joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45af78
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x45b017
cmp dword [ebx + 0x94], 0
jne 0x45b011
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45af00
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45b011
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45afd7
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45b011
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00414c98
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45afe6
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45b230
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x470ccc]
cmp dword [eax + 0x30], 0
je 0x45b38d
test bl, bl
jne 0x45b2de
cmp dword [esi + 0x9c], 0
jne 0x45b2d3
mov eax, esi
call fcn.0045db70
push eax
push 0x45b15c
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x45b2a4
mov eax, dword [0x470ccc]
call fcn.0045e250
test al, al
je 0x45b2a4
mov eax, dword [0x470cf0]
call fcn.004059c0
mov edi, eax
cmp edi, 0
jl 0x45b2a4
push 0
mov eax, dword [0x470cf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x45b28e
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x45b2d3
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00414c98
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x45b2b3
inc dword [esi + 0x9c]
jmp 0x45b38d
cmp dword [esi + 0x9c], 0
jle 0x45b38d
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x45b38d
cmp dword [esi + 0x44], 0
je 0x45b339
mov eax, dword [0x470ccc]
call fcn.0045e250
test al, al
je 0x45b339
mov eax, dword [0x470cf0]
call fcn.004059c0
mov edi, eax
cmp edi, 0
jl 0x45b339
push 5
mov eax, dword [0x470cf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x45b323
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x45b368
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00414c98
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x45b348
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, 0x470cf0
mov ecx, 1
mov edx, dword [0x45b13c]
call fcn.00405b74
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x45be74
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x45bede
mov eax, ebx
call fcn.0045e250
test al, al
jne 0x45bede
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404ba8
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x45becb
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x45beeb
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404b0c
jmp 0x45beeb
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404b0c
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x45d374
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45d3e2
mov eax, esi
call fcn.00445fac
test al, al
je 0x45d3e2
mov eax, dword [ebx + 0x84]
call fcn.00445c0c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45d3e2
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x45d3d6
push 0
mov eax, dword [ebx + 0x84]
call fcn.00445c0c
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.0043da88
jmp 0x45d3e2
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.0045d1b0
pop esi
pop ebx
ret
Function at 0x45e99c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp], edx
mov ebx, eax
xor eax, eax
mov dword [esp + 4], eax
call fcn.0045e630
test al, al
jne 0x45e9c5
mov eax, dword [esp]
push eax
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov esi, eax
jmp 0x45ea1d
test ebx, ebx
je 0x45ea1d
lea eax, [ebx + 0x3c]
mov eax, dword [eax]
add eax, ebx
mov esi, dword [eax + 0x78]
add esi, ebx
mov ebp, dword [esi + 0x18]
dec ebp
test ebp, ebp
jl 0x45ea19
inc ebp
xor edi, edi
mov eax, dword [esi + 0x20]
add eax, ebx
mov eax, dword [eax + edi*4]
add eax, ebx
mov edx, dword [esp]
call fcn.00409518
test eax, eax
jne 0x45ea15
mov eax, dword [esi + 0x24]
add eax, ebx
movsx eax, word [eax + edi*2]
mov edx, dword [esi + 0x1c]
add edx, ebx
mov eax, dword [edx + eax*4]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add eax, ebx
mov dword [esp + 4], eax
inc edi
dec ebp
jne 0x45e9e0
mov esi, dword [esp + 4]
mov eax, esi
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x463f30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x108], edx
mov edi, eax
xor eax, eax
push ebp
push 0x464123
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
cmp dword [edi + 0x38], 0
jne 0x46410a
mov eax, dword [edi + 0x30]
test eax, eax
je 0x463f6e
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x463f8e
mov eax, dword [edi + 0x34]
test eax, eax
je 0x463f7e
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x463f8e
mov eax, edi
call fcn.004641c4
jmp 0x46410a
cmp dword [edi + 0xa0], 0
jne 0x463fc5
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0x30]
call fcn.004094d0
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x470e4c]
mov eax, dword [eax + 0x44]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xa0], eax
cmp dword [edi + 0xa4], 0
jne 0x463ffc
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0x34]
call fcn.004094d0
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x470e4c]
mov eax, dword [eax + 0x44]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xa4], eax
mov ecx, dword [edi + 0xa4]
mov edx, dword [edi + 0xa0]
mov eax, edi
call fcn.00464204
mov ebx, eax
test bl, bl
jne 0x4640bf
mov eax, dword [edi + 0x30]
test eax, eax
je 0x464025
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x46403f
mov eax, dword [edi + 0xc0]
test eax, eax
je 0x464038
sub eax, 4
mov eax, dword [eax]
test eax, eax
sete al
jmp 0x464041
xor eax, eax
test al, al
jne 0x4640bf
mov eax, dword [edi + 0xc0]
test eax, eax
je 0x464054
sub eax, 4
mov eax, dword [eax]
test eax, eax
je 0x46406b
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0xc0]
call fcn.004094d0
jmp 0x464097
push dword [edi + 0x30]
push 0x464140
push dword [edi + 0x34]
lea eax, [ebp - 0x108]
mov edx, 3
call fcn.00404e4c
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x101]
call fcn.004094d0
push 7
lea eax, [ebp - 0x101]
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jb 0x4640bf
mov ecx, dword [edi + 0xa4]
mov edx, dword [edi + 0xa0]
mov eax, edi
call fcn.00464204
mov ebx, eax
test bl, bl
jne 0x4640cc
mov eax, edi
call fcn.004641c4
jmp 0x46410a
mov eax, dword [edi + 0x58]
test eax, eax
je 0x4640db
mov dword [edi + 0xa8], eax
jmp 0x4640e5
mov dword [edi + 0xa8], 1
mov eax, edi
call fcn.0046427c
test al, al
je 0x46410a
mov eax, edi
mov si, 0xffee
call fcn.00403e88
xor ecx, ecx
xor edx, edx
mov eax, edi
call fcn.0046432c
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46412a
lea eax, [ebp - 0x108]
call fcn.00404ab8
ret
Function at 0x465814
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov byte [ebp - 9], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404f38
xor eax, eax
push ebp
push 0x4659a7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00404ab8
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.00404f48
mov ebx, eax
push ebx
call sub.version.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
je 0x46597f
mov eax, edi
call fcn.00402e50
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x465978
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
push eax
push edi
push 0
push ebx
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x4659b8
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueA
cmp dword [ebp - 0x1c], 0
ja 0x4658c5
mov ecx, 0x4659dc
mov dl, 1
mov eax, dword [0x4078dc]
call fcn.0040c458
call fcn.00404500
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x30]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
and eax, 0xffff
mov edx, 4
call fcn.00408b90
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
lea ecx, [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
shr eax, 0x10
and eax, 0xffff
mov edx, 4
call fcn.00408b90
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea eax, [ebp - 0x2c]
push eax
movzx eax, byte [ebp - 9]
mov ecx, dword [eax*4 + 0x46b860]
lea eax, [ebp - 0x38]
mov edx, 0x465a08
call fcn.00404dd0
mov eax, dword [ebp - 0x38]
mov ecx, 1
pop edx
call fcn.00409b2c
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
call fcn.00404f48
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueA
cmp dword [ebp - 0x1c], 0
jbe 0x465962
mov eax, esi
mov edx, dword [ebp - 0x18]
call fcn.00404cb0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46597f
mov eax, dword [ebp - 0x14]
call fcn.00402e6c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4659ae
lea eax, [ebp - 0x38]
mov edx, 3
call fcn.00404adc
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404adc
ret
Function at 0x465bf4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x465d20
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x109]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
mov eax, ebx
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.00404d28
push 0x465d30
call sub.kernel32.dll_GetModuleHandleA_2
mov esi, eax
test esi, esi
jns 0x465c53
call fcn.00403b54
test esi, esi
je 0x465cdf
push 0x465d40
test esi, esi
jns 0x465c69
call fcn.00403b54
push esi
call sub.kernel32.dll_GetProcAddress_1
mov edi, eax
test edi, edi
je 0x465cdf
mov eax, ebx
mov edx, pe_nt_image_headers32
call fcn.004051d8
push 0xff
mov eax, dword [ebx]
call fcn.00404f48
push eax
lea eax, [ebp - 0x110]
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.00404d28
mov eax, dword [ebp - 0x110]
call fcn.00404f48
push eax
call edi
test eax, eax
je 0x465ccd
mov eax, dword [ebx]
call fcn.00404f48
call fcn.00409410
mov edx, eax
mov eax, ebx
call fcn.004051d8
jmp 0x465cdf
mov eax, ebx
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.00404d28
mov esi, dword [ebx]
lea edx, [ebp - 4]
mov dword [ebp - 0x114], esi
mov eax, dword [ebp - 0x114]
call fcn.0040d160
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00404b0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x465d27
lea eax, [ebp - 0x110]
call fcn.00404ab8
lea eax, [ebp - 4]
call fcn.00404ab8
ret
Function at 0x406a10
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov eax, 0x10
mov ebp, esp
push ebx
sub esp, 0x64
and esp, 0xfffffff0
call fcn.00406c70
call fcn.00406c00
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x406a48
jmp 0x406ae6
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
jne 0x406a47
cmp cl, 0x22
je 0x406aa0
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
je 0x406ac0
lea esi, [esi]
lea edi, [edi]
test cl, cl
je 0x406ac0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
jne 0x406a80
jmp 0x406ac0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x22
setne al
xor edx, edx
test cl, cl
setne dl
test eax, edx
jne 0x406aa0
cmp cl, 0x22
je 0x406b22
lea esi, [esi]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
jmp 0x406ae0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete dl
cmp cl, 9
sete al
or eax, edx
test al, 1
jne 0x406ad0
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
test byte [ebp - 0x2c], 1
mov edx, 0xa
je 0x406b04
movzx edx, word [ebp - 0x28]
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call fcn.004013b0
sub esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
inc ebx
movzx ecx, byte [ebx]
jmp 0x406ac0

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x137057f0
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
mov ecx, 0x3ae7347b
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x411cb0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x1c], 0
je 0x411cbf
xor eax, eax
pop esi
ret 4
mov ecx, dword [esp + 8]
lea eax, [esi + 0x20]
push eax
push ecx
push esi
push 0x411c30
push 0
push 0
call fcn.0047af54
xor edx, edx
add esp, 0x18
test eax, eax
setne dl
mov dword [esi + 0x1c], eax
pop esi
mov eax, edx
ret 4

Function at 0x417640
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x4a2c4b
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x4c7894]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c7894]
xor eax, esp
push eax
lea eax, [esp + 0x224]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 0x219], eax
mov word [esp + 0x21d], ax
mov byte [esp + 0x21f], al
push 8
mov esi, ecx
mov ecx, dword [esi + 4]
lea eax, [esp + 0x21c]
push eax
xor ebx, ebx
push ecx
mov byte [esp + 0x224], bl
call dword [sym.imp.USER32.dll_GetClassNameA]
test eax, eax
je 0x4176f2
push 0x4ac6ec
lea edx, [esp + 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4176f2
mov eax, dword [esi + 4]
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov ecx, eax
or ecx, 0x100
cmp eax, ecx
je 0x4176f2
push ecx
mov ecx, dword [esi + 4]
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0x7f89
push ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
mov edi, eax
mov eax, dword [esi + 0x24]
cmp eax, ebx
je 0x417715
push eax
call dword [sym.imp.USER32.dll_DestroyCursor]
cmp eax, ebx
je 0x417715
mov dword [esi + 0x24], ebx
mov dword [esi + 0x24], edi
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_GetParent]
push ebx
push ebx
push 0x31
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [esi + 0x58], ebx
mov dword [esi + 0x28], eax
jne 0x4177bd
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
cmp eax, ebx
jle 0x4177bd
mov dword [esp + 0x14], ebx
lea edi, [eax + 1]
xor eax, eax
cmp eax, ebx
mov dword [esp + 0x22c], ebx
ja 0x417760
cmp edi, 0xffffffff
jbe 0x41776a
push 0x80070057
call fcn.004014a0
cmp edi, 0x200
jbe 0x417782
push edi
lea ecx, [esp + 0x18]
call fcn.00412910
mov eax, dword [esp + 0x14]
jmp 0x41778a
lea eax, [esp + 0x18]
mov dword [esp + 0x14], eax
cmp eax, ebx
mov ebp, eax
je 0x4177ac
mov ecx, dword [esi + 4]
push edi
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
jle 0x4177a8
push ebp
mov ecx, esi
call fcn.00416540
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
cmp eax, edx
je 0x4177bd
lea ecx, [esp + 0x14]
call fcn.00412530
mov ecx, dword [esp + 0x224]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.0047a194
add esp, 0x21c
ret
Function at 0x41b1b0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x4a3249
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c7894]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea eax, [esi + 4]
push eax
mov dword [esi], vtable.CMitThread.0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esi + 0x20]
push eax
push 4
xor ebx, ebx
push esi
push 0x411c30
push ebx
push ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x1c], ebx
mov dword [eax], ebx
call fcn.0047af54
add esp, 0x18
mov dword [esi + 0x1c], eax
mov ebp, dword [esp + 0x28]
lea edi, [esi + 0x30]
mov dword [esi], vtable.login_thread.0
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov eax, ebp
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], ebx
mov dword [esp + 0x20], ebx
mov byte [edi + 4], bl
lea ecx, [eax + 1]
mov dl, byte [eax]
add eax, 1
cmp dl, bl
jne 0x41b237
sub eax, ecx
push eax
push ebp
mov ecx, edi
call fcn.0040ecf0
mov ebp, dword [esp + 0x2c]
lea edi, [esi + 0x4c]
mov eax, ebp
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], ebx
mov byte [esp + 0x20], 1
mov byte [edi + 4], bl
lea ecx, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
add eax, 1
cmp dl, bl
jne 0x41b270
sub eax, ecx
push eax
push ebp
mov ecx, edi
call fcn.0040ecf0
mov ebp, dword [esp + 0x30]
lea edi, [esi + 0x68]
mov eax, ebp
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], ebx
mov byte [esp + 0x20], 2
mov byte [edi + 4], bl
lea ecx, [eax + 1]
mov dl, byte [eax]
add eax, 1
cmp dl, bl
jne 0x41b2a2
sub eax, ecx
push eax
push ebp
mov ecx, edi
call fcn.0040ecf0
mov eax, dword [esp + 0x34]
mov ebp, dword [esp + 0x44]
mov dword [esi + 0x84], eax
lea edi, [esi + 0x88]
mov eax, ebp
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], ebx
mov byte [esp + 0x20], 3
mov byte [edi + 4], bl
lea ecx, [eax + 1]
mov dl, byte [eax]
add eax, 1
cmp dl, bl
jne 0x41b2e1
sub eax, ecx
push eax
push ebp
mov ecx, edi
call fcn.0040ecf0
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov dword [esi + 0xac], eax
mov dword [esi + 0xa4], ecx
mov dword [esi + 0xa8], edx
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x20
Function at 0x422730
Capabilities:
Hide graphical window

Disassembly:
test ecx, ecx
push esi
je 0x42273d
lea esi, [ecx - 0x88]
jmp 0x42273f
xor esi, esi
mov eax, dword [esi + 4]
push 6
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 4]
push 0
push 0xf020
push 0x112
push ecx
call dword [sym.imp.USER32.dll_DefWindowProcA]
pop esi
ret

Function at 0x4245a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4a3e33
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4c7894]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [sym.imp.USER32.dll_DefWindowProcA]
xor edi, edi
mov dword [esi + 4], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], eax
mov eax, 1
mov dword [esi], vtable.wly::CButtonXYLM.0
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], eax
mov dword [esp + 0x18], edi
mov dword [esi + 0x38], edi
push 0x413ee0
push 0x422d80
push 3
push 4
lea ecx, [esi + 0x3c]
push ecx
mov byte [esp + 0x2c], al
call fcn.0047a99e
mov dword [esi + 0x48], edi
mov eax, 0xffffff
push 0xc
mov ecx, esi
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x5c], edi
call fcn.00423b50
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x428a10
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x4a427b
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
push esi
mov eax, dword [0x4c7894]
xor eax, esp
push eax
lea eax, [esp + 0xac]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x29c], 0x14
jge 0x428b38
push 1
push 3
lea ecx, [esp + 0x2c]
call fcn.00428520
mov eax, 0x14
sub eax, dword [esi + 0x29c]
lea ecx, [esp + 0x2c]
push eax
push 0x4ace78
push ecx
mov dword [esp + 0xc0], 0
call fcn.00421560
add esp, 8
mov ecx, eax
call fcn.00421770
lea edx, [esp + 8]
push edx
lea ecx, [esp + 0x28]
call fcn.0041cc60
cmp dword [eax + 0x18], 0x10
jb 0x428a9f
mov eax, dword [eax + 4]
jmp 0x428aa2
add eax, 4
push eax
mov eax, dword [esi + 0x1a4]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
cmp dword [esp + 0x20], 0x10
jb 0x428ac4
mov ecx, dword [esp + 0xc]
push ecx
call fcn.0047964d
add esp, 4
mov edx, dword [esi + 0x1a4]
push edx
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x428af8
push eax
mov eax, dword [esi + 0x1a4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [esp + 0x78]
mov dword [esp + 0xb4], 0xffffffff
call fcn.00416250
lea ecx, [esp + 0x78]
push ecx
mov dword [esp + 0x7c], vtable.std::ios_base.0
call fcn.00477b46
add esp, 4
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xb0
ret
mov edx, dword [esi + 0x1a4]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xb0
ret