joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d240
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x42d25a
jmp 0x42d2bc
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [ebp + 0xc]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x42d2b6
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00450890
add esp, 0xc
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 8]
push eax
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x42d2d0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x42d2ed
jmp 0x42d39d
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x42d309
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x42d39d
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalSize]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0xc]
push edx
call fcn.0057284c
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov byte [ecx], 0x19
mov edx, dword [ebp - 0xc]
sub edx, 1
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 1
push ecx
call fcn.00450890
add esp, 0xc
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x154]
push eax
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x158]
call fcn.00416100
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00572875
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x439840
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov word [ebp - 0x18], 1
mov eax, dword [ebp - 4]
mov cx, word [eax + 4]
mov word [ebp - 0x16], cx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
xor edx, edx
mov dx, word [ecx + 4]
mov eax, dword [ebp - 4]
imul edx, dword [eax + 8]
mov ecx, dword [ebp - 4]
xor eax, eax
mov ax, word [ecx + 0xc]
imul edx, eax
shr edx, 3
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 4]
xor edx, edx
mov dx, word [ecx + 0xc]
mov eax, edx
mov ecx, dword [ebp - 4]
xor edx, edx
mov dx, word [ecx + 4]
imul eax, edx
cdq
and edx, 7
add eax, edx
sar eax, 3
mov word [ebp - 0xc], ax
mov eax, dword [ebp - 4]
mov cx, word [eax + 0xc]
mov word [ebp - 0xa], cx
mov word [ebp - 8], 0
push 1
push 0
push 0
lea edx, [ebp - 0x18]
push edx
push 0xffffffffffffffff
push 0
call dword [sym.imp.WINMM.dll_waveInOpen]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x14], 0
je 0x439906
mov eax, 1
test eax, eax
je 0x4398f2
mov dword [ebp - 0x1c], 0
jmp 0x439902
push str.CWaveIn::OpenDev:_waveInOpen_error._n
call fcn.0040b7b0
add esp, 4
mov dword [ebp - 0x1c], eax
xor eax, eax
jmp 0x439966
push 0x20000
mov ecx, dword [0x60764c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
push eax
lea ecx, [ebp - 0x18]
push ecx
push 0xffffffffffffffff
mov edx, dword [ebp - 4]
add edx, 0x10
push edx
call dword [sym.imp.WINMM.dll_waveInOpen]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x14], 0
je 0x439961
mov eax, 1
test eax, eax
je 0x43994d
mov dword [ebp - 0x20], 0
jmp 0x43995d
push str.CWaveIn::OpenDev:_waveInOpen_error._n
call fcn.0040b7b0
add esp, 4
mov dword [ebp - 0x20], eax
xor eax, eax
jmp 0x439966
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x439970
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 0x18
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x439560
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1c], 0
jne 0x4399cd
mov ecx, 1
test ecx, ecx
je 0x4399b9
mov dword [ebp - 8], 0
jmp 0x4399c9
push str.CWaveIn::StartThread:_Strat_wave_in_thread_fail._n
call fcn.0040b7b0
add esp, 4
mov dword [ebp - 8], eax
xor eax, eax
jmp 0x4399d2
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4399e0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x1c], 0
je 0x439a97
mov dword [ebp - 8], 0x32
mov dword [ebp - 0x10], 0
push 0
push 0
push 0x12
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.USER32.dll_PostThreadMessageA]
cmp dword [ebp - 8], 0
je 0x439a56
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 0xc], 0x103
je 0x439a43
mov dword [ebp - 0x10], 1
jmp 0x439a56
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x439a1a
cmp dword [ebp - 0x10], 0
jne 0x439a8d
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, 1
test eax, eax
je 0x439a7d
mov dword [ebp - 0x14], 0
jmp 0x439a8d
push str.CWaveIn::StopThread:_TerminateThread_wave_in_thread._n
call fcn.0040b7b0
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x1c], 0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x439b90
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.WINMM.dll_waveInReset]
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x14], 0
je 0x439be1
mov ecx, 1
test ecx, ecx
je 0x439bca
mov dword [ebp - 0x14], 0
jmp 0x439bda
push str.CWaveIn::PerPareBuffer:_waveInReset_error._n
call fcn.0040b7b0
add esp, 4
mov dword [ebp - 0x14], eax
xor eax, eax
jmp 0x439d17
push 0x140
call fcn.0057284c
add esp, 4
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov dword [edx + 0x20], eax
mov dword [ebp - 8], 0
jmp 0x439c0c
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0xa
jae 0x439d12
push 0x20
push 0
mov edx, dword [ebp - 8]
shl edx, 5
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x20]
add ecx, edx
push ecx
call fcn.00450460
add esp, 0xc
push 0x3c0
call fcn.0057284c
add esp, 4
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 8]
shl edx, 5
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x20]
mov eax, dword [ebp - 0x10]
mov dword [ecx + edx], eax
mov ecx, dword [ebp - 8]
shl ecx, 5
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x20]
mov dword [eax + ecx + 4], 0x3c0
push 0x20
mov ecx, dword [ebp - 8]
shl ecx, 5
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x20]
add eax, ecx
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x14], 0
je 0x439cba
mov eax, 1
test eax, eax
je 0x439ca6
mov dword [ebp - 0x18], 0
jmp 0x439cb6
push str.CWaveIn::PerPareBuffer:_waveInPrepareHeader_error._n
call fcn.0040b7b0
add esp, 4
mov dword [ebp - 0x18], eax
xor eax, eax
jmp 0x439d17
push 0x20
mov ecx, dword [ebp - 8]
shl ecx, 5
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x20]
add eax, ecx
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x14], 0
je 0x439d0d
mov eax, 1
test eax, eax
je 0x439cf9
mov dword [ebp - 0x1c], 0
jmp 0x439d09
push str.CWaveIn::PerPareBuffer:_waveInAddBuffer_error._n
call fcn.0040b7b0
add esp, 4
mov dword [ebp - 0x1c], eax
xor eax, eax
jmp 0x439d17
jmp 0x439c03
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x439e60
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
jne 0x439e9b
mov ecx, 1
test ecx, ecx
je 0x439e87
mov dword [ebp - 8], 0
jmp 0x439e97
push str.CWaveIn::CloseDev:_Device_hasnt_opened._n
call fcn.0040b7b0
add esp, 4
mov dword [ebp - 8], eax
xor eax, eax
jmp 0x439ee2
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.WINMM.dll_waveInStart]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x14], 0
je 0x439edd
mov eax, 1
test eax, eax
je 0x439ec9
mov dword [ebp - 0xc], 0
jmp 0x439ed9
push str.CWaveIn::OpenRecord:_waveInStart_error._n
call fcn.0040b7b0
add esp, 4
mov dword [ebp - 0xc], eax
xor eax, eax
jmp 0x439ee2
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x43a330
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x44], 0
je 0x43a36b
mov ecx, 1
test ecx, ecx
je 0x43a357
mov dword [ebp - 8], 0
jmp 0x43a367
push str.CWaveOut::StartThread:_Wave_out_thread_has_run._n
call fcn.0040b7b0
add esp, 4
mov dword [ebp - 8], eax
xor eax, eax
jmp 0x43a3cb
mov edx, dword [ebp - 4]
add edx, 0x1c
push edx
push 0
mov eax, dword [ebp - 4]
push eax
push 0x43a190
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x18], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x18], 0
jne 0x43a3bc
mov eax, 1
test eax, eax
je 0x43a3a8
mov dword [ebp - 0xc], 0
jmp 0x43a3b8
push str.CWaveOut::StartThread:_Strat_wave_out_thread_fail._n
call fcn.0040b7b0
add esp, 4
mov dword [ebp - 0xc], eax
xor eax, eax
jmp 0x43a3cb
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x44], 1
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43a3e0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x44], 0
jne 0x43a41e
mov ecx, 1
test ecx, ecx
je 0x43a407
mov dword [ebp - 0x14], 0
jmp 0x43a417
push str.CWaveOut::StopThread:_Wave_out_thread_hasnt_run._n
call fcn.0040b7b0
add esp, 4
mov dword [ebp - 0x14], eax
xor eax, eax
jmp 0x43a4d8
mov edx, dword [ebp - 4]
cmp dword [edx + 0x18], 0
je 0x43a4c9
mov dword [ebp - 8], 0x32
mov dword [ebp - 0x10], 0
push 0
push 0
push 0x12
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_PostThreadMessageA]
cmp dword [ebp - 8], 0
je 0x43a488
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 0xc], 0x103
je 0x43a475
mov dword [ebp - 0x10], 1
jmp 0x43a488
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 8]
sub edx, 1
mov dword [ebp - 8], edx
jmp 0x43a44c
cmp dword [ebp - 0x10], 0
jne 0x43a4bf
push 0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, 1
test edx, edx
je 0x43a4af
mov dword [ebp - 0x18], 0
jmp 0x43a4bf
push str.CWaveOut::StopThread:_TerminateThread_wave_out_thread._n
call fcn.0040b7b0
add esp, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x44], 0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43b2c0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0
cmp dword [ebp + 8], 0
jne 0x43b321
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowDC]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x24]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x20]
mov dword [ebp - 0x2c], edx
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x24]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x30]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x30]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x34]
sub ecx, dword [ebp - 0x38]
mov dword [ebp - 0x3c], ecx
xor edx, edx
sub edx, dword [ebp - 0x38]
mov dword [ebp - 0x28], edx
xor eax, eax
sub eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x30]
add ecx, dword [ebp - 0x38]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x3c]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x14], eax
push 0xcc0020
push 0
push 0
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edx, dword [ebp - 0xc]
push edx
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [ebp - 8]
push eax
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x43c3a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], 0x5ae104
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x44], 0
jne 0x43c3c6
jmp 0x43c500
mov byte [ebp - 0xc], 0x49
mov byte [ebp - 0xb], 0x43
mov byte [ebp - 0xa], 0x43
mov byte [ebp - 9], 0x6c
mov byte [ebp - 8], 0x6f
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0x65
mov byte [ebp - 5], 0
lea edx, [ebp - 0xc]
push edx
push 0x5ae0f8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x24], 0x49
mov byte [ebp - 0x23], 0x43
mov byte [ebp - 0x22], 0x43
mov byte [ebp - 0x21], 0x6f
mov byte [ebp - 0x20], 0x6d
mov byte [ebp - 0x1f], 0x70
mov byte [ebp - 0x1e], 0x72
mov byte [ebp - 0x1d], 0x65
mov byte [ebp - 0x1c], 0x73
mov byte [ebp - 0x1b], 0x73
mov byte [ebp - 0x1a], 0x6f
mov byte [ebp - 0x19], 0x72
mov byte [ebp - 0x18], 0x46
mov byte [ebp - 0x17], 0x72
mov byte [ebp - 0x16], 0x65
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x14], 0
lea eax, [ebp - 0x24]
push eax
push 0x5ae0f8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x40], 0x49
mov byte [ebp - 0x3f], 0x43
mov byte [ebp - 0x3e], 0x53
mov byte [ebp - 0x3d], 0x65
mov byte [ebp - 0x3c], 0x71
mov byte [ebp - 0x3b], 0x43
mov byte [ebp - 0x3a], 0x6f
mov byte [ebp - 0x39], 0x6d
mov byte [ebp - 0x38], 0x70
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x65
mov byte [ebp - 0x35], 0x73
mov byte [ebp - 0x34], 0x73
mov byte [ebp - 0x33], 0x46
mov byte [ebp - 0x32], 0x72
mov byte [ebp - 0x31], 0x61
mov byte [ebp - 0x30], 0x6d
mov byte [ebp - 0x2f], 0x65
mov byte [ebp - 0x2e], 0x45
mov byte [ebp - 0x2d], 0x6e
mov byte [ebp - 0x2c], 0x64
mov byte [ebp - 0x2b], 0
lea ecx, [ebp - 0x40]
push ecx
push 0x5ae0f8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x44], eax
push 0
push 0
push 0x400e
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x44]
push eax
call sub.MSVFW32.dll_ICSendMessage
mov ecx, dword [ebp - 4]
add ecx, 4
push ecx
call dword [ebp - 0x44]
mov edx, dword [ebp - 4]
add edx, 4
push edx
call dword [ebp - 0x28]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x44]
push ecx
call dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4465f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa4
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
lea edx, [eax + 0x50]
lea ecx, [eax + 8]
push edi
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0x3ff00000
mov dword [esp + 0x80], 0
mov dword [esp + 0x84], 0x3ff00000
xor eax, eax
fld qword [ecx]
fadd qword [edx]
add eax, 8
add ecx, 8
sub edx, 8
cmp eax, 0x20
fsub qword [esp + eax + 0x48]
fstp qword [esp + eax + 0x50]
fld qword [ecx - 8]
fsub qword [edx + 8]
fadd qword [esp + eax + 0x78]
fstp qword [esp + eax + 0x80]
jle 0x446632
mov eax, dword [0x5f1b48]
mov ecx, dword [0x5f1b4c]
mov dword [esp + 0x10], eax
lea edx, [esp + 0x50]
mov dword [esp + 0x14], ecx
push 5
mov eax, ecx
mov ecx, dword [esp + 0x14]
push edx
push eax
push ecx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x44], ebx
lea edi, [esp + 0x60]
call fcn.00446820
mov edx, dword [ebp + 0xc]
add esp, 0x10
mov dword [esp + 0x44], edx
mov esi, 0x5f1b48
cmp esi, 0x5f1cd8
jge 0x4467ed
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 8]
add esi, 8
fstp qword [esp + 0x28]
mov dword [esp + 0x38], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x3c], ecx
push 5
mov ecx, eax
push edi
push ecx
push edx
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
call fcn.00446820
fst qword [esp + 0x58]
fld qword [esp + 0x38]
fmul st(1)
add esp, 0x10
fcomp qword [0x5aeed0]
fnstsw ax
test ah, 0x41
je 0x4467db
fstp st(0)
sub esi, 8
mov ebx, 2
fld qword [esp + 0x38]
fadd qword [esp + 0x10]
push 5
push edi
fmul qword [0x5aeec8]
fstp qword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push eax
push ecx
call fcn.00446820
fld st(0)
fmul qword [esp + 0x58]
add esp, 0x10
fcomp qword [0x5aeed0]
fnstsw ax
test ah, 0x41
je 0x446754
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
fstp qword [esp + 0x28]
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], eax
jmp 0x446768
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
fstp qword [esp + 0x48]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
dec ebx
jne 0x446704
fld qword [esp + 0x38]
fsub qword [esp + 0x10]
mov eax, dword [esp + 0x44]
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x34]
add eax, 8
fmul qword [esp + 0x48]
fld qword [esp + 0x28]
fsub qword [esp + 0x48]
mov dword [esp + 0x44], eax
inc edi
mov dword [esp + 0x1c], edi
lea edi, [esp + 0x80]
fdivp st(1)
fsubr qword [esp + 0x10]
fst qword [esp + 0x28]
fld st(0)
fstp qword [eax - 8]
mov eax, 1
sub eax, ecx
mov dword [esp + 0x34], eax
jne 0x4467be
lea edi, [esp + 0x50]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
fstp qword [esp + 0x10]
push 5
push edi
push ecx
push edx
call fcn.00446820
mov ebx, dword [esp + 0x2c]
add esp, 0x10
cmp ebx, 0xa
jl 0x44669f
fstp st(0)
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 0xa
fstp st(0)
jge 0x446813
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
sub ecx, eax
mov edx, 0xa
mov esi, dword [ecx + eax]
mov dword [eax], esi
mov esi, dword [ecx + eax + 4]
mov dword [eax + 4], esi
add eax, 8
dec edx
jne 0x446801
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45ef50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x598199
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.00576b13
mov eax, dword [0x5f2384]
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [esi + 0x50], eax
mov ecx, dword [0x5f2384]
mov dword [esi + 0x54], ecx
mov dword [esi + 0x68], 0x5b4d88
mov dword [esi + 0x6c], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x70], edi
mov ecx, esi
mov byte [esp + 0x14], 3
mov dword [esi], 0x5b4d30
call fcn.00590b47
lea edx, [esi + 0x40]
or eax, 0xffffffff
push edx
mov dword [esi + 0x30], 1
mov dword [esi + 0x2c], 1
mov dword [esi + 0x38], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x28], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x3c], edi
call dword [sym.imp.USER32.dll_SetRectEmpty]
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x60], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x64], 1
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x461f50
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 0x14]
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x14]
push eax
lea ebx, [edi + 0x3c]
push ecx
mov ecx, ebx
call fcn.004607b0
mov edx, dword [esp + 0x18]
mov esi, eax
push edx
mov ecx, esi
call fcn.0045f150
mov ebp, dword [esp + 0x1c]
mov ecx, esi
push ebp
call fcn.004c0ba0
mov eax, dword [esp + 0x20]
mov ecx, dword [esi + 0x24]
cmp ecx, eax
je 0x461f9a
mov ecx, dword [esi + 0x5c]
mov dword [esi + 0x24], eax
mov eax, dword [ecx]
call dword [eax + 4]
test ebp, ebp
je 0x461fa7
push 0
push ebp
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x461fbf
mov eax, dword [edi + 0x40]
test eax, eax
jne 0x461fbf
push 0
mov ecx, ebx
call fcn.00460a20
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 0x14