joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442583
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
call fcn.00413010
cmp eax, 3
jge 0x442597
xor al, al
leave
ret
push 0x38
lea eax, [ebp - 0x38]
push 0
push eax
mov dword [ebp - 0x3c], 0x3c
call fcn.0046e0e0
mov eax, dword [ebp + 8]
and dword [ebp - 0x20], 0
mov dword [ebp - 0x2c], eax
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x38], 0x400
mov dword [ebp - 0x30], str.taskbarunpin
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
dec eax
neg eax
sbb al, al
inc al
leave
ret

Function at 0x4425d9
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
call fcn.00413010
cmp eax, 4
jge 0x4425ed
xor al, al
leave
ret
push 0x38
lea eax, [ebp - 0x38]
push 0
push eax
mov dword [ebp - 0x3c], 0x3c
call fcn.0046e0e0
mov eax, dword [ebp + 8]
and dword [ebp - 0x20], 0
mov dword [ebp - 0x2c], eax
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x38], 0x400
mov dword [ebp - 0x30], str.taskbarunpin
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
dec eax
neg eax
sbb al, al
inc al
leave
ret

Function at 0x442e60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4a02f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
xor eax, eax
xor ecx, ecx
cmp byte [ebp + 8], al
push eax
sete cl
push eax
dec ecx
and ecx, 9
add ecx, 0x10
push ecx
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x442ea1
xor al, al
jmp 0x442eb1
lea eax, [ebp - 0x20c]
push eax
mov ecx, esi
call fcn.00401fb0
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0046e0cd
leave
ret

Function at 0x442ebe
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4a02f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.0046e0e0
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x442f2a
lea eax, [ebp - 0x20c]
push eax
mov ecx, esi
call fcn.00401fb0
push str.MicrosoftInternet_ExplorerQuick_LaunchUser_PinnedTaskBar
mov ecx, esi
call fcn.00406d00
mov al, 1
jmp 0x442f2c
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0046e0cd
leave
ret
Function at 0x442f39
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x4a02f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 0xc]
cmp byte [ebp + 8], bl
je 0x443042
push str.Userenv.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.GetDefaultUserProfileDirectoryW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x264], 0x104
cmp eax, ebx
je 0x44303e
lea ecx, [ebp - 0x264]
push ecx
lea ecx, [ebp - 0x20c]
push ecx
call eax
cmp eax, 1
jne 0x44303e
lea eax, [ebp - 0x20c]
push eax
mov ecx, esi
call fcn.00401fb0
call fcn.00413010
cmp eax, 3
jl 0x442ff6
xor eax, eax
push str.AppDataRoaming
lea ecx, [ebp - 0x244]
mov dword [ebp - 0x230], 7
mov dword [ebp - 0x234], ebx
mov word [ebp - 0x244], ax
call fcn.00401fb0
lea eax, [ebp - 0x244]
push eax
push esi
call fcn.0040e190
pop ecx
pop ecx
lea ecx, [ebp - 0x244]
jmp 0x443034
xor eax, eax
push str.Application_Data
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x214], 7
mov dword [ebp - 0x218], ebx
mov word [ebp - 0x228], ax
call fcn.00401fb0
lea eax, [ebp - 0x228]
push eax
push esi
call fcn.0040e190
pop ecx
pop ecx
lea ecx, [ebp - 0x228]
push ebx
push 1
call fcn.00402b70
jmp 0x443066
xor al, al
jmp 0x443096
lea eax, [ebp - 0x20c]
push eax
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x44303e
lea eax, [ebp - 0x20c]
push eax
mov ecx, esi
call fcn.00401fb0
push dword [0x4a01cc]
lea ecx, [ebp - 0x260]
call fcn.00406cb0
lea eax, [ebp - 0x260]
push eax
push esi
call fcn.0040e190
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x260]
call fcn.00402b70
mov al, 1
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0046e0cd
leave
ret
Function at 0x4433cc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x4a02f0]
xor eax, ebp
mov dword [ebp - 4], eax
push str.DeleteOldMenuItem
call fcn.0045979e
pop ecx
call fcn.00442a49
cmp al, 1
jne 0x4435b0
push esi
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
xor esi, esi
lea eax, [ebp - 0x20a]
push esi
push eax
call fcn.0046e0e0
xor eax, eax
add esp, 0xc
mov dword [ebp - 0x214], 7
mov dword [ebp - 0x218], esi
mov word [ebp - 0x228], ax
call fcn.00413010
cmp eax, 3
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
jle 0x4434d6
push 0x1a
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4435a1
lea eax, [ebp - 0x20c]
push eax
call fcn.0045979e
pop ecx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x228]
call fcn.00401fb0
push str.MicrosoftWindowsStart_MenuPrograms360
lea ecx, [ebp - 0x228]
call fcn.00406d00
push 1
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x244]
call fcn.00401f50
push eax
call fcn.00404360
pop ecx
pop ecx
lea ecx, [ebp - 0x244]
call fcn.00401f80
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x228]
call fcn.00401fb0
push str.MicrosoftWindowsStart_Menu360
lea ecx, [ebp - 0x228]
call fcn.00406d00
jmp 0x44357b
push 0xb
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4435a1
lea eax, [ebp - 0x20c]
push eax
call fcn.0045979e
pop ecx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x228]
call fcn.00401fb0
push 0x4947e4
lea ecx, [ebp - 0x228]
call fcn.00406d00
push 1
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x244]
call fcn.00401f50
push eax
call fcn.00404360
pop ecx
pop ecx
lea ecx, [ebp - 0x244]
call fcn.00401f80
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x228]
call fcn.00401fb0
push 0x4947c4
lea ecx, [ebp - 0x228]
call fcn.00406d00
cmp dword [ebp - 0x214], 8
mov eax, dword [ebp - 0x228]
jae 0x443574
lea eax, [ebp - 0x228]
push eax
call fcn.0045979e
pop ecx
push esi
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x244]
call fcn.00401f50
push eax
call fcn.00404360
pop ecx
pop ecx
lea ecx, [ebp - 0x244]
call fcn.00401f80
push esi
push 1
lea ecx, [ebp - 0x228]
call fcn.00402b70
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046e0cd
leave
ret
Function at 0x4440aa
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x280
mov eax, dword [0x4a02f0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x204]
push eax
mov dword [ebp - 0x278], pe_nt_image_headers32
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x4440ea
xor al, al
jmp 0x4441ef
push ebx
push esi
push 0x49b460
mov ecx, edi
call fcn.00401fb0
lea eax, [ebp - 0x204]
push eax
mov ecx, edi
call fcn.00406d00
push dword [0x4a0180]
lea ecx, [ebp - 0x220]
call fcn.00406cb0
call fcn.00448048
mov edx, dword [eax]
lea ecx, [ebp - 0x274]
push ecx
mov ecx, eax
call dword [edx + 0xc]
push 0x49b76c
xor esi, esi
push esi
mov ecx, eax
call fcn.00409610
push eax
lea ecx, [ebp - 0x258]
call fcn.004038f0
push 0xffffffffffffffff
push esi
push edi
lea ecx, [ebp - 0x258]
call fcn.00402600
push eax
lea ecx, [ebp - 0x23c]
call fcn.004038f0
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x220]
call fcn.00402600
xor edi, edi
push esi
inc edi
push edi
lea ecx, [ebp - 0x23c]
call fcn.00402b70
push esi
push edi
lea ecx, [ebp - 0x258]
call fcn.00402b70
push esi
push edi
lea ecx, [ebp - 0x274]
call fcn.00402b70
cmp dword [ebp - 0x20c], 8
mov eax, dword [ebp - 0x220]
jae 0x4441b4
lea eax, [ebp - 0x220]
push 0x20019
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x280]
call fcn.0040bec0
cmp dword [ebp - 0x280], esi
lea ecx, [ebp - 0x280]
setne bl
call fcn.0040bf10
push esi
push edi
lea ecx, [ebp - 0x220]
call fcn.00402b70
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0046e0cd
leave
ret
Function at 0x44adf8
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x4a02f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 8
xor edx, edx
pop ecx
xor eax, eax
mov dword [ebp - 0x44], edx
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x44]
push eax
push edx
push esi
mov dword [ebp - 0x64], edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
jne 0x44ae8b
call fcn.0040ab90
xor edi, edi
inc edi
cmp eax, edi
jg 0x44ae73
mov dword [ebp - 0x64], edi
call sub.KERNEL32.dll_GetLastError
push eax
push edi
push 0x3c
push str.installer_tdsetuputildelete_after_reboot_helper.cc
lea ecx, [ebp - 0x11c]
call fcn.0040b4f0
push str._does_not_exist.
add eax, 0x10
push esi
push eax
call fcn.0040b670
pop ecx
pop ecx
push eax
call fcn.00403540
pop ecx
pop ecx
test byte [ebp - 0x64], 1
je 0x44ae84
lea ecx, [ebp - 0x11c]
call fcn.0040b560
xor al, al
jmp 0x44af97
push ebx
push 4
pop edi
push esi
lea ecx, [ebp - 0x20]
call fcn.00406cb0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.00401c80
push eax
call fcn.00404ed0
mov bl, al
add esp, 0xc
neg bl
lea ecx, [ebp - 0x60]
sbb bl, bl
call fcn.00401f80
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.00402b70
inc bl
je 0x44aecf
push 5
pop edi
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x44af3f
call fcn.0040ab90
push 2
pop ebx
cmp eax, ebx
jg 0x44af2b
mov dword [ebp - 0x64], ebx
call sub.KERNEL32.dll_GetLastError
push eax
push ebx
push 0x47
push str.installer_tdsetuputildelete_after_reboot_helper.cc
lea ecx, [ebp - 0x11c]
call fcn.0040b4f0
push str._for_deletion.
push esi
add eax, 0x10
push str.Could_not_schedule
push eax
call fcn.00403540
pop ecx
pop ecx
push eax
call fcn.0040b670
pop ecx
pop ecx
push eax
call fcn.00403540
pop ecx
pop ecx
test byte [ebp - 0x64], bl
je 0x44af3b
lea ecx, [ebp - 0x11c]
call fcn.0040b560
xor al, al
jmp 0x44af96
push 0x35
mov edi, str.installer_tdsetuputildelete_after_reboot_helper.cc
push edi
call fcn.0040aba0
pop ecx
pop ecx
cmp eax, 1
jl 0x44af83
push 0xffffffffffffffff
push 0x5a
push edi
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x64], 4
call fcn.0040add0
push esi
add eax, 8
push str.Scheduled_for_deletion:
push eax
call fcn.00403540
pop ecx
pop ecx
push eax
call fcn.0040b670
pop ecx
pop ecx
test byte [ebp - 0x64], 4
je 0x44af94
lea ecx, [ebp - 0x114]
call fcn.0040ae20
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0046e0cd
leave
ret
Function at 0x44b6cb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov ecx, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
push eax
push edx
lea eax, [ebp - 0xc]
push eax
call fcn.0044b3ba
push 1
push str.SYSTEMCurrentControlSetControlSession_Manager
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x14]
call fcn.0043cae3
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
cmp eax, ebx
jne 0x44b718
lea ecx, [ebp - 0x14]
call fcn.0043ca36
mov eax, 0x80070002
pop ebx
leave
ret
push esi
push edi
push 1
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
call fcn.00417910
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x24]
lea eax, [ebp - 8]
push eax
push ebx
mov edi, str.PendingFileRenameOperations
push edi
push dword [ebp - 0xc]
call esi
cmp eax, 2
jne 0x44b76d
mov esi, 0x80070002
lea ecx, [ebp - 0x24]
call fcn.0041b130
lea ecx, [ebp - 0x14]
call fcn.0043ca36
pop edi
mov eax, esi
pop esi
jmp 0x44b715
cmp eax, 0xea
jne 0x44b7b6
cmp dword [ebp - 8], 7
je 0x44b78f
mov esi, 0x8000ffff
jmp 0x44b757
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x44b757
test byte [ebp - 4], 1
jne 0x44b77a
push dword [ebp - 4]
lea ecx, [ebp - 0x24]
call fcn.00417910
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x24]
lea eax, [ebp - 8]
push eax
push ebx
push edi
push dword [ebp - 0xc]
call esi
cmp eax, ebx
je 0x44b7bc
cmp eax, ebx
jg 0x44b781
jmp 0x44b78b
mov eax, dword [ebp - 0x20]
push dword [ebp + 8]
sub eax, dword [ebp - 0x24]
push eax
push dword [ebp - 0x24]
call fcn.0044b5f3
add esp, 0xc
jmp 0x44b78b

Function at 0x44baf0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
push 1
push 0
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x44bb4f
push dword [ebp + 8]
mov byte [esi], 1
push 0
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
test edi, edi
je 0x44bb5a
push edi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x44bb3f
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
call dword [sym.imp.USER32.dll_BringWindowToTop]
jmp 0x44bb5a
push 0x495c8c
call fcn.0045979e
pop ecx
pop edi
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x44c87a
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x4a02f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x20c], esi
call fcn.0044c2d7
mov ebx, eax
cmp ebx, esi
je 0x44c8eb
lea ecx, [ebp - 0x214]
call fcn.0044c254
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046e0cd
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x44c909
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x214]
call fcn.0044c87a
cmp eax, esi
jne 0x44c950
lea eax, [ebp - 0x220]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x208], pe_nt_image_headers32
call ebx
test eax, eax
je 0x44c8f3
lea ecx, [ebp - 0x214]
call fcn.0044c254
push dword [ebp - 0x218]
mov ecx, edi
call fcn.0044c1e4
lea ecx, [ebp - 0x214]
mov esi, eax
call fcn.0044c254
mov eax, esi
jmp 0x44c8da
Function at 0x44dfbf
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4a02f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
push 2
push ebx
push eax
mov dword [ebp - 0x410], ecx
mov dword [ebp - 0x414], ebx
mov dword [ebp - 0x408], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x40c], eax
cmp eax, ebx
jne 0x44e012
call fcn.0044bff5
mov esi, eax
jmp 0x44e0b0
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebx
jne 0x44e028
call fcn.0044bff5
jmp 0x44e0a2
push esi
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
cmp edi, ebx
je 0x44e021
push esi
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x44e058
mov esi, 0x8007000e
jmp 0x44e0a4
push eax
lea ecx, [ebp - 0x408]
call fcn.0044ce83
cmp dword [ebp - 0x408], ebx
je 0x44e051
push esi
push dword [ebp - 0x408]
push esi
push edi
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, ebx
je 0x44e021
mov edx, dword [ebp - 0x408]
push dword [ebp + 0x14]
xor ecx, ecx
mov word [edx + eax*2], cx
push dword [ebp - 0x408]
lea ecx, [ebp - 0x414]
call fcn.0044da7d
mov esi, eax
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x404]
cmp dword [ebp - 0x408], eax
je 0x44e0c9
lea ecx, [ebp - 0x408]
call fcn.0044c828
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046e0cd
leave
ret 0x10
Function at 0x44f73e
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x860
mov eax, dword [0x4a02f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 4]
push edi
lea ecx, [ebp - 0x844]
push ecx
xor ebx, ebx
push eax
mov dword [ebp - 0x84c], ebx
mov dword [ebp - 0x848], eax
call dword [sym.imp.USER32.dll_BeginPaint]
mov dword [ebp - 0x84c], eax
xor eax, eax
push 0x7fe
mov word [ebp - 0x804], ax
lea eax, [ebp - 0x802]
push ebx
push eax
call fcn.0046e0e0
add esp, 0xc
push 0x400
lea eax, [ebp - 0x804]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 1
push dword [ebp - 0x84c]
call dword [sym.imp.GDI32.dll_SetBkMode]
push ebx
push ebx
push 0x31
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push dword [ebp - 0x84c]
call edi
push dword [esi + 0x24]
mov dword [ebp - 0x860], eax
push dword [ebp - 0x84c]
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0xfffffffffffffff0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test al, 1
je 0x44f7ff
inc ebx
jmp 0x44f806
test al, 2
je 0x44f806
push 2
pop ebx
lea eax, [ebp - 0x85c]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
push ebx
lea eax, [ebp - 0x85c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x84c]
call dword [sym.imp.USER32.dll_DrawTextW]
push dword [ebp - 0x860]
push dword [ebp - 0x84c]
call edi
lea eax, [ebp - 0x844]
push eax
push dword [ebp - 0x848]
call dword [sym.imp.USER32.dll_EndPaint]
mov ecx, dword [ebp - 4]
pop edi
xor eax, eax
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.0046e0cd
leave
ret 0x10
Function at 0x453677
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [ecx + 0x10]
call esi
call fcn.0044e54d
mov ecx, eax
call fcn.004522da
push 5
push dword [eax + 0x14]
call esi
xor eax, eax
inc eax
pop esi
ret 0x10

Function at 0x453727
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.004536b6
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x45374a
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret 4

Function at 0x453763
Capabilities:
Create process on windows
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
push edi
push 0x44
pop esi
push esi
xor edi, edi
lea eax, [ebp - 0x54]
push edi
push eax
call fcn.0046e0e0
add esp, 0xc
push 5
mov dword [ebp - 0x54], esi
pop eax
xor esi, esi
mov dword [ebp - 0x28], 1
mov word [ebp - 0x24], ax
cmp dword [ebp + 0xc], edi
je 0x453799
push 4
pop esi
call fcn.00453550
test al, al
je 0x4537a8
or esi, 0x1000000
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x4537b3
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x54]
push ecx
push edi
push edi
push esi
push edi
push edi
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4537d1
xor al, al
jmp 0x45380d
cmp dword [ebp + 0xc], edi
je 0x4537fb
push dword [ebp - 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
jne 0x4537f2
push edi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x4537cd
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
mov al, 1
pop edi
pop esi
leave
ret

Function at 0x453a9c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4a02f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x210], esi
call dword [sym.imp.USER32.dll_GetDC]
push edi
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push eax
mov dword [ebp - 0x214], eax
call edi
mov dword [ebp - 0x218], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.0046e0e0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x20c]
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x453b18
sub eax, ecx
push ebx
sar eax, 1
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
push dword [ebp - 0x218]
push dword [ebp - 0x214]
call edi
lea ecx, [ebp - 0x214]
call fcn.00452a81
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046e0cd
leave
ret 0xc
Function at 0x453f69
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
mov ecx, 0x56aad8
call fcn.00453e0a
test ebx, ebx
je 0x453f91
lea ecx, [ebx + 0x2c]
mov dword [ebp - 4], ecx
jmp 0x453f95
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
push ecx
lea ecx, [eax + 4]
call fcn.00453a22
push 0x14
pop eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
push 0x54
pop eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
lea edi, [ebx + 0x98]
lea esi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor edi, edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call fcn.0045afd2
push dword [eax + 0x3c]
lea eax, [ebp - 0xc]
push eax
push dword [ebx + 0x38]
mov ecx, ebx
call fcn.00453a9c
mov eax, dword [ebp - 8]
mov esi, dword [sym.imp.USER32.dll_SetWindowPos]
push 4
shl eax, 2
push eax
mov eax, dword [ebp - 0xc]
add eax, 5
push eax
push 0x19
push 0x6c
push edi
push dword [ebx + 0x38]
call esi
call fcn.0045afd2
push dword [eax + 0x3c]
lea eax, [ebp - 0xc]
push eax
push dword [ebx + 0x64]
mov ecx, ebx
call fcn.00453a9c
mov eax, dword [ebp - 8]
push 4
add eax, 3
push eax
mov eax, dword [ebp - 0xc]
add eax, 5
push eax
push 0x8e
push 0x28
push edi
push dword [ebx + 0x64]
call esi
call fcn.0045afd2
push dword [eax + 0x3c]
lea eax, [ebp - 0xc]
push eax
push dword [ebx + 0x8c]
mov ecx, ebx
call fcn.00453a9c
mov edi, dword [ebp - 8]
call fcn.0045afd2
push dword [eax + 0x3c]
lea eax, [ebp - 0xc]
push eax
push dword [ebx + 0x90]
mov ecx, ebx
call fcn.00453a9c
add edi, 0xb
push 4
push edi
mov dword [ebp - 4], edi
push 0x8c
mov edi, 0x89
push edi
push 0xe3
push 0
push dword [ebx + 0x8c]
call esi
push 4
push dword [ebp - 4]
push 0x8c
push edi
push 0x17c
push 0
push dword [ebx + 0x90]
call esi
call fcn.0045afd2
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
xor edi, edi
inc edi
push edi
push dword [eax + 0x3c]
push 0x30
push dword [ebx + 0x8c]
call esi
call fcn.0045afd2
push edi
push dword [eax + 0x3c]
push 0x30
push dword [ebx + 0x90]
call esi
call fcn.0045afd2
push edi
push dword [eax + 0x3c]
push 0x30
push dword [ebx + 0x38]
call esi
call fcn.0045afd2
push edi
push dword [eax + 0x3c]
push 0x30
push dword [ebx + 0x64]
call esi
push 0
push dword [ebx + 0x64]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebx + 0x10]
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8