joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414627
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.004146a6
jae 0x414633
xor ecx, ecx
call fcn.004146a6
jae 0x41465d
xor eax, eax
call fcn.004146a6
jae 0x41466e
mov al, 0x10
call fcn.004146a6
adc al, al
jae 0x41464f
jne 0x41469b
stosb byte es:[edi], al
jmp 0x414634
call fcn.004146b2
dec ecx
loop 0x41467a
mov eax, ebp
call fcn.004146b0
jmp 0x41469c
lodsb al, byte [esi]
shr eax, 1
je 0x4146c2
adc ecx, 2
mov ebp, eax
jmp 0x41469c
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.004146b0
cmp eax, 0x7d00
jae 0x41469a
cmp eax, 0x500
jae 0x41469b
cmp eax, 0x7f
ja 0x41469c
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x414634
pop ebp
ret 8
Function at 0x40c790
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x597644]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
mov esi, ecx
call dword [sym.imp.USER32.dll_GetDC]
push 0x118
mov ebx, eax
lea eax, [ebp - 0x11c]
push 0
push eax
call fcn.004dda00
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jb 0x40c7f9
push esi
push 0x40c560
push 0
push ebx
call dword [sym.imp.GDI32.dll_EnumFontFamiliesW]
jmp 0x40c802
mov eax, 0x100
or word [esi + 0xc], ax
movzx ecx, word [esi + 0xc]
movzx eax, cx
test ecx, 0x100
je 0x40c822
push 0x54f9f0
lea ecx, [esi + 8]
call fcn.0040c9b0
movzx eax, word [esi + 0xc]
movzx ecx, ax
test al, 0x10
je 0x40c83a
push str.Tahoma
lea ecx, [esi + 8]
call fcn.0040c9b0
movzx ecx, word [esi + 0xc]
test cl, 1
je 0x40c84c
push 0x54f9d4
lea ecx, [esi + 8]
call fcn.0040c9b0
push ebx
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push dword [esi + 8]
movsd xmm0, qword [ebp + 8]
mulsd xmm0, qword [0x54fa08]
push 0x20
push 0
push 0
push 0
push 0x86
push 0
push 0
push 0
push 0x190
cvttsd2si eax, xmm0
push 0
push 0
push 0
push eax
call dword [sym.imp.GDI32.dll_CreateFontW]
mov ecx, dword [ebp - 4]
pop edi
mov dword [esi + 4], eax
xor ecx, ebp
pop esi
pop ebx
call fcn.004982ff
mov esp, ebp
pop ebp
ret 8
Function at 0x40d640
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x535f0b
mov eax, dword fs:[0]
push eax
sub esp, 0x418
mov eax, dword [0x597644]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x1c], 0
mov eax, dword [ebp + 8]
je 0x40d683
mov eax, 1
jmp 0x40d83c
mov eax, dword [eax]
mov ecx, dword [eax - 0x10]
lea esi, [eax - 0x10]
mov dword [ebp - 0x424], eax
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi + 0xc], 0
mov ecx, eax
lea eax, [esi + 0xc]
jl 0x40d6aa
cmp ecx, dword [esi]
jne 0x40d6aa
lock inc dword [eax]
jmp 0x40d6dd
mov eax, dword [ecx]
lea edi, [esi + 4]
push 2
push dword [edi]
call dword [eax]
mov esi, eax
test esi, esi
je 0x40d85a
mov eax, dword [edi]
mov dword [esi + 4], eax
mov eax, dword [edi]
inc eax
add eax, eax
push eax
push dword [ebp - 0x424]
push eax
lea eax, [esi + 0x10]
push eax
call fcn.0040e3d0
add esp, 0x10
add esi, 0x10
mov dword [ebp - 0x424], esi
cmp dword [esi - 0xc], 0
mov dword [ebp - 4], 0
jne 0x40d79f
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.004dda00
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004dda00
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.005083ff
add esp, 0x18
lea eax, [ebp - 0x218]
push str.NetBridge.dll
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40d777
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x424]
call fcn.0040dcb0
mov esi, dword [ebp - 0x424]
push esi
call fcn.00475cd0
add esp, 4
test eax, eax
jne 0x40d7b0
xor edi, edi
jmp 0x40d81b
mov dword [ebx + 0x1c], 1
cmp dword [ebx], 0
jne 0x40d816
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebx], eax
test eax, eax
je 0x40d816
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.HttpInit
push eax
call edi
push str.HttpUninit
push dword [ebx]
mov dword [ebx + 4], eax
call edi
push str.zlib_uncompress
push dword [ebx]
mov dword [ebx + 8], eax
call edi
push str.zlib_compress
push dword [ebx]
mov dword [ebx + 0x10], eax
call edi
push str.zlib_compressBound
push dword [ebx]
mov dword [ebx + 0x14], eax
call edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
test eax, eax
je 0x40d816
call eax
mov dword [ebx + 0xc], eax
mov edi, 1
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40d83a
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004982ff
mov esp, ebp
pop ebp
ret 4
call fcn.0040b390
int3
Function at 0x40e2a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40e2f9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40e2f9
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x40e2ea
cmp esi, edx
jae 0x40e2f9
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x40e2d8
cmp esi, edx
jae 0x40e2f9
cmp word [esi], 0
je 0x40e2f9
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x40e900
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, word [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push dword [ebp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x40e958
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x40e958
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x40e958
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x40e961
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x40e983
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push ebx
push eax
call fcn.004dd480
add esp, 0xc
mov dword [ebp + 8], 0
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp + 8]
xor edi, edi
test eax, eax
je 0x40e9ab
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp + 8]
push eax
push 0
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x40e9f0
mov ebx, dword [ebp + 8]
push 0x10
call sub.gdiplus.dll_GdipAlloc
mov edi, eax
test edi, edi
je 0x40e9ee
lea eax, [ebp - 4]
mov dword [edi], vtable.Gdiplus::Bitmap.0
push eax
push ebx
mov dword [ebp - 4], 0
call sub.gdiplus.dll_GdipCreateBitmapFromStream
mov dword [edi + 8], eax
mov eax, dword [ebp - 4]
mov dword [edi + 4], eax
jmp 0x40e9f0
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x40ea04
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40ea10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x40ea3a
mov dword [edi + 0xc], 0
mov dword [edi + 8], 0
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [edi + 4], 0
push dword [ebp + 0xc]
movzx eax, word [ebp + 8]
push eax
push 0x400000
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x40eb57
push ebx
push esi
push 0x400000
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp + 8], ebx
test ebx, ebx
jne 0x40ea74
xor esi, esi
jmp 0x40eb56
push esi
push 0x400000
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40eb56
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x40eaae
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor esi, esi
jmp 0x40eb56
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x40eace
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor esi, esi
jmp 0x40eb56
push dword [ebp + 8]
push esi
push eax
call fcn.004dd480
add esp, 0xc
mov dword [ebp + 0xc], 0
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp + 0xc]
xor esi, esi
test eax, eax
je 0x40eaf8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp + 0xc]
push eax
push 0
push ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x40eb42
mov eax, dword [ebp + 0xc]
push 0x10
mov dword [ebp - 4], eax
call sub.gdiplus.dll_GdipAlloc
mov esi, eax
test esi, esi
je 0x40eb40
lea eax, [ebp + 8]
mov dword [esi], vtable.Gdiplus::Bitmap.0
push eax
push dword [ebp - 4]
mov dword [ebp + 8], 0
call sub.gdiplus.dll_GdipCreateBitmapFromStream
mov dword [esi + 8], eax
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
jmp 0x40eb42
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x40eb56
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop ebx
mov dword [edi + 4], esi
test esi, esi
jne 0x40eb68
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0
push eax
push dword [esi + 4]
call sub.gdiplus.dll_GdipGetImageWidth
test eax, eax
je 0x40eb82
mov dword [esi + 8], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [edi + 4]
mov dword [edi + 8], eax
lea eax, [ebp + 0xc]
push eax
mov dword [ebp + 0xc], 0
push dword [esi + 4]
call sub.gdiplus.dll_GdipGetImageHeight
test eax, eax
je 0x40eba5
mov dword [esi + 8], eax
mov eax, dword [ebp + 0xc]
mov ecx, edi
mov dword [edi + 0xc], eax
call fcn.0040e890
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x40f300
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x597644]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x800
lea eax, [ebp - 0x804]
mov ebx, ecx
push 0
push eax
call fcn.004dda00
add esp, 0xc
lea eax, [ebp - 0x804]
push 0x400
push eax
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push str.Q360ComputerZSetupMutext
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov dword [ebp - 0x808], esi
test esi, esi
je 0x40f43d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40f40c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x54fb48
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
mov esi, eax
test esi, esi
je 0x40f3f9
push str.ComputerZSetupDesktopTips
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
movzx eax, ax
test ax, ax
je 0x40f3cc
push eax
call dword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
push 0
push 0
push 0x8c88
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x40f43d
push esi
call dword [sym.imp.USER32.dll_IsIconic]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x40f3e2
push 9
push esi
call edi
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x40f3f2
push 5
push esi
call edi
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004982ff
mov esp, ebp
pop ebp
ret
lea edi, [ebx + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx + 8]
lea ecx, [ebx + 4]
cmp dword [ecx + 8], eax
je 0x40f429
mov dword [eax], esi
add dword [ecx + 4], 4
jmp 0x40f436
lea edx, [ebp - 0x808]
push edx
push eax
call fcn.0040edf0
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004982ff
mov esp, ebp
pop ebp
ret
Function at 0x40f4e0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1a3c
call fcn.00498310
mov eax, dword [0x597644]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push 0
push 2
mov dword [ebp - 0x1a34], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40f6f9
push edi
push 0x228
lea eax, [ebp - 0x1a2c]
push 0
push eax
call fcn.004dda00
add esp, 0xc
mov dword [ebp - 0x1a30], 0x22c
lea eax, [ebp - 0x1a30]
push eax
push ebx
call sub.KERNEL32.dll_Process32FirstW
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x40f6f5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x1a3c], eax
cmp eax, dword [ebp - 0x1a28]
je 0x40f6da
push dword [ebp - 0x1a34]
lea eax, [ebp - 0x1a0c]
push eax
call fcn.005085bf
add esp, 8
test eax, eax
jne 0x40f6da
push 0x800
push eax
lea eax, [ebp - 0x1804]
push eax
call fcn.004dda00
add esp, 0xc
push dword [ebp - 0x1a28]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x40f696
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.004dda00
add esp, 0xc
lea eax, [ebp - 0x804]
push 0x400
push eax
push 0
push edi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x40f68b
push 0x800
lea eax, [ebp - 0x1004]
push 0
push eax
call fcn.004dda00
lea eax, [ebp - 0x804]
push 0x7e
push eax
call fcn.004dea9e
add esp, 0x14
test eax, eax
je 0x40f653
push 0x400
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
dec eax
cmp eax, 0x3fe
ja 0x40f653
lea ecx, [ebp - 0x1004]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f640
lea eax, [ebp - 0x1004]
jmp 0x40f671
lea ecx, [ebp - 0x804]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f660
lea eax, [ebp - 0x804]
sub ecx, edx
sar ecx, 1
push ecx
push eax
lea eax, [ebp - 0x1804]
push 0x400
push eax
call fcn.005085b4
add esp, 0x10
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
jmp 0x40f69c
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x1804]
push eax
call fcn.00475cd0
add esp, 4
test eax, eax
je 0x40f6da
mov eax, dword [esi + 4]
mov ecx, dword [ebp - 0x1a28]
mov dword [ebp - 0x1a38], ecx
cmp dword [esi + 8], eax
je 0x40f6cb
mov dword [eax], ecx
add dword [esi + 4], 4
jmp 0x40f6da
lea ecx, [ebp - 0x1a38]
push ecx
push eax
mov ecx, esi
call fcn.0040ec90
lea eax, [ebp - 0x1a30]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
mov eax, dword [ebp - 0x1a3c]
jne 0x40f561
push ebx
call edi
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004982ff
mov esp, ebp
pop ebp
ret 8
Function at 0x4175a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5368d0
mov eax, dword fs:[0]
push eax
mov eax, dword [0x597644]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ecx + 0x30]
or eax, 0xffffffff
mov dword [ecx], vtable.CLayerControlBase.0
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4175e3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x417600
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5368f0
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x597644]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [esi + 0x30]
or eax, 0xffffffff
mov dword [esi], vtable.CLayerControlBase.0
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x417646
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test byte [ebp + 8], 1
je 0x417657
push 0x44
push esi
call fcn.00497eef
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x417a00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x536918
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x597644]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
add ebx, 0x30
mov eax, dword [ebx]
mov ecx, dword [eax - 0x10]
lea esi, [eax - 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi + 0xc], 0
mov ecx, eax
lea eax, [esi + 0xc]
jl 0x417a52
cmp ecx, dword [esi]
jne 0x417a52
lock inc dword [eax]
jmp 0x417a80
mov eax, dword [ecx]
lea edi, [esi + 4]
push 2
push dword [edi]
call dword [eax]
mov esi, eax
test esi, esi
je 0x417be0
mov eax, dword [edi]
mov dword [esi + 4], eax
mov eax, dword [edi]
inc eax
push eax
push dword [ebp - 0x10]
push eax
lea eax, [esi + 0x10]
push eax
call fcn.0040c4d0
add esp, 0x10
add esi, 0x10
mov dword [ebp - 0x18], esi
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], 0
test ecx, ecx
je 0x417b66
mov edi, ecx
lea edx, [edi + 2]
nop dword [eax]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x417aa0
sub edi, edx
sar edi, 1
je 0x417b66
mov edx, dword [ebx]
mov eax, dword [edx - 0xc]
mov dword [ebp - 0x14], eax
mov eax, ecx
sub eax, edx
sar eax, 1
mov dword [ebp - 0x10], eax
test edi, edi
js 0x417be5
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, edi
or eax, ecx
jge 0x417ae9
push edi
mov ecx, ebx
call fcn.0040c910
mov edx, dword [ebx]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
ja 0x417b3e
lea ecx, [edi + edi]
lea eax, [edx + eax*2]
mov dword [ebp + 0xc], eax
test ecx, ecx
je 0x417b4e
test eax, eax
jne 0x417b14
call fcn.004e928e
mov dword [eax], 0x16
call fcn.004e9168
jmp 0x417b4e
mov eax, dword [edx - 8]
add eax, eax
cmp eax, ecx
jae 0x417b2f
call fcn.004e928e
mov dword [eax], 0x22
call fcn.004e9168
jmp 0x417b4e
push ecx
push dword [ebp + 0xc]
push edx
call fcn.004de240
add esp, 0xc
jmp 0x417b4e
push edi
push dword [ebp + 0xc]
push dword [edx - 8]
push edx
call fcn.0040c4d0
add esp, 0x10
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x417be5
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [ebx]
mov word [eax + edi*2], cx
jmp 0x417b6d
mov ecx, ebx
call fcn.00417690
mov eax, dword [ebx]
test eax, eax
je 0x417bef
mov ecx, esi
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x417b9b
test dx, dx
je 0x417b97
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x417b9b
add ecx, 4
add eax, 4
test dx, dx
jne 0x417b75
xor eax, eax
jmp 0x417ba0
sbb eax, eax
or eax, 1
test eax, eax
je 0x417bad
mov ecx, dword [ebp + 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x417bcc
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.0040b390
push 0x80070057
call fcn.0040ada0
push 0x80004005
call fcn.0040ada0
int3
Function at 0x41bb60
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push 0
push dword [eax - 0x20]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
pop ebp
ret 4

Function at 0x41d0e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x536dee
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x597644]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.00411aa0
mov dword [ebp - 4], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
lea esi, [edi + 0x30]
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov ecx, esi
mov dword [edi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.0041f760
mov dword [esi], eax
mov eax, edi
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4208e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push esi
mov esi, ecx
je 0x42090a
mov eax, dword [esi + 0x48]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x420936
push 1
mov ecx, esi
call fcn.00420400
pop esi
pop ebp
ret 8
cmp dword [esi + 0x2c], 0
push edi
je 0x420916
mov edi, dword [esi + 0x34]
jmp 0x420919
mov edi, dword [esi + 0x30]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x420935
test edi, edi
je 0x420935
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
ret 8

Function at 0x420940
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push esi
mov esi, dword [ebp + 8]
je 0x420971
mov eax, dword [esi + 0x24]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x42099d
push 1
lea ecx, [esi - 0x24]
call fcn.00420400
mov eax, 1
pop esi
pop ebp
ret 0xc
cmp dword [esi + 8], 0
push edi
je 0x42097d
mov edi, dword [esi + 0x10]
jmp 0x420980
mov edi, dword [esi + 0xc]
push dword [esi - 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42099c
test edi, edi
je 0x42099c
push 0
push dword [esi - 0x20]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
mov eax, 1
pop esi
pop ebp
ret 0xc