joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5cc7b8
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5cc963
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x44], 0
jne 0x5cc944
mov dl, 1
mov eax, dword [0x48de5c]
call fcn.004b17d8
mov edx, dword [ebp - 4]
mov dword [edx + 0x44], eax
mov eax, dword [ebp - 4]
add eax, 0x48
call fcn.00409c7c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x5cc933
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0052c2b8
test al, al
je 0x5cc926
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x5cc974
lea eax, [ebp - 0x394]
call fcn.0042541c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x5cc926
xor eax, eax
push ebp
push 0x5cc91f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x5cc9e4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x5cc908
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040a7c4
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x4c]
jne 0x5cc908
mov eax, dword [ebp - 4]
add eax, 0x48
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.0040a7c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5cc926
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x5cc829
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
mov byte [eax + 0x2d], 0
mov dl, 1
call fcn.004b16fc
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5cc96a
lea eax, [ebp - 0x3a0]
call fcn.00409c7c
ret

Function at 0x5cd570
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x5f71c4]
cmp byte [eax + 0xc5], 0
jne 0x5cd5e2
cmp dword [0x5f71e8], 0
jne 0x5cd5a2
call sub.kernel32.dll_GetCurrentThreadId
push eax
push 0
mov eax, dword [0x5efb04]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x5f71e8], eax
cmp dword [0x5f71e4], 0
jne 0x5cd5bd
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x5f71e4], eax
cmp dword [0x5f71ec], 0
jne 0x5cd5e2
push esp
push 0
push 0
mov eax, dword [0x5efb00]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x5f71ec], eax
pop edx
ret
Function at 0x5cda04
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x5cda1b
add esp, 0xfffffff0
call fcn.00408518
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004c21b0
mov eax, dword [0x5efbe4]
cmp byte [eax], 0
jne 0x5cda48
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x194], al
mov eax, dword [0x5eff58]
cmp word [eax + 2], 0
jne 0x5cda62
mov eax, dword [0x5eff58]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005cfdf8
mov eax, dword [0x5f00a0]
cmp word [eax + 2], 0
jne 0x5cda7c
mov eax, dword [0x5f00a0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005cfffc
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x4f27a4]
call fcn.004f8ccc
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x5d0574
mov dl, 1
mov eax, dword [0x48a4a0]
call fcn.00407e60
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x48a4a0]
call fcn.00407e60
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0x9c], 0
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x4f7540]
call fcn.00502f24
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x5cdc6c
mov eax, dword [0x5efdf0]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.00503440
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x5d085c
mov dl, 1
mov eax, dword [0x48a4a0]
call fcn.00407e60
mov dword [ebx + 0xb0], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x5efdf0]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.0042521c
test eax, eax
je 0x5cdb96
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00425074
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00425200
test eax, eax
je 0x5cdbae
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040a7c4
push ebx
push 0x5cf7d4
call fcn.005c2cd4
mov dword [ebx + 0x190], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x5efbe4]
cmp byte [eax], 0
jne 0x5cdbff
mov eax, ebx
call fcn.005cde50
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.005d0a94
mov eax, ebx
call fcn.005d1734
mov byte [ebx + 0x196], 0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5cdc63
call fcn.00408570
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5ce194
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x188]
test eax, eax
je 0x5ce236
cmp dword [ebx + 0xac], 0
jne 0x5ce230
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5ce0d0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x5ce230
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5ce1f6
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5ce230
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xa8]
mov edx, esi
call fcn.004acc6c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5ce205
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5ce4f0
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, edx
mov esi, eax
mov eax, dword [0x5f71c4]
cmp dword [eax + 0x188], 0
je 0x5ce66a
test bl, bl
jne 0x5ce5b5
cmp dword [esi + 0xb4], 0
jne 0x5ce5aa
mov eax, esi
call fcn.005d1584
push eax
push 0x5ce3e4
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x5ce57b
mov eax, dword [0x5f71c4]
cmp byte [eax + 0xeb], 0
je 0x5ce57b
mov eax, dword [esi + 0xf0]
mov dword [esp], eax
mov eax, dword [esp]
test eax, eax
je 0x5ce55c
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5ce57b
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5ce564
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5ce5aa
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004acc6c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5ce58a
inc dword [esi + 0xb4]
jmp 0x5ce66a
cmp dword [esi + 0xb4], 0
jle 0x5ce66a
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x5ce66a
cmp dword [esi + 0x58], 0
je 0x5ce61f
mov eax, dword [0x5f71c4]
cmp byte [eax + 0xeb], 0
je 0x5ce61f
mov eax, dword [esi + 0xf0]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x5ce600
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5ce61f
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5ce608
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5ce64e
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004acc6c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5ce62e
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x5bf518]
call fcn.0040c048
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x5cf308
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x5cf365
cmp byte [ebx + 0xeb], 0
jne 0x5cf365
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x188]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00409e04
mov eax, dword [esi]
test eax, eax
je 0x5cf352
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5cf372
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a05c
jmp 0x5cf372
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a05c
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5d0ca8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x5d0d19
mov eax, esi
call fcn.00525dcc
test al, al
je 0x5d0d19
mov eax, dword [ebx + 0x98]
call fcn.005259f8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5d0d19
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x134]
test al, al
je 0x5d0d0a
push 0
mov eax, dword [ebx + 0x98]
call fcn.005259f8
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.0051c434
jmp 0x5d0d19
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.005d0ab4
pop esi
pop ebx
ret
Function at 0x5d7b80
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x8c], 0
jne 0x5d7bfe
mov eax, dword [ebx + 8]
call fcn.005259f8
mov ecx, eax
mov dl, 1
mov eax, dword [0x533014]
call fcn.0051faf4
mov dword [ebx + 0x8c], eax
mov esi, dword [ebx + 0x8c]
xor edx, edx
mov eax, esi
call fcn.0053886c
mov dword [esi + 0x2cc], ebx
mov dword [esi + 0x2c8], 0x5d7450
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebx + 0x8c]
call fcn.005259f8
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x8c]
call fcn.005259f8
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x9c], 0
jne 0x5d7c78
mov eax, dword [ebx + 8]
call fcn.005259f8
mov ecx, eax
mov dl, 1
mov eax, dword [0x533014]
call fcn.0051faf4
mov dword [ebx + 0x9c], eax
mov esi, dword [ebx + 0x9c]
mov dl, 1
mov eax, esi
call fcn.0053886c
mov dword [esi + 0x2cc], ebx
mov dword [esi + 0x2c8], 0x5d749c
push 8
push 0
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x9c]
call fcn.005259f8
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x9c]
call fcn.005259f8
push eax
call sub.user32.dll_ShowWindow
cmp dword [ebx + 0x94], 0
jne 0x5d7ce6
mov eax, dword [ebx + 8]
call fcn.005259f8
mov ecx, eax
mov dl, 1
mov eax, dword [0x533ab0]
call fcn.0051faf4
mov dword [ebx + 0x94], eax
mov eax, dword [ebx + 0x94]
mov byte [eax + 0x2a0], 1
push 8
push 3
call sub.user32.dll_GetSystemMetrics
push eax
push 2
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push 0
mov eax, dword [ebx + 0x94]
call fcn.005259f8
push eax
call sub.user32.dll_SetWindowPos
push 0
mov eax, dword [ebx + 0x94]
call fcn.005259f8
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x10002610
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x78
movups xmm0, xmmword [str.AmericanFlag]
mov ax, word [0x1007cb28]
mov word [esp + 0x20], ax
lea eax, [esp + 8]
push esi
mov esi, dword [ebp + 8]
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x78], eax
lea eax, [esp + 0x54]
movq xmm0, qword [0x1007cb20]
push edi
movq qword [esp + 0x20], xmm0
xorps xmm0, xmm0
push eax
mov dword [esp + 0x5c], 0
movlpd qword [esp + 0x64], xmm0
movlpd qword [esp + 0x70], xmm0
movlpd qword [esp + 0x78], xmm0
mov dword [esp + 0x60], 0x10002920
mov dword [esp + 0x6c], esi
call dword [sym.imp.USER32.dll_RegisterClassW]
push 0
push esi
push 0
push 0
push 0x190
push 0x140
push 0x80000000
push 0x80000000
push 0xcf0000
push str.AmericanFlag
lea eax, [esp + 0x38]
push eax
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
test esi, esi
je 0x10002723
push dword [ebp + 0x14]
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [esp + 0x30]
push 0
push 0
xorps xmm0, xmm0
mov dword [esp + 0x50], 0
push 0
push eax
movaps xmmword [esp + 0x40], xmm0
movq qword [esp + 0x50], xmm0
call esi
test eax, eax
je 0x10002723
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
nop dword [eax + eax]
lea eax, [esp + 0x30]
push eax
call edi
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push 0
push 0
lea eax, [esp + 0x3c]
push eax
call esi
test eax, eax
jne 0x10002700
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10002730
Capabilities:
Capture screenshot
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6c
push ebx
push esi
mov eax, ecx
mov dword [esp + 0x1c], edx
push edi
push eax
mov dword [esp + 0x30], eax
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push esi
mov dword [esp + 0x20], esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 0x12c
push 0x12c
mov ebx, eax
push esi
mov dword [esp + 0x20], ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push ebx
mov dword [esp + 0x20], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x28], eax
xor edi, edi
mov ebx, 0x1007daa8
push dword [ebx]
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov esi, eax
mov dword [esp + 0x44], edi
push esi
lea eax, [esp + 0x44]
mov dword [esp + 0x44], 0
push eax
push dword [esp + 0x1c]
add edi, 0x32
mov dword [esp + 0x54], 0x12c
mov dword [esp + 0x58], edi
call dword [sym.imp.USER32.dll_FillRect]
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
add ebx, 4
cmp ebx, 0x1007dac0
jl 0x10002788
push 0x41eb0
push 0x42
mov dword [esp + 0x58], 0x28
mov dword [esp + 0x5c], 0x12c
mov dword [esp + 0x60], 0x12c
mov dword [esp + 0x64], 0x180001
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0
mov ebx, eax
lea eax, [esp + 0x54]
push eax
push ebx
push 0x12c
push 0
push dword [esp + 0x2c]
push dword [esp + 0x34]
call dword [sym.imp.GDI32.dll_GetDIBits]
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push dword [esp + 0x38]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
mov eax, 0x4d42
mov dword [esp + 0x3a], 0x36
push 0
mov word [esp + 0x34], ax
lea eax, [esp + 0x14]
push eax
push 0xe
lea eax, [esp + 0x3c]
mov dword [esp + 0x3e], 0x41ee6
push eax
push edi
mov dword [esp + 0x24], 0
call esi
push 0
lea eax, [esp + 0x14]
push eax
push 0x28
lea eax, [esp + 0x5c]
push eax
push edi
call esi
push 0
lea eax, [esp + 0x14]
push eax
push 0x41eb0
push ebx
push edi
call esi
mov esi, dword [esp + 0x24]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x28]
mov ebx, dword [esp + 0x18]
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [esp + 0x18]
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [esp + 0x1c]
push dword [esp + 0x30]
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10009420
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x78
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movups xmm0, xmmword [str.TutahshClass]
mov cx, word [0x1007d080]
mov esi, eax
push 0x7f00
movups xmmword [esp + 0x14], xmm0
lea eax, [esp + 0x14]
mov word [esp + 0x2c], cx
movq xmm0, qword [0x1007d078]
movq qword [esp + 0x24], xmm0
xorps xmm0, xmm0
push 0
mov dword [esp + 0x60], 0
movlpd qword [esp + 0x68], xmm0
mov dword [esp + 0x74], 0
mov dword [esp + 0x80], 0
mov dword [esp + 0x64], 0x10004370
mov dword [esp + 0x70], esi
mov dword [esp + 0x84], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [esp + 0x70], eax
lea eax, [esp + 0x58]
push eax
mov dword [esp + 0x78], 6
call dword [sym.imp.USER32.dll_RegisterClassW]
push 0
push esi
push 0
push 0
push 0x258
push 0x320
push 0x80000000
push 0x80000000
push 0xcf0000
push str.Tutahgh
lea eax, [esp + 0x38]
push eax
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
test esi, esi
je 0x10009558
push 1
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [esp + 0x30]
push 0
push 0
xorps xmm0, xmm0
mov dword [esp + 0x50], 0
push 0
push eax
movaps xmmword [esp + 0x40], xmm0
movq qword [esp + 0x50], xmm0
call esi
test eax, eax
je 0x10009558
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x30]
push eax
call edi
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push 0
push 0
lea eax, [esp + 0x3c]
push eax
call esi
test eax, eax
jne 0x10009535
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10009560
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x78
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movups xmm0, xmmword [str.WndClassA]
mov ecx, dword [0x1007cfcc]
mov esi, eax
lea eax, [esp + 0x10]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x58]
movups xmmword [esp + 0x10], xmm0
mov dword [esp + 0x58], 0
xorps xmm0, xmm0
mov dword [esp + 0x5c], 0x10003880
push eax
movlpd qword [esp + 0x64], xmm0
movlpd qword [esp + 0x70], xmm0
movlpd qword [esp + 0x78], xmm0
mov dword [esp + 0x6c], esi
call dword [sym.imp.USER32.dll_RegisterClassW]
push 0
push esi
push 0
push 0
push 0x1b7
push 0x1a0
push 0x80000000
push 0x80000000
push 0xcf0000
push str.Game
lea eax, [esp + 0x38]
push eax
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
test esi, esi
je 0x10009665
push 1
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [esp + 0x30]
push 0
push 0
xorps xmm0, xmm0
mov dword [esp + 0x50], 0
push 0
push eax
movaps xmmword [esp + 0x40], xmm0
movq qword [esp + 0x50], xmm0
call esi
test eax, eax
je 0x10009665
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x30]
push eax
call edi
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push 0
push 0
lea eax, [esp + 0x3c]
push eax
call esi
test eax, eax
jne 0x10009642
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000bf10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100718df
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x14], 0
lea ecx, [edi + 0x68]
mov dword [edi], 0x1007da00
mov dword [edi + 0x10], 0x1007ddc4
call fcn.1000d440
mov dword [ebp - 4], 0
mov eax, dword [edi]
push 0
push 0
mov dword [ebp - 0x14], 1
mov eax, dword [eax + 4]
mov dword [edi + eax], 0x1007d9fc
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ecx + edi - 4], eax
mov eax, dword [edi]
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov ebx, dword [eax + 4]
add ebx, edi
mov ecx, ebx
mov dword [ebx + 0x30], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0x201
mov dword [ebx + 0x18], 6
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 0
call fcn.100023e0
push 8
call fcn.10051160
add esp, 4
mov esi, eax
push 1
mov dword [ebp - 4], 3
call fcn.10050183
mov dword [esi + 4], eax
add esp, 4
lea eax, [edi + 0x18]
mov dword [ebx + 0x30], esi
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x3c], 0
mov esi, dword [esi + 4]
mov ecx, esi
mov dword [ebp - 0x18], esi
mov eax, dword [esi]
call dword [eax + 4]
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 4
push eax
call fcn.10010ce0
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
call dword [edx + 0x30]
movzx eax, ax
mov ecx, esi
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 2
mov eax, dword [esi]
call dword [eax + 8]
test eax, eax
je 0x1000c051
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [ebx + 0x38], 0
mov eax, dword [ebp - 0x18]
mov word [ebx + 0x40], ax
jne 0x1000c06e
mov eax, dword [ebx + 0xc]
mov ecx, ebx
push 0
or eax, 4
push eax
call fcn.100023e0
lea edx, [edi + 0x10]
mov dword [ebp - 0x18], edx
mov eax, dword [edx]
mov eax, dword [eax + 4]
mov dword [edx + eax], 0x1007dc38
mov eax, dword [edx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edx - 4], eax
mov eax, dword [edi]
mov eax, dword [eax + 4]
mov dword [edi + eax], 0x1007dad0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x20]
mov dword [ecx + edi - 4], eax
mov dword [ebp - 4], 7
mov eax, dword [edi]
push ecx
push dword [ebp + 8]
lea ecx, [edi + 0x18]
mov eax, dword [eax + 4]
mov dword [edi + eax], 0x1007c99c
mov eax, dword [edi]
mov edx, dword [eax + 4]
lea eax, [edx - 0x68]
mov dword [edx + edi - 4], eax
call fcn.1000d2a0
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc