joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c900
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
push ebx
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], 0
push edi
je 0x43ca81
xor eax, eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x30]
push eax
push esi
mov dword [esp + 0x38], 0
call fcn.0043cbd0
cmp dword [esi + 0x18], 0x5a
jge 0x43c945
mov eax, dword [esi + 0x10]
jmp 0x43c950
mov eax, dword [esi + 0x14]
test eax, eax
je 0x43ca81
mov ecx, dword [eax + 0x28]
sub ecx, dword [eax + 0x20]
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x3c]
sub edi, dword [esp + 0x30]
sub ebx, dword [esp + 0x34]
mov dword [esp + 0x48], ecx
mov ecx, dword [eax + 0x2c]
sub ecx, dword [eax + 0x24]
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov eax, dword [esi + 4]
push eax
mov dword [esp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
push ebx
push edi
push eax
lea esi, [esp + 0x5c]
mov dword [esp + 0x20], eax
call fcn.0042eca0
mov ecx, dword [esp + 0x20]
add esp, 0xc
push ecx
test al, al
jne 0x43c9db
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
call fcn.0042edd0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp + 8]
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0xc]
mov edx, dword [esp + 0x4c]
push ecx
mov ecx, dword [esp + 0x4c]
push edx
mov edx, dword [eax]
mov eax, dword [esp + 0x58]
push ecx
push 0
push 0
push edx
push ebx
push edi
push 0
push 0
push eax
call dword [sym.imp.MSIMG32.dll_AlphaBlend]
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
xor edx, edx
push edx
push ebx
push edi
push ecx
mov dword [esp + 0x3c], ecx
mov ecx, dword [esi + 4]
push eax
push ecx
mov dword [esp + 0x40], eax
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], ebx
call dword [sym.imp.USER32.dll_MoveWindow]
mov ecx, dword [esp + 0x50]
push 2
lea edx, [esp + 0x60]
push edx
push 0
lea eax, [esp + 0x24]
push eax
push ecx
mov ecx, dword [esi + 4]
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x40]
push eax
push 0
push ecx
call dword [sym.imp.USER32.dll_UpdateLayeredWindow]
mov edx, dword [esi + 4]
push 8
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
lea esi, [esp + 0x50]
call fcn.0042edd0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x43d8a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [0x54734c]
test eax, eax
jne 0x43d8b8
mov dword [esi + 0x10], eax
mov dword [esi + 0xc], 0xffffffff
xor al, al
ret 8
push edi
mov edi, dword [esi + 0xc]
test edi, edi
jge 0x43d8dd
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 8]
mov dword [esi + 0x14], eax
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], ecx
xor al, al
pop edi
ret 8
mov edx, dword [esp + 8]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 4]
push ebx
mov bl, byte [esi + 0x18]
push ebp
mov ebp, edx
sub ebp, eax
cmp ebp, ecx
jle 0x43d8fa
mov byte [esi + 0x18], 1
jmp 0x43d904
sub eax, edx
cmp eax, ecx
jle 0x43d912
mov byte [esi + 0x18], 0
mov dword [esi + 0x10], edx
test edi, edi
jne 0x43d91a
mov dword [esi + 0xc], 1
pop ebp
pop ebx
xor al, al
pop edi
ret 8
cmp bl, byte [esi + 0x18]
je 0x43d912
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
sub edx, dword [esi + 0x14]
mov dword [esi + 0x14], eax
cmp edx, dword [esi + 8]
ja 0x43d912
inc dword [esi + 0xc]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
pop ebp
inc ecx
cmp eax, ecx
pop ebx
sete al
pop edi
ret 8
Function at 0x43eba0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x22c
mov eax, dword [0x545628]
xor eax, esp
mov dword [esp + 0x224], eax
mov eax, dword [esp + 0x230]
push ebx
push ebp
push esi
push edi
xor edi, edi
push 0x206
mov esi, ecx
mov dword [esp + 0x24], eax
mov dword [eax], edi
lea ecx, [esp + 0x2e]
mov ebx, edx
xor eax, eax
push edi
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x1c], edi
mov word [esp + 0x34], ax
call fcn.004d6770
add esp, 0xc
lea edx, [esp + 0x10]
push edx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionFontLinkSystemLink
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x30], 0x208
lea ebp, [esp + 0x34]
mov dword [esp + 0x20], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x43ec3f
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x14]
mov ecx, ebp
push ecx
lea edx, [esp + 0x1c]
push edx
push edi
push str.SimSun
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x43ec3f
cmp dword [esp + 0x14], 7
je 0x43ec5e
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x43ec4e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esi + 4]
push ebx
call fcn.00442b90
xor al, al
jmp 0x43ed6a
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x28]
mov dword [esp + 0x10], edi
call fcn.0043eb60
mov edi, eax
mov esi, edi
imul esi, esi, 0x20c
add esi, 0x490
push esi
mov dword [esp + 0x20], edi
call fcn.004d1df2
add esp, 4
push esi
mov ebx, eax
push 0
push ebx
call fcn.004d6770
mov edx, dword [esp + 0x24]
mov esi, dword [esp + 0x250]
add esp, 0xc
add edi, 2
mov dword [ebx + 0xc], edi
push str.NSimSun
lea eax, [ebx + 0x78]
mov dword [ebx + 4], edx
lea edi, [ebx + 0x1c]
mov ecx, 0x17
push 0x104
rep movsd dword es:[edi], dword [esi]
push eax
mov dword [ebx + 0x10], 0
call fcn.004d2c76
add esp, 0xc
push str.SurSong
lea ecx, [ebx + 0x284]
push 0x104
push ecx
call fcn.004d2c76
mov eax, dword [esp + 0x28]
add esp, 0xc
test eax, eax
jle 0x43ed4e
lea esi, [ebx + 0x490]
mov edi, eax
push 0x2c
push ebp
call fcn.004d3496
add esp, 8
test eax, eax
je 0x43ed19
add eax, 2
jmp 0x43ed1b
mov eax, ebp
push eax
push 0x104
push esi
call fcn.004d2c76
mov eax, ebp
add esp, 0xc
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43ed30
sub eax, edx
sar eax, 1
add esi, 0x20c
sub edi, 1
lea ebp, [ebp + eax*2 + 2]
jne 0x43ed05
mov eax, dword [esp + 0x24c]
mov edx, dword [esp + 0x248]
mov ecx, dword [esp + 0x20]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x14], edx
mov dword [ecx], ebx
mov al, 1
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004d158d
add esp, 0x22c
ret
Function at 0x4439f0
Capabilities:
Get common file path

Disassembly:
push 0x5c
push ebx
call fcn.004d3496
add esp, 8
test eax, eax
jne 0x443a0e
push 0x2f
push ebx
call fcn.004d3496
add esp, 8
test eax, eax
je 0x443a49
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x443a13
push 0
push 0
push 0x104
push edi
sub eax, edx
sar eax, 1
push eax
push ebx
push 0
push 0x3a8
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jg 0x443a42
xor al, al
ret
mov byte [eax + edi], 0
mov al, 1
ret
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x443a3f
push str._fonts_
push 0x104
push edi
call fcn.004d944b
mov eax, edi
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x443a71
sub eax, edx
push esi
mov esi, eax
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x443a82
push 0
push 0
mov ecx, 0x104
sub eax, edx
sub ecx, esi
push ecx
lea edx, [esi + edi]
push edx
sar eax, 1
push eax
push ebx
push 0
push 0x3a8
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jg 0x443ab8
xor al, al
pop esi
ret
add eax, esi
mov byte [eax + edi], 0
mov al, 1
pop esi
ret
Function at 0x443d80
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x440
mov eax, dword [0x545628]
xor eax, esp
mov dword [esp + 0x43c], eax
mov eax, dword [esp + 0x444]
push ebx
push edi
mov edi, edx
xor ebx, ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], ecx
cmp edi, ebx
je 0x443f5b
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x443db6
sub eax, edx
sar eax, 1
je 0x443f5b
lea edx, [esp + 0x10]
push edx
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionFonts
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [esp + 0x1f], bl
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x443f5b
mov ecx, dword [esp + 0x10]
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x24]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ecx
mov dword [esp + 0x44], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x443f31
push ebp
xor ebp, ebp
mov dword [esp + 0x10], ebp
cmp dword [esp + 0x18], ebx
jbe 0x443f30
push esi
mov edi, edi
push 0
push 0
lea edx, [esp + 0x2c]
push edx
mov edx, dword [esp + 0x24]
push 0
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x50]
push ecx
push ebx
mov esi, 1
push edx
mov dword [esp + 0x4c], 0x104
mov dword [esp + 0x44], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x443f07
cmp dword [esp + 0x24], esi
jne 0x443f07
mov ecx, dword [esp + 0x458]
mov dword [esp + 0x20], eax
push edi
lea eax, [esp + 0x18]
push eax
push ecx
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x4c]
mov esi, ebp
call fcn.00443c60
mov ebp, dword [esp + 0x24]
add esp, 0x10
test al, al
je 0x443ef5
cmp ebp, esi
mov dword [esp + 0x28], 1
mov dword [esp + 0x34], 0x208
jle 0x443eef
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x248]
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x30]
push edx
push 0
lea eax, [esp + 0x4c]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x443ee3
mov ebp, esi
mov dword [esp + 0x14], ebp
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x38]
mov dword [eax], edx
jmp 0x443ef5
mov ebp, esi
mov dword [esp + 0x14], ebp
mov eax, dword [esp + 0x458]
mov edx, ebp
call fcn.00443ad0
test al, al
jne 0x443f12
inc ebx
cmp ebx, dword [esp + 0x1c]
jb 0x443e30
pop esi
test ebp, ebp
je 0x443f30
mov edi, dword [esp + 0x2c]
lea ebx, [esp + 0x240]
call fcn.004439f0
test al, al
je 0x443f30
mov byte [esp + 0xf], 1
pop ebp
mov eax, dword [esp + 0x10]
test eax, eax
je 0x443f40
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [esp + 0xb]
pop edi
pop ebx
mov ecx, dword [esp + 0x43c]
xor ecx, esp
call fcn.004d158d
add esp, 0x440
ret
mov ecx, dword [esp + 0x444]
pop edi
pop ebx
xor ecx, esp
xor al, al
call fcn.004d158d
add esp, 0x440
ret
Function at 0x444290
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4f07b8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x545628]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
push 1
push eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x14], bl
call dword [sym.imp.GDI32.dll_SetBkMode]
mov dword [esp + 0x20], ebx
mov byte [esp + 0xd], bl
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x30], ebx
mov eax, dword [esi]
mov eax, dword [eax + 4]
push ecx
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call eax
lea esi, [esp + 0xc]
call fcn.0042dd60
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x444320
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x545628]
xor eax, esp
mov dword [esp + 8], eax
push ebx
push edi
push 0x3c
call fcn.004d1df2
mov edi, eax
xor ebx, ebx
add esp, 4
cmp edi, ebx
jne 0x44435f
pop edi
mov dword [0x54dbc4], 0x6d
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.004d158d
add esp, 0xc
ret
push esi
push 0x3c
push ebx
push edi
call fcn.004d6770
push 0x6148
call fcn.004d1df2
mov esi, eax
add esp, 0x10
cmp esi, ebx
jne 0x4443a3
push edi
mov dword [0x54dbc4], 0x6d
call fcn.004d1d15
add esp, 4
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.004d158d
add esp, 0xc
ret
mov eax, dword [esp + 0x1c]
mov dword [edi + 0x38], esi
mov dword [esi + 4], ebx
mov dword [esi + 0x38], ebx
mov dword [esi], 8
mov dword [esi + 0x3c], 0x440580
mov ecx, dword [edi + 0x38]
mov dword [edi + 0x34], eax
mov eax, dword [ecx + 0x3c]
cmp eax, ebx
je 0x4443d9
push 6
lea ecx, [esp + 0x10]
push ecx
push edi
call eax
add esp, 0xc
jmp 0x4443ee
mov edx, dword [ecx + 0x38]
push edx
push 6
lea eax, [esp + 0x14]
push 1
push eax
call fcn.004d58a0
add esp, 0x10
cmp eax, 6
je 0x4443ff
mov dword [0x54dbc4], 0x66
jmp 0x444425
push 3
lea ecx, [esp + 0x10]
push ecx
push str.GIFVER
mov byte [esp + 0x1e], bl
call fcn.004d953c
add esp, 0xc
test eax, eax
je 0x444448
mov dword [0x54dbc4], 0x67
push esi
call fcn.004d1d15
push edi
call fcn.004d1d15
add esp, 8
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.004d158d
add esp, 0xc
ret
call fcn.00444470
test eax, eax
je 0x444425
mov ecx, dword [esp + 0x14]
pop esi
mov eax, edi
pop edi
mov dword [0x54dbc4], ebx
pop ebx
xor ecx, esp
call fcn.004d158d
add esp, 0xc
ret
Function at 0x444470
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [edi + 0x38]
test byte [eax], 8
jne 0x444487
mov dword [0x54dbc4], 0x6f
xor eax, eax
pop ecx
ret
push edi
mov edx, edi
call fcn.00444b60
add esp, 4
test eax, eax
je 0x444483
lea ecx, [edi + 4]
push ecx
mov edx, edi
call fcn.00444b60
add esp, 4
test eax, eax
je 0x444483
mov eax, dword [edi + 0x38]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x4444c1
push 3
lea edx, [esp + 4]
push edx
push edi
call ecx
add esp, 0xc
jmp 0x4444d6
mov eax, dword [eax + 0x38]
push eax
push 3
lea ecx, [esp + 8]
push 1
push ecx
call fcn.004d58a0
add esp, 0x10
cmp eax, 3
je 0x4444e9
mov dword [0x54dbc4], 0x66
xor eax, eax
pop ecx
ret
mov dl, byte [esp]
movzx eax, dl
mov ecx, eax
shr ecx, 4
and ecx, 7
inc ecx
mov dword [edi + 8], ecx
movzx ecx, byte [esp + 1]
and eax, 7
push ebx
inc eax
push esi
mov dword [edi + 0xc], ecx
test dl, dl
jns 0x4445d7
mov ecx, eax
mov esi, 1
shl esi, cl
push 0
call fcn.00445150
add esp, 4
mov dword [edi + 0x10], eax
test eax, eax
jne 0x444539
pop esi
mov dword [0x54dbc4], 0x6d
pop ebx
pop ecx
ret
xor ebx, ebx
cmp dword [eax], ebx
jle 0x4445de
xor esi, esi
mov eax, dword [edi + 0x38]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x44455e
push 3
lea edx, [esp + 0xc]
push edx
push edi
call ecx
add esp, 0xc
jmp 0x444573
mov eax, dword [eax + 0x38]
push eax
push 3
lea ecx, [esp + 0x10]
push 1
push ecx
call fcn.004d58a0
add esp, 0x10
cmp eax, 3
jne 0x4445b8
mov edx, dword [edi + 0x10]
mov eax, dword [edx + 8]
movzx ecx, byte [esp + 8]
mov byte [esi + eax], cl
mov edx, dword [edi + 0x10]
mov eax, dword [edx + 8]
movzx ecx, byte [esp + 9]
mov byte [eax + esi + 1], cl
mov edx, dword [edi + 0x10]
movzx ecx, byte [esp + 0xa]
mov eax, dword [edx + 8]
mov byte [eax + esi + 2], cl
mov edx, dword [edi + 0x10]
inc ebx
add esi, 3
cmp ebx, dword [edx]
jl 0x444545
pop esi
mov eax, 1
pop ebx
pop ecx
ret
mov esi, dword [edi + 0x10]
call fcn.004451d0
pop esi
mov dword [edi + 0x10], 0
mov dword [0x54dbc4], 0x66
xor eax, eax
pop ebx
pop ecx
ret
mov dword [edi + 0x10], 0
pop esi
mov eax, 1
pop ebx
pop ecx
ret

Function at 0x4445f0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [edx + 0x38]
test byte [eax], 8
jne 0x444607
mov dword [0x54dbc4], 0x6f
xor eax, eax
pop ecx
ret
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x44461d
push 1
lea eax, [esp + 7]
push eax
push edx
call ecx
add esp, 0xc
jmp 0x444632
mov ecx, dword [eax + 0x38]
push ecx
push 1
lea edx, [esp + 0xb]
push 1
push edx
call fcn.004d58a0
add esp, 0x10
cmp eax, 1
je 0x444645
mov dword [0x54dbc4], 0x66
xor eax, eax
pop ecx
ret
mov al, byte [esp + 3]
cmp al, 0x21
je 0x444683
cmp al, 0x2c
je 0x444676
cmp al, 0x3b
je 0x444669
mov dword [esi], 0
mov dword [0x54dbc4], 0x6b
xor eax, eax
pop ecx
ret
mov dword [esi], 4
mov eax, 1
pop ecx
ret
mov dword [esi], 2
mov eax, 1
pop ecx
ret
mov dword [esi], 3
mov eax, 1
pop ecx
ret
Function at 0x444990
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
mov esi, eax
mov eax, dword [esi + 0x38]
test byte [eax], 8
jne 0x4449ab
mov dword [0x54dbc4], 0x6f
xor eax, eax
pop esi
pop ecx
ret
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x4449c1
push 1
lea eax, [esp + 0xb]
push eax
push esi
call ecx
add esp, 0xc
jmp 0x4449d6
mov ecx, dword [eax + 0x38]
push ecx
push 1
lea edx, [esp + 0xf]
push 1
push edx
call fcn.004d58a0
add esp, 0x10
cmp eax, 1
je 0x4449ea
mov dword [0x54dbc4], 0x66
xor eax, eax
pop esi
pop ecx
ret
movzx eax, byte [esp + 7]
mov ecx, dword [esp + 0xc]
mov dword [ecx], eax
call fcn.00444a00
pop esi
pop ecx
ret

Function at 0x444a00
Capabilities:
Read file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esi + 0x38]
cmp dword [edi + 0x3c], 0
mov eax, edi
je 0x444a1f
mov edx, dword [eax + 0x3c]
push 1
lea ecx, [esp + 0xb]
push ecx
push esi
call edx
add esp, 0xc
jmp 0x444a34
mov ecx, dword [eax + 0x38]
push ecx
push 1
lea edx, [esp + 0xf]
push 1
push edx
call fcn.004d58a0
add esp, 0x10
cmp eax, 1
jne 0x444a80
mov cl, byte [esp + 7]
test cl, cl
jbe 0x444a8f
lea eax, [edi + 0x44]
mov byte [eax], cl
mov ecx, dword [esi + 0x38]
mov edx, dword [ecx + 0x3c]
mov dword [ebx], eax
inc eax
test edx, edx
je 0x444a62
movzx ecx, byte [esp + 7]
push ecx
push eax
push esi
call edx
add esp, 0xc
jmp 0x444a77
mov edx, dword [ecx + 0x38]
movzx ecx, byte [esp + 7]
push edx
push ecx
push 1
push eax
call fcn.004d58a0
add esp, 0x10
movzx edx, byte [esp + 7]
cmp eax, edx
je 0x444a95
mov dword [0x54dbc4], 0x66
xor eax, eax
pop edi
pop ecx
ret
mov dword [ebx], 0
mov eax, 1
pop edi
pop ecx
ret

Function at 0x444b60
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [edx + 0x38]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x444b7a
push 2
lea eax, [esp + 4]
push eax
push edx
call ecx
add esp, 0xc
jmp 0x444b8f
mov ecx, dword [eax + 0x38]
push ecx
push 2
lea edx, [esp + 8]
push 1
push edx
call fcn.004d58a0
add esp, 0x10
cmp eax, 2
je 0x444ba2
mov dword [0x54dbc4], 0x66
xor eax, eax
pop ecx
ret
mov ax, word [esp]
movzx ecx, ah
movzx edx, al
mov eax, dword [esp + 8]
shl ecx, 8
add ecx, edx
mov dword [eax], ecx
mov eax, 1
pop ecx
ret
Function at 0x444bc0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, dword [esi + 0x38]
cmp dword [edi + 0x3c], 0
mov eax, edi
je 0x444be4
mov edx, dword [eax + 0x3c]
push 1
lea ecx, [esp + 0xf]
push ecx
push esi
call edx
add esp, 0xc
jmp 0x444bf9
mov ecx, dword [eax + 0x38]
push ecx
push 1
lea edx, [esp + 0x13]
push 1
push edx
call fcn.004d58a0
add esp, 0x10
cmp eax, 1
jne 0x444c46
mov cl, byte [esp + 0xb]
test cl, cl
jbe 0x444c56
lea eax, [edi + 0x44]
mov byte [eax], cl
mov ecx, dword [esi + 0x38]
mov edx, dword [ecx + 0x3c]
mov dword [ebp], eax
inc eax
test edx, edx
je 0x444c28
movzx ecx, byte [esp + 0xb]
push ecx
push eax
push esi
call edx
add esp, 0xc
jmp 0x444c3d
mov edx, dword [ecx + 0x38]
movzx ecx, byte [esp + 0xb]
push edx
push ecx
push 1
push eax
call fcn.004d58a0
add esp, 0x10
movzx edx, byte [esp + 0xb]
cmp eax, edx
je 0x444c68
pop edi
mov dword [0x54dbc4], 0x66
xor eax, eax
pop ebp
pop ecx
ret
mov dword [ebp], 0
mov byte [edi + 0x44], 0
mov dword [edi + 0x34], 0
pop edi
mov eax, 1
pop ebp
pop ecx
ret

Function at 0x444c80
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [eax + 0x38]
xor ebx, ebx
push edi
mov ecx, esi
cmp dword [esi + 0x3c], ebx
je 0x444ca2
push 1
lea edx, [esp + 0x13]
push edx
push eax
mov eax, dword [ecx + 0x3c]
call eax
add esp, 0xc
jmp 0x444cb7
mov edx, dword [ecx + 0x38]
push edx
push 1
lea eax, [esp + 0x17]
push 1
push eax
call fcn.004d58a0
add esp, 0x10
movzx ecx, byte [esp + 0xf]
mov eax, 1
shl eax, cl
mov dword [esi + 8], ecx
inc ecx
mov edx, 1
mov dword [esi + 0xc], eax
inc eax
mov dword [esi + 0x10], eax
inc eax
shl edx, cl
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov eax, 0x1002
mov byte [esi + 0x44], bl
mov dword [esi + 0x28], ebx
mov dword [esi + 0x20], eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
lea edi, [esi + 0x2144]
mov dword [esi + 0x1c], edx
mov ecx, 0x1000
rep stosd dword es:[edi], eax
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x445060
Capabilities:
Read file on windows

Disassembly:
mov cl, byte [esi]
push ebp
mov ebp, dword [esp + 8]
push edi
test cl, cl
jne 0x445109
mov ecx, dword [ebx + 0x38]
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x445085
push 1
push esi
push ebx
call eax
add esp, 0xc
jmp 0x445096
mov eax, dword [ecx + 0x38]
push eax
push 1
push 1
push esi
call fcn.004d58a0
add esp, 0x10
cmp eax, 1
je 0x4450aa
pop edi
mov dword [0x54dbc4], 0x66
xor eax, eax
pop ebp
ret
mov al, byte [esi]
test al, al
jne 0x4450bf
pop edi
mov dword [0x54dbc4], 0x70
xor eax, eax
pop ebp
ret
mov ecx, dword [ebx + 0x38]
mov edx, dword [ecx + 0x3c]
lea edi, [esi + 1]
test edx, edx
je 0x4450d9
movzx ecx, al
push ecx
push edi
push ebx
call edx
add esp, 0xc
jmp 0x4450ec
mov edx, dword [ecx + 0x38]
push edx
movzx eax, al
push eax
push 1
push edi
call fcn.004d58a0
add esp, 0x10
mov cl, byte [esi]
movzx edx, cl
cmp eax, edx
jne 0x44509b
mov al, byte [edi]
mov byte [edi], 2
mov byte [ebp], al
dec cl
pop edi
mov byte [esi], cl
mov eax, 1
pop ebp
ret
mov al, byte [esi + 1]
movzx edx, al
mov dl, byte [edx + esi]
inc al
dec cl
pop edi
mov byte [ebp], dl
mov byte [esi + 1], al
mov byte [esi], cl
mov eax, 1
pop ebp
ret
Function at 0x446130
Capabilities:
Find taskbar

Disassembly:
sub esp, 0x68
push ebx
push ebp
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor ebp, ebp
cmp eax, ebp
je 0x446175
xor ecx, ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x18]
push ecx
push eax
mov dword [esp + 0x20], ebp
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x446175
push 2
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.USER32.dll_MonitorFromRect]
cmp eax, ebp
jne 0x4461a6
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
jne 0x446194
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebp
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push 2
push ecx
push edx
call dword [sym.imp.USER32.dll_MonitorFromPoint]
lea ecx, [esp + 0x48]
push ecx
push eax
mov dword [esp + 0x50], 0x28
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
test eax, eax
je 0x4461e0
mov edx, dword [esp + 0x5c]
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x64]
mov dword [esi], edx
mov edx, dword [esp + 0x68]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
pop edi
pop ebp
pop ebx
add esp, 0x68
ret
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push ebp
call edi
push 1
mov ebx, eax
call edi
xor ecx, ecx
xor edx, edx
mov dword [esi], ecx
mov dword [esi + 4], edx
push ebp
mov dword [esi + 8], ebx
push str.Shell_TrayWnd
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], ebx
mov dword [esi + 0xc], eax
call dword [sym.imp.USER32.dll_FindWindowW]
cmp eax, ebp
je 0x446250
lea ecx, [esp + 0x38]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.USER32.dll_IntersectRect]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x2c]
push eax
push esi
call dword [sym.imp.USER32.dll_SubtractRect]
pop edi
pop ebp
pop ebx
add esp, 0x68
ret