joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e13b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.005f01a0
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x18]
inc ebp
push edi
mov edi, dword [esp + 0x20]
mov eax, dword [esi + 4]
mov ecx, dword [edi + 8]
mov eax, dword [eax + 0x64]
test byte [eax + 0x30], 1
je 0x5e143a
mov edx, dword [esp + 0x24]
lea eax, [edx + ebp]
cmp eax, ecx
ja 0x5e143e
add dword [edi + 0x14], edx
sub ecx, edx
add dword [edi + 0x18], edx
sub dword [edi + 0xc], edx
mov dword [edi + 8], ecx
mov eax, dword [edi + 0x14]
push ebx
push dword [esi + 0x3cc]
mov al, byte [eax + ecx - 1]
movzx ebx, al
mov byte [esp + 0x30], al
mov dword [esp + 0x24], ebx
call fcn.004f9020
push eax
call fcn.004f4c70
mov esi, dword [edi + 8]
add esp, 8
mov dword [esp + 0x18], esi
and eax, 0x200000
je 0x5e1447
sub esi, ebx
mov eax, 1
dec esi
pop ebx
mov dword [edi + 8], esi
pop edi
pop esi
pop ebp
add esp, 0xc
ret
cmp ebp, ecx
jbe 0x5e13f2
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret
lea ecx, [ebx + ebp]
mov eax, esi
mov ebx, esi
xor eax, ecx
sub ebx, ecx
xor ebx, ecx
or ebx, eax
mov eax, 0x100
xor ebx, esi
shr ebx, 0x1f
dec ebx
cmp esi, eax
cmovb eax, esi
xor ebp, ebp
mov dword [esp + 0x10], eax
test eax, eax
je 0x5e14c3
mov edx, dword [esp + 0x20]
dec esi
mov edi, dword [edi + 0x14]
shr edx, 0x1f
add edi, esi
mov esi, dword [esp + 0x20]
mov dword [esp + 0x14], edx
mov eax, esi
lea edi, [edi - 1]
sub eax, ebp
mov ecx, ebp
shr ecx, 0x1f
inc ebp
shr eax, 0x1f
xor al, cl
xor cl, dl
or al, cl
movzx ecx, byte [esp + 0x2c]
dec al
movzx edx, al
movzx eax, byte [edi + 1]
xor ecx, eax
and edx, ecx
not edx
and ebx, edx
mov edx, dword [esp + 0x14]
cmp ebp, dword [esp + 0x10]
jb 0x5e1485
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
not ebx
movzx ecx, bl
inc eax
dec ecx
shr ecx, 0x1f
neg ecx
and eax, ecx
sub esi, eax
mov dword [edi + 8], esi
mov dword [esp + 0x2c], ecx
not ecx
pop ebx
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
and ecx, 1
pop edi
pop esi
or eax, ecx
pop ebp
add esp, 0xc
ret
Function at 0x1001bd34
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ebx, ebx
push edi
mov edi, ecx
push 5
pop eax
push ebx
mov dword [edi], eax
mov dword [edi + 4], eax
mov word [edi + 8], 1
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
push 0x5b
mov dword [edi + 0xc], 4
call esi
push ebx
push 0x10
mov byte [edi + 0x29], al
call esi
push ebx
push 0xa0
mov byte [edi + 0x26], al
call esi
push ebx
push 0xa1
mov byte [edi + 0x27], al
call esi
push ebx
push 0x11
mov byte [edi + 0x28], al
call esi
push ebx
push 0x12
mov byte [edi + 0x24], al
call esi
mov byte [edi + 0x25], al
pop edi
pop esi
pop ebx
ret

Function at 0x1001c671
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x1001c680
pop dword [ebp - 0x24]
mov eax, 0x2e1ddb60
sub eax, 0x1e1c14e0
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x6d21c590
sub dword [ebp - 0x34], 0x1ecf8045
mov dword [ebp - 0x30], 0x537534c8
sub dword [ebp - 0x30], 0x2141e883
mov dword [ebp - 0x2c], 0xe22ad69
sub dword [ebp - 0x2c], 0xc1d6693b
mov dword [ebp - 0x28], 0xb44e3825
add dword [ebp - 0x28], 0x4bb1c7db
lea eax, [ebp - 0x34]
push eax
mov eax, 0x3d5ee227
sub eax, 0x2d5a9123
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xa9510238
sub dword [ebp - 0x34], 0x34de98e2
mov dword [ebp - 0x30], 0x791aceba
add dword [ebp - 0x30], 0xc85192bb
mov dword [ebp - 0x2c], 0xbb3f496b
sub dword [ebp - 0x2c], 0x57cfdcff
mov dword [ebp - 0x28], 0x4012abb4
sub dword [ebp - 0x28], 0x4012abb4
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x4c1c6
push 0
call eax
mov ecx, 0x85234e90
add ecx, 0x7add0061
xor ebx, ebx
add ebx, eax
mov edi, 0xaf991938
sub edi, 0x9f91c938
add edi, dword [ebp - 0x24]
mov edx, 0x5f6913f9
add edx, 0x3e37822e
add dword [ebp - 4], edi
mov esi, dword [edi]
xor dword [ebp - 4], eax
sub esi, edx
add dword [ebp - 0x1c], ebx
mov dword [ebx], esi
add ebx, 4
add edi, 0x324f9cad
add edi, 0xcdb06357
loop 0x1001c79f
add eax, 0x12e97
xor ebx, ebx
add ebx, eax
add eax, 0x221255b0
add eax, 0xddedaa55
mov ecx, 0x712dd7d7
add ecx, 0x9ed22829
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x407229
Capabilities:
Check mutex on windows

Disassembly:
push 4
mov eax, 0x5686e1
call fcn.0050feac
push str.xundupdf_screencapture
lea ecx, [ebp - 0x10]
call fcn.0040941c
and dword [ebp - 4], 0
mov eax, dword [0x5db108]
cmp dword [eax - 0xc], 0
jle 0x40725d
push dword [eax - 0xc]
lea ecx, [ebp - 0x10]
push eax
call fcn.0040826d
push dword [ebp - 0x10]
xor esi, esi
inc esi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
je 0x40727d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40727f
xor esi, esi
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00409cc2
mov eax, esi
call fcn.0050fe75
ret
Function at 0x40c1bd
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x5689dd
call fcn.0050ff4e
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x418], ebx
push 0x60
push ebx
push esi
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x40c23a
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x40c23a
call fcn.0040a70e
mov esi, eax
jmp 0x40c311
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x40c25d
call fcn.0040a70e
jmp 0x40c304
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x40c253
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x420], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x40c28d
mov esi, 0x8007000e
jmp 0x40c306
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.0040a6e0
jmp 0x40c2b3
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
je 0x40c286
push esi
push dword [ebp - 0x418]
push esi
push dword [ebp - 0x41c]
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x40c253
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.0040c081
mov esi, eax
test edi, edi
je 0x40c311
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x40c32a
lea ecx, [ebp - 0x418]
call fcn.0040a681
mov eax, esi
call fcn.0050fe9b
ret 0x10
Function at 0x40c698
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov ebx, ecx
call fcn.0040c62e
mov ecx, dword [ebp + 0xc]
xor edi, edi
test ecx, ecx
je 0x40c776
mov edx, ecx
push esi
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, di
jne 0x40c6b8
sub edx, esi
sar edx, 1
je 0x40c775
push 0x83e
push ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
mov dword [ebp - 4], esi
test esi, esi
je 0x40c736
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x40c736
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push edi
push 0x22
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [ebx + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [ebp + 0xc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push eax
push esi
call fcn.00512bc0
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor edi, edi
cmp dword [ebx + 0xc], 0
je 0x40c775
lea eax, [ebp + 8]
mov dword [ebp + 8], edi
push eax
push 1
push dword [ebx + 0xc]
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x40c775
cmp dword [ebp + 8], eax
je 0x40c775
push 0x10
call dword [sym.imp.gdiplus.dll_GdipAlloc]
test eax, eax
je 0x40c770
push ecx
push dword [ebp + 8]
mov ecx, eax
call fcn.0040cbbd
jmp 0x40c772
mov eax, edi
mov dword [ebx + 0x14], eax
pop esi
mov ecx, dword [ebx + 0x14]
test ecx, ecx
je 0x40c79a
call fcn.0040cb96
mov ecx, dword [ebx + 0x14]
mov dword [ebx + 4], eax
call fcn.0040cb6f
mov dword [ebx + 8], eax
xor eax, eax
cmp dword [ebx + 4], edi
setg al
jmp 0x40c79c
xor eax, eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40d334
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], edx
push eax
push 0x80
push 2
push eax
push eax
push 0xc0000000
push ecx
mov esi, 0xfa000
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40d366
xor eax, eax
jmp 0x40d3b3
mov eax, dword [ebp - 4]
push edi
mov edi, dword [ebp + 8]
push 0
cmp edi, 0xfa000
lea ecx, [ebp - 8]
push ecx
cmovb esi, edi
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40d3a9
cmp esi, edi
je 0x40d39d
mov eax, dword [ebp - 4]
sub edi, 0xfa000
add eax, esi
mov dword [ebp - 4], eax
jmp 0x40d36d
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x40d3b2
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40dd6c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [ebp + 0xc], ebx
jne 0x40dd81
push 0x83e
jmp 0x40dd84
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [0x5c9bf0]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x40de72
push esi
push dword [0x5c9bf0]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x40de72
push esi
push dword [0x5c9bf0]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push edi
push 0x22
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [ebp + 0xc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push eax
push esi
call fcn.00512bc0
add esp, 0xc
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov esi, dword [ebp - 4]
test esi, esi
je 0x40de72
lea eax, [ebp + 0xc]
xor edi, edi
push eax
push 1
push esi
mov dword [ebp + 0xc], edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x40de31
cmp dword [ebp + 0xc], ebx
je 0x40de31
push 0x10
call dword [sym.imp.gdiplus.dll_GdipAlloc]
test eax, eax
je 0x40de31
push ecx
push dword [ebp + 0xc]
mov ecx, eax
call fcn.0040e4ae
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test ebx, ebx
je 0x40de72
mov dword [ebp + 8], edi
mov eax, dword [ebx + 8]
mov dword [ebx + 8], edi
test eax, eax
jne 0x40de65
push edi
lea eax, [ebp + 8]
push eax
push dword [ebx + 4]
call dword [sym.imp.gdiplus.dll_GdipCreateHBITMAPFromBitmap]
test eax, eax
je 0x40de65
mov dword [ebx + 8], eax
mov eax, dword [ebx]
mov ecx, ebx
push 1
call dword [eax]
mov eax, dword [ebp + 8]
jmp 0x40de74
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40e612
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5b1074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
push 0
push 0x100
push 0
lea ebx, [esi + 4]
mov ecx, ebx
call fcn.0040e9fb
lea edi, [esi + 0x28]
push 1
mov ecx, edi
call fcn.0041c4d9
push dword [ebx]
call fcn.0041b99f
push 0xd
push str.IDB_PNG2
push ecx
mov ecx, edi
call fcn.0041b9f2
cmp dword [0x5c9e0c], 0
mov eax, dword [0x5db104]
je 0x40e6aa
cmp dword [eax - 0xc], 0
jne 0x40e692
mov ecx, dword [esi + 0xdc]
xor eax, eax
test ecx, ecx
mov edx, 0x5b5000
setne al
add eax, 0xc
push eax
mov eax, 0x5b85a0
test ecx, ecx
cmovne eax, edx
jmp 0x40e6ec
mov ecx, dword [0x5c9bf4]
test ecx, ecx
push 0xb
pop eax
push 2
pop edx
cmovne eax, edx
mov edx, 0x5b22a0
jmp 0x40e6e3
cmp dword [eax - 0xc], 0
jne 0x40e6cd
mov ecx, dword [esi + 0xdc]
xor eax, eax
test ecx, ecx
mov edx, 0x5be480
setne al
add eax, 0xc
push eax
mov eax, 0x5c1a20
jmp 0x40e68b
mov ecx, dword [0x5c9bf4]
test ecx, ecx
push 0xb
pop eax
push 2
pop edx
cmovne eax, edx
mov edx, 0x5bb720
push eax
mov eax, 0x5b1a60
cmove eax, edx
push eax
mov ecx, edi
call fcn.0041b769
push 0x1b
pop ecx
push 6
push ecx
xor edx, edx
mov dword [esi + 0xc4], eax
push eax
push edx
push edx
push edx
push dword [ebx]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
call fcn.0041c036
push 1
mov ecx, edi
call fcn.0041c4cc
push 0
push dword [ebx]
call dword [sym.imp.USER32.dll_ShowWindow]
and dword [esi + 0xd8], 0
xor eax, eax
mov ecx, dword [ebp - 4]
inc eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0050eff9
mov esp, ebp
pop ebp
ret 4
Function at 0x40f995
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5b1074]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x228], eax
je 0x40fb53
xor ecx, ecx
mov dword [ebx + 0x228], eax
inc ecx
xor edi, edi
cmp eax, ecx
je 0x40fa98
cmp eax, 3
je 0x40fa98
cmp eax, 2
jne 0x40fb48
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push dword [ebx + 0x22c]
call esi
push 5
push dword [ebx + 0x230]
call esi
push edi
lea ecx, [ebx + 0x3c]
call fcn.0041c4cc
mov esi, dword [sym.imp.USER32.dll_SetWindowPos]
mov edi, 0xc8
push 4
push edi
push 0x3c
push 7
push 0x1e
push 0
push dword [ebx + 0x230]
call esi
push 4
push edi
push 0x2b
push 7
push 0x64
xor edi, edi
push edi
push dword [ebx + 0x22c]
call esi
movaps xmm0, xmmword [0x592510]
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebx + 0x174]
movups xmmword [ebp - 0x18], xmm0
call fcn.0041c036
movaps xmm0, xmmword [0x592470]
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebx + 0xd8]
movups xmmword [ebp - 0x28], xmm0
call fcn.0041c036
push 0x22
push 0xb2
push 5
push 0x96
lea eax, [ebx + 0x214]
push eax
call dword [sym.imp.USER32.dll_SetRect]
push 6
push 0x27
push 0x144
push edi
push edi
push edi
push dword [ebx + 4]
call esi
jmp 0x40fb45
push ecx
lea ecx, [ebx + 0x3c]
call fcn.0041c4cc
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [ebx + 0x22c]
call esi
push 0
push dword [ebx + 0x230]
call esi
movaps xmm0, xmmword [0x592500]
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebx + 0x174]
movups xmmword [ebp - 0x28], xmm0
call fcn.0041c036
movaps xmm0, xmmword [0x592460]
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebx + 0xd8]
movups xmmword [ebp - 0x18], xmm0
call fcn.0041c036
push 0x22
push 0x76
push 5
push 0x5a
lea eax, [ebx + 0x214]
push eax
call dword [sym.imp.USER32.dll_SetRect]
xor eax, eax
cmp dword [ebp + 8], 1
push ecx
setne al
lea ecx, [ebx + 0x3c]
add eax, 0x500
push eax
call fcn.0041c29c
push 0xa
pop eax
xor ecx, ecx
push 6
inc ecx
cmp dword [ebp + 8], ecx
push 0x27
push 0x108
cmove eax, ecx
xor edi, edi
push edi
push edi
push edi
push dword [ebx + 4]
mov dword [ebx + 0x224], eax
call dword [sym.imp.USER32.dll_SetWindowPos]
xor ecx, ecx
inc ecx
push ecx
push edi
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0050eff9
mov esp, ebp
pop ebp
ret 4
Function at 0x410ba0
Capabilities:
Hide graphical window

Disassembly:
push 0x1c
mov eax, 0x568bb2
call fcn.0050fee0
mov esi, edx
mov ebx, ecx
mov ecx, dword [0x5ca1ec]
xor edi, edi
test ecx, ecx
je 0x410bc9
mov eax, dword [ecx]
push 1
call dword [eax + 0xc]
mov dword [0x5ca1ec], edi
push 0x130
call fcn.0050f042
pop ecx
mov dword [ebp - 0x28], eax
mov ecx, eax
mov dword [ebp - 4], edi
call fcn.0041099e
or dword [ebp - 4], 0xffffffff
push ecx
mov ecx, eax
mov dword [0x5ca1ec], eax
call fcn.00435330
mov eax, dword [0x5ca1ec]
mov dword [eax + 0x128], esi
push dword [eax + 0x38]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x410c56
push ecx
push ecx
mov ecx, dword [0x5ca1ec]
lea edx, [ebp - 0x24]
mov eax, esp
push 0
push SysReAllocString
lea esi, [ecx + 0x7c]
mov dword [eax], edi
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
push ecx
push ecx
mov eax, esp
movsd dword es:[edi], dword [esi]
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [eax], edx
call fcn.00433d30
mov ecx, dword [0x5ca1ec]
push 0xb4
mov eax, dword [ecx]
call dword [eax + 0x40]
mov eax, dword [0x5ca1ec]
push 1
push dword [eax + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
call fcn.0050fe8a
ret

Function at 0x410d63
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x5ca1ec]
test eax, eax
je 0x410d77
push 0
push dword [eax + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x4121b6
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x5b1074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov ebx, ecx
push 0x20a
push eax
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x218]
push eax
call fcn.00516180
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push dword [ebx + 4]
xorps xmm0, xmm0
movups xmmword [ebp - 0x228], xmm0
call dword [sym.imp.USER32.dll_GetDC]
push dword [ebx + 0x58]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
mov esi, eax
push esi
mov dword [ebp - 0x244], esi
call edi
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x240], eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x23c]
jne 0x412236
push 0x400
sub ecx, edx
lea eax, [ebp - 0x228]
push eax
sar ecx, 1
lea eax, [ebp - 0x218]
push ecx
push eax
push esi
call dword [sym.imp.USER32.dll_DrawTextW]
push dword [ebp - 0x240]
push esi
call edi
lea esi, [ebx + 0x38]
lea edi, [ebp - 0x238]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x238]
mov esi, dword [ebp - 0x220]
sub esi, dword [ebp - 0x228]
lea ecx, [eax + 0x1e]
add ecx, esi
cmp ecx, dword [ebx + 0x50]
cmovg ecx, dword [ebx + 0x50]
xor edx, edx
mov dword [ebp - 0x230], ecx
inc edx
sub ecx, eax
lea eax, [ecx - 0x1e]
test eax, eax
jg 0x4122b1
mov eax, ecx
test eax, eax
cmovle eax, edx
cmp esi, eax
jle 0x4122be
mov ecx, eax
add ecx, eax
inc edx
cmp esi, ecx
jg 0x4122b7
mov ecx, dword [ebp - 0x21c]
sub ecx, dword [ebp - 0x224]
mov eax, dword [ebp - 0x234]
push dword [ebp - 0x244]
imul ecx, edx
add eax, 0x1e
push dword [ebx + 4]
add eax, ecx
cmp eax, dword [ebx + 0x54]
cmovg eax, dword [ebx + 0x54]
mov dword [ebp - 0x22c], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
lea eax, [ebp - 0x238]
mov ecx, ebx
push eax
call fcn.00412170
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0050eff9
mov esp, ebp
pop ebp
ret

Function at 0x4126ff
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0x100
jne 0x412728
cmp dword [eax + 8], 0x1b
jne 0x412728
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
inc eax
jmp 0x412737
push eax
add ecx, 0xffffffcc
call fcn.0041739e
neg eax
sbb eax, eax
neg eax
pop ebp
ret 4
Function at 0x414582
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x5b1074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
push 3
pop eax
mov edx, eax
mov ecx, dword [ebx + 4]
call fcn.00410ba0
lea ecx, [ebp - 0x28]
call fcn.00410d8b
call fcn.00410d63
call fcn.0041a251
mov ecx, dword [ebx + 0x18c]
lea esi, [ebp - 0x28]
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp ecx, 0x50f
jne 0x4145d7
mov dword [ebp - 8], 1
jmp 0x4145fa
cmp ecx, 0x510
jne 0x4145e8
mov dword [ebp - 8], 2
jmp 0x4145fa
mov eax, dword [ebp - 8]
cmp ecx, 0x50e
push 3
pop ecx
cmove eax, ecx
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x34], 0x14
mov dword [ebp - 0x30], eax
xor esi, esi
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x38], 0x3ec
push eax
push 0xbb8
push esi
lea eax, [ebp - 0x38]
mov dword [ebp - 0x2c], esi
push eax
push dword [ebx + 4]
push 0x4a
call fcn.0041290c
push eax
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
jne 0x414644
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0050eff9
mov esp, ebp
pop ebp
ret
Function at 0x414665
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x5b1074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
xor esi, esi
push edi
cmp dword [ebx + 0x17c], esi
je 0x4146ae
lea eax, [ebx + 0x50]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_CopyRect]
lea eax, [ebp - 0x24]
mov dword [ebp - 0xc], 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0x3ec
mov dword [ebp - 0x4c], esi
jmp 0x4147a9
mov eax, dword [ebx + 0x180]
test eax, eax
jne 0x4146ce
mov eax, dword [ebx + 0xc8]
push 5
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4147da
cmp eax, 3
je 0x41472c
cmp eax, 2
je 0x41472c
cmp eax, 4
je 0x41472c
lea eax, [ebx + 0x50]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_CopyRect]
mov eax, dword [ebx + 0x180]
sub esp, 0x28
mov ecx, ebx
push esp
cmp eax, 1
jne 0x414705
call fcn.00413d88
push 1
jmp 0x414719
cmp eax, 6
jne 0x414713
call fcn.00413d88
push 2
jmp 0x414719
call fcn.00413d88
push esi
mov ecx, dword [ebx + 4]
lea edx, [ebp - 0x14]
call fcn.0041a268
add esp, 0x2c
jmp 0x4147da
lea eax, [ebx + 0x50]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_CopyRect]
lea ecx, [ebp - 0x48]
call fcn.00410d8b
mov esi, eax
mov ecx, dword [ebx + 0x180]
lea edi, [ebp - 0x24]
push 3
pop eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x24]
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp ecx, eax
jne 0x41476b
mov dword [ebp - 0x28], 2
jmp 0x41477f
cmp ecx, 4
je 0x41477c
mov eax, dword [ebp - 0x28]
xor edx, edx
inc edx
cmp ecx, 2
cmove eax, edx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], 0x14
xor esi, esi
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0x3ec
mov dword [ebp - 0x4c], esi
call fcn.00410d63
push 0x510
mov ecx, ebx
call fcn.00413a6b
lea eax, [ebp - 0x4c]
push eax
push 0xbb8
push esi
lea eax, [ebp - 0x10]
push eax
push dword [ebx + 4]
push 0x4a
call fcn.0041290c
push eax
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
jne 0x4147da
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0050eff9
mov esp, ebp
pop ebp
ret