0x41830d
push edi
push str.RepairService:Start360Service_Fails_and_Retry___d_r_n
push dword [ebp - 4]
push esi
call fcn.0041840b
add esp, 0x10
inc edi
push 0x3e8
call dword [0x4641b8]
cmp edi, dword [ebp + 0xc]
jae 0x418322
jmp 0x4182dd
push str.RepairService:Start360Service_Succeed__r_n
xor ebx, ebx
push dword [ebp - 4]
push esi
call fcn.0041840b
add esp, 0xc
jmp 0x41832d
push str.Repair_Service_Fails__Cannot_Execute_Repair_Command_
call dword [0x464248]
xor eax, eax
test ebx, ebx
sete al
jmp 0x418338
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x41840b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
push ebx
xor ebx, ebx
cmp byte [ebp + 0xc], bl
je 0x4184c1
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x80e]
mov word [ebp - 0x810], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp - 0x810]
push dword [ebp + 0x10]
push 0x200
push eax
call fcn.0040df88
mov ecx, 0x103
xor eax, eax
lea edi, [ebp - 0x40e]
mov word [ebp - 0x410], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 1
lea eax, [ebp - 0x410]
push 0x1a
push eax
push ebx
mov word [ebp - 0x412], bx
call dword [0x464410]
test eax, eax
pop edi
je 0x4184c1
push esi
mov esi, dword [0x46444c]
lea eax, [ebp - 0x410]
push str.360Safe
push eax
call esi
lea eax, [ebp - 0x410]
push str.Zhudongfangyu.log
push eax
call esi
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.004184c4
pop esi
pop ebx
leave
ret
Function at 0x4186b6
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea esi, [ecx + 0x2d0]
push 1
push esi
push 0x45f
add ecx, 0x68
call fcn.00416d44
and dword [ebp - 4], 0
cmp dword [esi], 0
pop esi
je 0x4186e2
mov dword [ebp - 4], 1
lea eax, [ebp - 4]
push 4
push eax
push 4
push 0x472db0
push str.SOFTWARE360Safe_safemon
push 0x80000002
call dword [0x464444]
push 0
push 0x64
call fcn.0040718d
pop ecx
xor eax, eax
pop ecx
leave
ret 0x10

Function at 0x4191d2
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
lea eax, [ebp - 8]
xor esi, esi
push eax
mov dword [ebp - 8], esi
call fcn.00419300
pop ecx
push 1
pop ebx
cmp eax, ebx
jne 0x419200
xor eax, eax
cmp dword [ebp - 8], esi
setne al
jmp 0x4192fc
push esi
push str.Q360SafeMonClass
call dword [0x46458c]
cmp eax, esi
je 0x419248
lea ecx, [ebp - 4]
mov dword [ebp - 4], esi
push ecx
push 0x1388
push ebx
push esi
push 0x8c
push 0x416
push eax
call dword [0x4645b8]
test eax, eax
je 0x419248
cmp dword [ebp - 4], ebx
jne 0x41923f
mov eax, ebx
jmp 0x4192fc
cmp dword [ebp - 4], esi
je 0x4192d3
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x216]
mov word [ebp - 0x218], si
mov dword [ebp - 4], esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x208
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x465dec
push 0x465d6c
push 0x80000002
mov dword [ebp - 0x10], ebx
call dword [0x464438]
test eax, eax
pop edi
jne 0x4192f9
lea eax, [ebp - 0x218]
push 0x104
push eax
lea eax, [ebp - 0x218]
push eax
call dword [0x46418c]
lea eax, [ebp - 0x218]
push 0x465e60
push eax
call dword [0x46444c]
lea eax, [ebp - 0x218]
push eax
call dword [0x464440]
test eax, eax
jne 0x4192d7
xor eax, eax
jmp 0x4192fc
lea eax, [ebp - 0x218]
push eax
push esi
push str.ProtectSelf
push str.param
call dword [0x464190]
cmp eax, esi
mov dword [ebp - 4], eax
je 0x4192f9
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret
Function at 0x41b88e
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov edi, dword [0x4645c0]
mov esi, ecx
push 0x446
push dword [esi + 4]
call edi
mov ebx, dword [0x464588]
push 5
push eax
call ebx
push 0x447
push dword [esi + 4]
call edi
push 0
push eax
call ebx
push 0x448
push dword [esi + 4]
call edi
push 0
push eax
call ebx
and dword [esi + 0xb4], 0
mov ecx, esi
call fcn.0041b85b
pop edi
pop esi
xor eax, eax
pop ebx
ret 0x10

Function at 0x41b8e2
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov edi, dword [0x4645c0]
mov esi, ecx
push 0x446
push dword [esi + 4]
call edi
mov ebx, dword [0x464588]
push 0
push eax
call ebx
push 0x447
push dword [esi + 4]
call edi
push 5
push eax
call ebx
push 0x448
push dword [esi + 4]
call edi
push 0
push eax
call ebx
mov ecx, esi
mov dword [esi + 0xb4], 1
call fcn.0041b85b
pop edi
pop esi
xor eax, eax
pop ebx
ret 0x10

Function at 0x41b939
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov edi, dword [0x4645c0]
mov esi, ecx
push 0x446
push dword [esi + 4]
call edi
mov ebx, dword [0x464588]
push 0
push eax
call ebx
push 0x447
push dword [esi + 4]
call edi
push 0
push eax
call ebx
push 0x448
push dword [esi + 4]
call edi
push 5
push eax
call ebx
mov ecx, esi
mov dword [esi + 0xb4], 2
call fcn.0041b85b
pop edi
pop esi
xor eax, eax
pop ebx
ret 0x10

Function at 0x41bbd3
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
xor ebx, ebx
push dword [ebp + 8]
call fcn.00452e2c
mov edi, eax
cmp edi, ebx
je 0x41bbfd
push edi
call dword [0x464394]
mov esi, eax
pop ecx
cmp esi, ebx
jne 0x41bc01
xor eax, eax
jmp 0x41bc42
push esi
push edi
push ebx
push dword [ebp + 8]
call fcn.00452e26
test eax, eax
je 0x41bc38
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
push 0x4713f4
push esi
call fcn.00452e32
mov edx, dword [ebp + 0xc]
mov ebx, eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov dword [edx], ecx
mov ecx, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
mov dword [ecx], eax
push esi
call dword [0x4643a4]
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41db68
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
call dword [0x4640c8]
push dword [ebp + 0x1c]
mov dword [ebp - 4], eax
push eax
call dword [0x4640e8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x28]
push 3
mov esi, dword [ebp + 0x10]
cdq
pop ecx
mov edi, dword [ebp + 0xc]
idiv ecx
mov ebx, eax
mov eax, dword [ebp + 0x18]
add eax, esi
push eax
mov eax, dword [ebp + 0x14]
add eax, edi
push eax
push esi
push edi
call dword [0x4640e0]
push eax
mov dword [ebp + 0x1c], eax
push dword [ebp + 8]
call dword [0x464070]
push 0xcc0020
mov eax, dword [ebp + 0x28]
push dword [ebp + 0x24]
sub eax, ebx
push dword [ebp + 0x20]
push dword [ebp - 4]
push dword [ebp + 0x2c]
push eax
push esi
push edi
push dword [ebp + 8]
call dword [0x4640c0]
mov esi, dword [ebp + 0x28]
mov edx, dword [ebp + 0x14]
lea eax, [ebx + ebx]
sub esi, eax
mov eax, dword [ebp + 0xc]
mov ecx, eax
lea edi, [esi + ebx]
sub ecx, ebx
add edi, eax
add ecx, edx
cmp edi, ecx
mov dword [ebp + 0xc], ecx
jge 0x41dc2a
add eax, ebx
mov dword [ebp + 0x14], eax
push 0xcc0020
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push dword [ebp + 8]
push dword [ebp + 0x2c]
push esi
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call dword [0x4640c0]
add edi, esi
add esi, esi
cmp edi, dword [ebp + 0xc]
jl 0x41dc02
mov eax, dword [ebp + 0x20]
mov esi, dword [ebp - 4]
push 0xcc0020
sub eax, ebx
push dword [ebp + 0x24]
add eax, dword [ebp + 0x28]
push eax
push esi
push dword [ebp + 0x2c]
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x4640c0]
xor edi, edi
push edi
push dword [ebp + 8]
call dword [0x464070]
cmp dword [ebp + 0x1c], edi
je 0x41dc6c
push dword [ebp + 0x1c]
call dword [0x4640ec]
push dword [ebp - 8]
push esi
call dword [0x4640e8]
cmp esi, edi
je 0x41dc94
push esi
mov esi, dword [0x4640bc]
call esi
test eax, eax
je 0x41dc8a
mov dword [ebp - 4], edi
cmp dword [ebp - 4], edi
je 0x41dc94
push dword [ebp - 4]
call esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41de93
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 0x28]
mov eax, esi
push edi
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 4], eax
lea ecx, [eax + eax]
sub esi, ecx
jne 0x41deb6
dec eax
push 2
mov dword [ebp - 4], eax
pop esi
push ebx
push dword [ebp + 8]
call dword [0x4640c8]
push dword [ebp + 0x1c]
mov dword [ebp - 8], eax
push eax
call dword [0x4640e8]
mov edi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
add eax, edi
push eax
mov eax, dword [ebp + 0xc]
add ecx, eax
push ecx
push edi
push eax
call dword [0x4640e0]
push eax
mov dword [ebp + 0x18], eax
push dword [ebp + 8]
call dword [0x464070]
mov ebx, 0xcc0020
mov eax, dword [ebp + 0x28]
push ebx
sub eax, dword [ebp - 4]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp - 8]
push dword [ebp + 0x2c]
push eax
push edi
push dword [ebp + 0xc]
mov edi, dword [0x4640c0]
push dword [ebp + 8]
call edi
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
mov dword [ebp + 0x1c], esi
add esi, eax
mov eax, dword [ebp + 0xc]
mov ecx, eax
add esi, eax
sub ecx, dword [ebp - 4]
add ecx, edx
cmp esi, ecx
mov dword [ebp + 0xc], ecx
jge 0x41df6d
mov ecx, dword [ebp - 4]
add ecx, eax
mov dword [ebp + 0x14], ecx
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push dword [ebp + 8]
push dword [ebp + 0x2c]
push dword [ebp + 0x1c]
push dword [ebp + 0x10]
push esi
push dword [ebp + 8]
call edi
mov eax, dword [ebp + 0x1c]
add esi, eax
add eax, eax
cmp esi, dword [ebp + 0xc]
mov dword [ebp + 0x1c], eax
jl 0x41df45
mov eax, dword [ebp + 0x20]
mov esi, dword [ebp - 8]
sub eax, dword [ebp - 4]
push ebx
push dword [ebp + 0x24]
add eax, dword [ebp + 0x28]
push eax
push esi
push dword [ebp + 0x2c]
push dword [ebp - 4]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
xor edi, edi
push edi
push dword [ebp + 8]
call dword [0x464070]
cmp dword [ebp + 0x18], edi
pop ebx
je 0x41dfab
push dword [ebp + 0x18]
call dword [0x4640ec]
push dword [ebp - 0xc]
push esi
call dword [0x4640e8]
cmp esi, edi
je 0x41dfd3
push esi
mov esi, dword [0x4640bc]
call esi
test eax, eax
je 0x41dfc9
mov dword [ebp - 8], edi
cmp dword [ebp - 8], edi
je 0x41dfd3
push dword [ebp - 8]
call esi
pop edi
pop esi
leave
ret
Function at 0x41e1c9
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push dword [ebp + 8]
call dword [0x4640c8]
push dword [ebp + 0x1c]
mov dword [ebp - 4], eax
push eax
call dword [0x4640e8]
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, ecx
mov esi, dword [ebp + 0x10]
sub eax, dword [ebp + 0x2c]
mov ebx, dword [ebp + 0xc]
cdq
sub eax, edx
mov edi, eax
lea eax, [esi + ecx]
mov dword [ebp - 8], eax
push eax
mov eax, dword [ebp + 0x14]
add eax, ebx
push eax
push esi
sar edi, 1
push ebx
inc edi
call dword [0x4640e0]
push eax
mov dword [ebp + 0x14], eax
push dword [ebp + 8]
call dword [0x464070]
push 0xcc0020
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp - 4]
push 1
push dword [ebp + 0x28]
push esi
push ebx
push dword [ebp + 8]
mov ebx, dword [0x4640c0]
call ebx
lea ecx, [esi + 1]
lea eax, [edi + esi]
cmp ecx, eax
mov dword [ebp + 0x1c], 1
mov dword [ebp + 0x10], ecx
jge 0x41e287
push 0xcc0020
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp + 0x1c]
push dword [ebp + 0x28]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call ebx
mov eax, dword [ebp + 0x1c]
add dword [ebp + 0x10], eax
add eax, eax
mov dword [ebp + 0x1c], eax
lea eax, [edi + esi]
cmp dword [ebp + 0x10], eax
jl 0x41e257
push 0xcc0020
lea eax, [edi + esi]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp - 4]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call ebx
sub esi, edi
mov dword [ebp + 0x1c], 1
add esi, dword [ebp + 0x18]
lea edi, [esi + 1]
cmp edi, dword [ebp - 8]
jge 0x41e2e2
push 0xcc0020
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp + 0x1c]
push dword [ebp + 0x28]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call ebx
mov eax, dword [ebp + 0x1c]
add edi, eax
add eax, eax
mov dword [ebp + 0x1c], eax
jmp 0x41e2b6
xor edi, edi
push edi
push dword [ebp + 8]
call dword [0x464070]
cmp dword [ebp + 0x14], edi
je 0x41e2fc
push dword [ebp + 0x14]
call dword [0x4640ec]
push dword [ebp - 0xc]
push dword [ebp - 4]
call dword [0x4640e8]
cmp dword [ebp - 4], edi
je 0x41e329
push dword [ebp - 4]
mov esi, dword [0x4640bc]
call esi
test eax, eax
je 0x41e31f
mov dword [ebp - 4], edi
cmp dword [ebp - 4], edi
je 0x41e329
push dword [ebp - 4]
call esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41e32e
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 0x1c], 0
push ebx
push esi
push edi
je 0x41e436
push dword [ebp + 8]
call dword [0x4640c8]
push dword [ebp + 0x1c]
mov dword [ebp - 4], eax
push eax
call dword [0x4640e8]
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x18]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
add ecx, ebx
add eax, esi
push ecx
push eax
push ebx
push esi
mov dword [ebp + 0x1c], eax
call dword [0x4640e0]
push eax
mov dword [ebp + 0xc], eax
push dword [ebp + 8]
call dword [0x464070]
mov edi, 0xcc0020
push edi
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp - 4]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push ebx
push esi
push dword [ebp + 8]
call dword [0x4640c0]
mov eax, dword [ebp + 0x28]
mov dword [ebp + 0x28], eax
add eax, esi
cmp eax, dword [ebp + 0x1c]
mov dword [ebp + 0x10], eax
jge 0x41e3e2
jmp 0x41e3b8
mov eax, dword [ebp + 0x10]
push edi
push ebx
push esi
push dword [ebp + 8]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push ebx
push eax
push dword [ebp + 8]
call dword [0x4640c0]
mov eax, dword [ebp + 0x28]
add dword [ebp + 0x10], eax
add eax, eax
mov dword [ebp + 0x28], eax
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 0x1c]
jl 0x41e3b5
xor edi, edi
push edi
push dword [ebp + 8]
call dword [0x464070]
cmp dword [ebp + 0xc], edi
je 0x41e3fc
push dword [ebp + 0xc]
call dword [0x4640ec]
push dword [ebp - 8]
push dword [ebp - 4]
call dword [0x4640e8]
cmp dword [ebp - 4], edi
je 0x41e4c3
push dword [ebp - 4]
mov esi, dword [0x4640bc]
call esi
test eax, eax
je 0x41e423
mov dword [ebp - 4], edi
cmp dword [ebp - 4], edi
je 0x41e4c3
push dword [ebp - 4]
call esi
jmp 0x41e4c3
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x28]
lea esi, [ebx + eax]
add edx, ecx
push edx
lea edx, [esi + edi]
lea eax, [ebx + edi]
push edx
push ecx
push eax
mov dword [ebp + 0x28], eax
call dword [0x4640e0]
push eax
mov dword [ebp + 0xc], eax
push dword [ebp + 8]
call dword [0x464070]
mov eax, dword [ebp + 0x28]
mov dword [ebp + 0x1c], edi
cmp eax, esi
mov dword [ebp + 0x28], eax
jge 0x41e4a9
mov edi, 0xcc0020
push edi
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
push dword [ebp + 0x2c]
push dword [ebp + 0x1c]
push dword [ebp + 0x10]
push dword [ebp + 0x28]
push dword [ebp + 8]
call dword [0x4640c0]
mov eax, dword [ebp + 0x1c]
add dword [ebp + 0x28], eax
add eax, eax
cmp dword [ebp + 0x28], esi
mov dword [ebp + 0x1c], eax
jl 0x41e47c
push 0
push dword [ebp + 8]
call dword [0x464070]
cmp dword [ebp + 0xc], 0
je 0x41e4c3
push dword [ebp + 0xc]
call dword [0x4640ec]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41e4c8
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 0x1c], 0
push ebx
push esi
push edi
je 0x41e5d0
push dword [ebp + 8]
call dword [0x4640c8]
push dword [ebp + 0x1c]
mov dword [ebp - 4], eax
push eax
call dword [0x4640e8]
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
add eax, esi
mov dword [ebp + 0x1c], eax
push eax
mov eax, dword [ebp + 0x14]
add eax, ebx
push eax
push esi
push ebx
call dword [0x4640e0]
push eax
mov dword [ebp + 0x10], eax
push dword [ebp + 8]
call dword [0x464070]
mov edi, 0xcc0020
push edi
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp - 4]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push esi
push ebx
push dword [ebp + 8]
call dword [0x4640c0]
mov eax, dword [ebp + 0x2c]
mov dword [ebp + 0x2c], eax
add eax, esi
cmp eax, dword [ebp + 0x1c]
mov dword [ebp + 0xc], eax
jge 0x41e57c
jmp 0x41e552
mov eax, dword [ebp + 0xc]
push edi
push esi
push ebx
push dword [ebp + 8]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push eax
push ebx
push dword [ebp + 8]
call dword [0x4640c0]
mov eax, dword [ebp + 0x2c]
add dword [ebp + 0xc], eax
add eax, eax
mov dword [ebp + 0x2c], eax
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 0x1c]
jl 0x41e54f
xor edi, edi
push edi
push dword [ebp + 8]
call dword [0x464070]
cmp dword [ebp + 0x10], edi
je 0x41e596
push dword [ebp + 0x10]
call dword [0x4640ec]
push dword [ebp - 8]
push dword [ebp - 4]
call dword [0x4640e8]
cmp dword [ebp - 4], edi
je 0x41e651
push dword [ebp - 4]
mov esi, dword [0x4640bc]
call esi
test eax, eax
je 0x41e5bd
mov dword [ebp - 4], edi
cmp dword [ebp - 4], edi
je 0x41e651
push dword [ebp - 4]
call esi
jmp 0x41e651
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
lea edi, [esi + eax]
mov eax, dword [ebp + 0xc]
add ecx, eax
push edi
push ecx
push esi
push eax
mov dword [ebp + 0x1c], edi
call dword [0x4640e0]
push eax
mov dword [ebp + 0x10], eax
push dword [ebp + 8]
call dword [0x464070]
mov eax, dword [ebp + 0x2c]
mov dword [ebp + 0x2c], eax
lea ebx, [esi + eax]
cmp ebx, edi
jge 0x41e637
mov edi, 0xcc0020
push edi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x4640c0]
mov eax, dword [ebp + 0x2c]
add ebx, eax
add eax, eax
cmp ebx, dword [ebp + 0x1c]
mov dword [ebp + 0x2c], eax
jl 0x41e60d
push 0
push dword [ebp + 8]
call dword [0x464070]
cmp dword [ebp + 0x10], 0
je 0x41e651
push dword [ebp + 0x10]
call dword [0x4640ec]
pop edi
pop esi
pop ebx
leave
ret