joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40722f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xd8
mov eax, 0x4374d9
call fcn.004291b9
xor esi, esi
push esi
push 0x8a
mov ecx, ebx
mov dword [ebp - 0xd8], ebx
mov dword [ebp - 0xd4], esi
call fcn.0041c87f
push esi
push esi
xor edi, edi
inc edi
push edi
mov dword [ebp - 4], esi
push edi
lea ecx, [ebx + 0x94]
mov dword [ebx], 0x446134
call fcn.00419b6a
push esi
push esi
push edi
push edi
lea ecx, [ebx + 0x9c]
mov byte [ebp - 4], 1
call fcn.00419b6a
mov dword [ebx + 0xa4], 0x445d6c
mov dword [ebx + 0xa8], esi
mov dword [ebx + 0xb4], esi
mov dword [ebx + 0xb0], esi
mov dword [ebx + 0xac], esi
mov dword [ebx + 0xc0], esi
mov byte [ebp - 4], 4
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x33]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x34], 0x66303662
mov dword [ebp - 0x30], 0x61653138
mov dword [ebp - 0x2c], 0x35343564
mov dword [ebp - 0x28], 0x32636663
mov dword [ebp - 0x24], 0x64386436
mov dword [ebp - 0x20], 0x64326337
mov dword [ebp - 0x1c], 0x32396565
mov dword [ebp - 0x18], 0x34303236
call dword [0x438438]
push 0x94
push esi
mov edi, 0x4527d0
push edi
mov dword [0x45316c], eax
call fcn.00424240
add esp, 0xc
push edi
mov edi, dword [0x438288]
mov dword [0x4527d0], 0x94
call edi
lea eax, [ebp - 0xcc]
push eax
mov ecx, 0x440580
call fcn.00407909
pop ecx
mov ecx, dword [ebp - 0xcc]
add ecx, 0xfffffff0
call fcn.00402d34
push esi
push esi
call dword [0x4384d8]
cmp eax, esi
je 0x40737c
lea eax, [ebp - 0xcc]
push eax
mov ecx, 0x446080
call fcn.00407909
pop ecx
call fcn.004079cd
mov ecx, dword [ebp - 0xcc]
add ecx, 0xfffffff0
call fcn.00402d34
push 8
call fcn.004120bd
pop ecx
mov dword [ebp - 0xcc], eax
mov byte [ebp - 4], 5
cmp eax, esi
je 0x4073c4
lea eax, [ebp - 0xd0]
push eax
mov ecx, 0x4460a8
call fcn.00407909
pop ecx
mov byte [ebp - 4], 6
mov eax, dword [eax]
push esi
xor ecx, ecx
inc ecx
push eax
push ecx
mov dword [ebp - 0xd4], ecx
push ecx
mov ecx, dword [ebp - 0xcc]
call fcn.00419b6a
jmp 0x4073c6
xor eax, eax
mov dword [ebp - 4], 4
test byte [ebp - 0xd4], 1
mov dword [0x452864], eax
je 0x4073e9
mov ecx, dword [ebp - 0xd0]
add ecx, 0xfffffff0
call fcn.00402d34
push esi
push dword [0x452864]
lea ecx, [ebp - 0xe4]
call fcn.00419c33
lea ecx, [ebp - 0xe4]
mov byte [ebp - 4], 8
call fcn.00419bd8
mov dword [ebx + 0xbc], esi
cmp dword [ebx + 0xc0], esi
je 0x40742c
push 0x4462c4
xor eax, eax
lea esi, [ebx + 0xc0]
call fcn.00405b3b
xor esi, esi
push 0x94
lea eax, [ebp - 0xc8]
push esi
push eax
mov byte [ebx + 0xb8], 0
call fcn.00424240
add esp, 0xc
lea eax, [ebp - 0xc8]
push eax
mov dword [ebp - 0xc8], 0x94
call edi
cmp dword [ebp - 0xc4], 6
ja 0x407470
jne 0x40747c
cmp dword [ebp - 0xc0], esi
ja 0x407470
jne 0x40747c
mov dword [0x4630d4], 1
jmp 0x40749c
lea eax, [ebp - 0xd0]
push eax
mov ecx, 0x440580
call fcn.00407909
pop ecx
mov ecx, dword [ebp - 0xd0]
add ecx, 0xfffffff0
call fcn.00402d34
lea ecx, [ebp - 0xe4]
mov byte [ebp - 4], 4
call fcn.00419bd8
mov eax, ebx
call fcn.0042923c
ret
Function at 0x40fe7d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [edi + 0x24]
push esi
mov esi, dword [edi + 0x34]
sub esi, dword [edi + 0x6c]
mov eax, dword [edi + 0x64]
mov ecx, dword [edi + 0x24]
lea ecx, [ebx + ecx - 0x106]
sub esi, eax
cmp eax, ecx
jb 0x40ff04
mov eax, dword [edi + 0x30]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.00425750
mov eax, dword [edi + 0x44]
mov ecx, dword [edi + 0x3c]
sub dword [edi + 0x68], ebx
sub dword [edi + 0x64], ebx
add esp, 0xc
sub dword [edi + 0x54], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
sub eax, 2
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x40fec5
mov eax, dword [edi + 0x38]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
sub eax, 2
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x40fee8
add esi, ebx
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x40ff5c
mov ecx, dword [edi + 0x6c]
add ecx, dword [edi + 0x64]
push esi
add ecx, dword [edi + 0x30]
mov esi, eax
push ecx
call fcn.0040fc41
add dword [edi + 0x6c], eax
mov esi, dword [edi + 0x6c]
pop ecx
pop ecx
cmp esi, 3
jb 0x40ff48
mov edx, dword [edi + 0x64]
add edx, dword [edi + 0x30]
mov ecx, dword [edi + 0x50]
movzx eax, byte [edx]
mov dword [edi + 0x40], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [edi + 0x4c]
mov dword [edi + 0x40], eax
cmp esi, 0x106
jae 0x40ff5c
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x40fe86
pop esi
pop ebx
leave
ret
Function at 0x664c17a0
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x48
mov ebx, dword [ecx]
mov esi, dword [ecx + 4]
test byte [0x664c3018], 8
jne 0x664c18f0
mov dword [esp + 8], 8
mov dword [esp + 4], 0
mov ebx, dword fs:[0x18]
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x2c], eax
call eax
sub esp, 0xc
mov edi, eax
test eax, eax
je 0x664c18d9
lea eax, [eax + 4]
mov dword [esp + 0xc], 0
mov dword [ebp - 0x30], eax
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x1c]
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 2
mov dword [esp], esi
call sym._EnumMonitorsW_24
sub esp, 0x18
test eax, eax
jne 0x664c18d0
cmp dword [ebx + 0x34], 0x7a
je 0x664c1878
mov dword [esp + 8], edi
xor edi, edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, edi
sub esp, 0xc
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [ebx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x2c]
call eax
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x1c]
sub esp, 0xc
mov dword [edi], eax
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x1c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], 2
mov dword [esp], esi
call sym._EnumMonitorsW_24
sub esp, 0x18
test eax, eax
je 0x664c183f
nop
test byte [0x664c3018], 8
jne 0x664c1930
lea esp, [ebp - 0x10]
mov eax, edi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
mov eax, esi
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str.__ld___s__n
mov dword [esp + 8], 0x664c50b0
mov dword [esp + 4], 0x664c3018
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x664c17c6
mov eax, dword [edi + 4]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.___p___lu_monitors_installed__n
mov dword [esp + 0x14], eax
mov dword [esp + 8], 0x664c50b0
mov dword [esp + 4], 0x664c3018
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
lea esp, [ebp - 0x10]
mov eax, edi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
Function at 0x664c1970
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x2c
mov ebx, dword [ecx]
test byte [0x664c3018], 8
jne 0x664c19f8
test ebx, ebx
je 0x664c19bf
mov eax, dword [ebx + 4]
mov esi, dword [sym.imp.kernel32.dll_HeapFree]
test eax, eax
jne 0x664c19d0
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 4
mov edx, dword [ebx]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call esi
sub esp, 0xc
jmp 0x664c199f
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__p__n
mov dword [esp + 8], str.PSetupDestroyMonitorInfo
mov dword [esp + 4], 0x664c3018
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x664c198e

Function at 0x664c1c20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x664c1c7b
cmp byte [esi + ebx - 1], 0xa
je 0x664c1c4f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x664c70a4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x401450
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
push ebx
push esi
push edi
push 0
push 0
push 3
push 0
push 0
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40155a
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x401553
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x401553
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x40154c
lea ecx, [esp + 0x10]
push 0
push ecx
push ebx
push eax
push edi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401545
lea edx, [esp + 0x18]
mov dword [esp + 0x18], 0
push edx
push 1
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jl 0x401545
mov eax, dword [esp + 0x18]
test eax, eax
je 0x401545
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
push ecx
push 0x6420c8
push 0
push ebx
push eax
call dword [sym.imp.OLEPRO32.DLL_OleLoadPicture]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jl 0x40155a
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40155a
mov eax, dword [esp + 0x18]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
add esp, 8
ret 4
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret 4
Function at 0x4043a0
Capabilities:
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x61611b
push eax
mov dword fs:[0], esp
sub esp, 0x210
lea eax, [esp + 0x10c]
push ebx
push ebp
push esi
push edi
push eax
mov esi, ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
xor edi, edi
cmp eax, edi
jne 0x4043ed
lea ecx, [esp + 0x11c]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, dword [esi + 0xc]
lea edx, [esp + 0x10]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, eax
call fcn.0048f1c0
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x18]
push ecx
push edx
push 0x104
push eax
mov dword [esp + 0x238], edi
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
cmp eax, edi
jne 0x40443f
mov ebx, dword [esp + 0x230]
lea ecx, [esp + 0x10]
push ecx
mov ecx, ebx
call fcn.00489a30
jmp 0x404461
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x230]
lea eax, [esp + 0x11c]
push edx
push eax
push str._s_s
push ebx
call fcn.0048a580
add esp, 0x10
push 0x68f46c
mov ecx, ebx
call fcn.0048a7d0
cmp eax, edi
jle 0x40447a
push edi
push eax
mov ecx, ebx
call fcn.0048aae0
mov edi, dword [ebx]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x68f464
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x18]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, ebx
call fcn.00489a10
lea ecx, [esp + 0x10]
mov dword [esp + 0x228], 0xffffffff
call fcn.00489810
mov ecx, dword [esp + 0x220]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x21c
ret 4
Function at 0x404510
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x61614f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x6925a8]
push ebp
push esi
xor esi, esi
push edi
mov dword [esp + 0x18], esi
mov dword [esp + 0xc], eax
mov ebp, dword [esp + 0x30]
mov edi, 1
mov dword [esp + 0x24], edi
mov ecx, dword [ebp]
mov eax, dword [ecx - 8]
cmp eax, esi
mov dword [esp + 0x10], eax
jle 0x40465a
push ebx
mov ebx, 2
mov edx, dword [ebp]
cmp byte [edx + esi], 0x25
je 0x404587
mov eax, esi
inc esi
inc edi
lea ecx, [esp + 0x10]
mov dl, byte [edx + eax]
inc ebx
mov byte [esp + 0x18], dl
mov eax, dword [esp + 0x18]
push eax
call fcn.005eb44d
jmp 0x40464f
xor al, al
xor cl, cl
cmp edi, dword [esp + 0x14]
jge 0x404595
mov al, byte [edx + esi + 1]
cmp ebx, dword [esp + 0x14]
jge 0x40459f
mov cl, byte [edx + esi + 2]
cmp al, 0x61
jl 0x4045a9
cmp al, 0x7a
jg 0x4045a9
add al, 0xe0
cmp cl, 0x61
jl 0x4045b6
cmp cl, 0x7a
jg 0x4045b6
add cl, 0xe0
cmp al, 0x30
jl 0x4045be
cmp al, 0x39
jle 0x4045c6
cmp al, 0x41
jl 0x404641
cmp al, 0x5a
jg 0x404641
cmp al, 0x30
jl 0x4045d2
cmp al, 0x39
jg 0x4045d2
sub al, 0x30
jmp 0x4045d4
sub al, 0x37
cmp cl, 0x30
mov byte [esp + 0x34], al
jl 0x4045e2
cmp cl, 0x39
jle 0x4045ec
cmp cl, 0x41
jl 0x404628
cmp cl, 0x5a
jg 0x404628
shl al, 4
cmp cl, 0x30
mov dl, al
jl 0x404603
cmp cl, 0x39
jg 0x404603
movsx eax, cl
sub eax, 0x30
jmp 0x404609
movsx eax, cl
sub eax, 0x37
add dl, al
mov byte [esp + 0x34], dl
mov ecx, dword [esp + 0x34]
push ecx
lea ecx, [esp + 0x14]
call fcn.005eb44d
add esi, 3
add edi, 3
add ebx, 3
jmp 0x40464f
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x10]
push edx
call fcn.005eb44d
add esi, 2
add edi, 2
add ebx, 2
jmp 0x40464f
push 0x25
lea ecx, [esp + 0x14]
call fcn.005eb44d
inc esi
inc edi
inc ebx
cmp esi, dword [esp + 0x14]
jl 0x40455f
pop ebx
mov esi, dword [esp + 0x2c]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.005eadbf
mov dword [esp + 0x18], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 0
call fcn.005eb04a
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x1c
ret 8
Function at 0x40a990
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
mov ebx, ecx
push eax
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, ebx
call fcn.00409690
mov ecx, dword [ebx + 0x98]
mov eax, dword [eax]
test ecx, ecx
mov dword [esp + 0xc], eax
jne 0x40a9c9
push eax
mov ecx, ebx
call fcn.00409730
test eax, eax
jne 0x40aade
mov eax, dword [0x6e8930]
push esi
mov esi, dword [sym.imp.USER32.dll_SetCursor]
push edi
mov edi, dword [sym.imp.USER32.dll_LoadCursorA]
cmp eax, 4
jne 0x40aa03
mov dword [0x6e8930], 3
call fcn.00606265
call fcn.00606265
mov eax, dword [eax + 0xc]
push 0x84
push eax
call edi
push eax
call esi
mov eax, dword [0x6e8948]
cmp eax, 3
jne 0x40aa65
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
xor ecx, ecx
mov cl, ah
test cl, cl
je 0x40aa52
mov dword [0x6e8930], 2
call fcn.00606265
call fcn.00606265
mov eax, dword [eax + 0xc]
push 0x87
push eax
call edi
push eax
call esi
mov eax, dword [0x6e8930]
cmp eax, 1
jne 0x40aaa4
mov ecx, ebx
call fcn.00406e20
jmp 0x40aab0
mov ecx, ebx
mov dword [0x6e8930], 1
call fcn.00406e20
jmp 0x40aab0
cmp eax, 4
jne 0x40aa3f
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
xor edx, edx
mov dl, ah
test dl, dl
je 0x40aa98
mov dword [0x6e8930], 1
call fcn.00606265
call fcn.00606265
mov eax, dword [eax + 0xc]
push 0x86
jmp 0x40aa39
mov dword [0x6e8930], 2
jmp 0x40aaa9
cmp eax, 2
jne 0x40aab0
mov ecx, ebx
call fcn.00406e70
mov eax, dword [esp + 0x14]
xor ecx, ecx
pop edi
cmp eax, ecx
mov dword [ebx + 0x98], ecx
pop esi
je 0x40aad8
push eax
mov ecx, ebx
mov dword [ebx + 0x94], 1
call fcn.00409560
pop ebx
ret 0xc
mov dword [ebx + 0x94], ecx
pop ebx
ret 0xc
Function at 0x40cdc0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x616848
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, dword [esp + 0x28]
push edi
mov edi, ecx
push esi
call fcn.0040cd40
test eax, eax
je 0x40cece
push ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], vtable.CRgn.0
mov eax, dword [esi + 0xc]
mov ebx, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi]
sub eax, ebx
sub ecx, edx
push eax
push ecx
push 0
push 0
mov dword [esp + 0x34], 0
call dword [sym.imp.GDI32.dll_CreateRectRgn]
push eax
lea ecx, [esp + 0x10]
call fcn.005f0005
lea eax, [esp + 0xc]
mov ecx, edi
push eax
call fcn.005efa1d
mov ecx, dword [esi + 4]
mov edx, dword [esi]
mov eax, dword [edi + 4]
mov ebx, dword [sym.imp.GDI32.dll_SetViewportOrgEx]
neg ecx
push 0
push ecx
neg edx
push edx
push eax
call ebx
mov ecx, dword [esp + 0x34]
mov eax, dword [edi + 4]
push eax
mov edx, dword [ecx]
call dword [edx + 0xe0]
mov ecx, dword [edi + 4]
push 0
push 0
push 0
push ecx
call ebx
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push 0xcc0020
mov ecx, dword [esi]
push 0
push 0
push edx
mov edx, dword [esi + 0xc]
sub edx, eax
push edx
mov edx, dword [esi + 8]
sub edx, ecx
push edx
push eax
mov eax, dword [esp + 0x48]
push ecx
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
lea ecx, [esp + 0xc]
call fcn.005f005c
mov dword [esp + 0xc], vtable.CGdiObject.0
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 1
call fcn.005f005c
pop ebx
pop edi
pop esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
lea ecx, [esp + 8]
call fcn.005ef418
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x20], 2
push ecx
lea ecx, [esp + 0xc]
call fcn.005ef4cf
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0xc]
push eax
mov edx, dword [ecx]
call dword [edx + 0xe0]
lea ecx, [esp + 8]
call fcn.005ef506
lea ecx, [esp + 8]
mov dword [esp + 0x20], 0xffffffff
call fcn.005ef54d
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc

Function at 0x40dbc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x61696b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea edi, [esi + 0x14]
mov dword [esi], 0x633450
mov ecx, edi
call fcn.005e5e99
mov dword [edi], method.CPtrArray.virtual_0
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
xor ebx, ebx
mov dword [esi + 0x10], ecx
push 0xffffffffffffffff
push ebx
mov ecx, edi
mov dword [esp + 0x20], ebx
mov dword [esi], 0x6333b4
mov dword [esi + 4], eax
call fcn.005e6638
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov edx, dword [0x6e8930]
push esi
mov dword [esi + 0x3c], edx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
call fcn.0053c500
mov ecx, eax
call fcn.0053c5c0
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x40dbd7
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x61696b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
lea edi, [esi + 0x14]
mov dword [esi], 0x633450
mov ecx, edi
call fcn.005e5e99
mov dword [edi], method.CPtrArray.virtual_0
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
xor ebx, ebx
mov dword [esi + 0x10], ecx
push 0xffffffffffffffff
push ebx
mov ecx, edi
mov dword [esp + 0x20], ebx
mov dword [esi], 0x6333b4
mov dword [esi + 4], eax
call fcn.005e6638
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov edx, dword [0x6e8930]
push esi
mov dword [esi + 0x3c], edx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
call fcn.0053c500
mov ecx, eax
call fcn.0053c5c0
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x410b10
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x3c
test eax, eax
push ebx
push ebp
push esi
push edi
mov ebx, ecx
jne 0x410b2e
mov ecx, dword [0x6e88bc]
mov eax, 0xe8cd
sub eax, ecx
mov ecx, dword [esp + 0x58]
mov dword [ebx + 0xbc], eax
test ecx, ecx
mov ebp, 0x40002810
je 0x410b46
mov ebp, 0x50002810
push eax
xor ecx, ecx
sub esp, 0x10
xor edx, edx
mov eax, esp
xor esi, esi
push ebp
push 0x8800
mov dword [eax], ecx
mov ecx, dword [esp + 0x6c]
xor edi, edi
push ecx
mov dword [eax + 4], edx
mov ecx, ebx
mov dword [eax + 8], esi
mov dword [eax + 0xc], edi
call fcn.006067c9
test eax, eax
jne 0x410b7f
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 0xc
mov edx, dword [ebx + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x31
push edx
call ebp
push eax
call fcn.005efff0
mov edx, dword [eax + 4]
lea ecx, [esp + 0x10]
push ecx
push 0x3c
push edx
call dword [sym.imp.GDI32.dll_GetObjectA]
mov edi, str.Tahoma
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x2c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x10], 0xd
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [ebx + 0xa8]
mov ecx, esi
call fcn.005f005c
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push eax
mov ecx, esi
call fcn.005f0005
test esi, esi
je 0x410bfd
mov esi, dword [esi + 4]
mov edx, dword [ebx + 0x1c]
push 1
push esi
push 0x30
push edx
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x3c
ret 0xc