joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412cef
Capabilities:
Delete file

Disassembly:
mov eax, 0x45c7f8
call fcn.0045c170
mov eax, 0x1214
call fcn.0045c140
and byte [ebp - 0x1220], 0
push esi
push edi
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x121f]
rep stosd dword es:[edi], eax
and byte [ebp - 0x220], 0
push 0x40
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x21f]
push 0xfff
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x1220]
mov esi, 0x103
push eax
lea eax, [ebp - 0x220]
push esi
push eax
push dword [ebp + 0xc]
and dword [ebp - 0x14], 0
push 0
push dword [ebp + 8]
call fcn.00438eb3
add esp, 0x1c
test al, al
je 0x412e59
push ebx
mov ebx, 0x40a168
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ebp - 0x1220]
push ecx
push ebx
push eax
call dword [sym.imp.MSVCRT.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x412e28
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ebp + ecx - 0x1220]
mov dword [ebp - 0x18], eax
mov eax, dword [0x40a0f8]
mov dword [ebp - 0x10], eax
and byte [ebp - 0x11c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x11b]
and dword [ebp - 4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40a190
lea eax, [ebp - 0x11c]
push esi
push eax
push dword [0x531f10]
call fcn.00425d30
add esp, 0x10
lea eax, [ebp - 0x11c]
lea ecx, [ebp - 0x10]
push eax
call fcn.00413e57
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x412e07
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push dword [ebp - 0x18]
lea ecx, [ebp - 0x10]
push eax
call fcn.00413ea4
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00411656
inc dword [ebp - 0x14]
lea eax, [ebp - 0x1220]
push 0xfff
push eax
lea eax, [ebp - 0x220]
push esi
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x14]
push dword [ebp + 8]
call fcn.00438eb3
add esp, 0x1c
test al, al
jne 0x412d70
pop ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00439463
pop ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
movzx eax, al
mov dword fs:[0], ecx
leave
ret
Function at 0x412e77
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x45c80c
call fcn.0045c170
sub esp, 0x904
push ebx
push esi
mov esi, 0x45e298
mov eax, esi
test eax, eax
je 0x412e9b
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, 0x45ebd0
push esi
push eax
mov ecx, ebx
call fcn.00413da2
cmp dword [ebp + 8], 0
je 0x413091
cmp dword [ebp + 0xc], 0
je 0x413091
and byte [ebp - 0x910], 0
push edi
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x90f]
push 0x7ff
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x910]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00438f87
mov esi, 0x40a168
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ebp - 0x910]
push ecx
push esi
push eax
call dword [sym.imp.MSVCRT.dll_strncmp]
add esp, 0x20
test eax, eax
jne 0x413027
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [0x40a0f8]
not ecx
dec ecx
mov dword [ebp + 0xc], eax
lea esi, [ebp + ecx - 0x910]
and byte [ebp - 0x110], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x10f]
and dword [ebp - 4], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40a190
lea eax, [ebp - 0x110]
push 0x103
push eax
push dword [0x531f10]
call fcn.00425d30
add esp, 0x10
lea eax, [ebp - 0x110]
lea ecx, [ebp + 0xc]
push eax
call fcn.00413e57
test esi, esi
jne 0x412f86
xor eax, eax
jmp 0x412f8d
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
push eax
lea ecx, [ebp + 0xc]
call fcn.00413ea4
push 0
push dword [ebp + 0xc]
call fcn.00425e07
pop ecx
test eax, eax
pop ecx
je 0x413019
push 0x40a240
push dword [ebp + 0xc]
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
pop ecx
test edi, edi
pop ecx
mov dword [ebp + 8], edi
je 0x413019
mov esi, dword [sym.imp.MSVCRT.dll_fseek]
push 2
push 0
push edi
call esi
push edi
call dword [sym.imp.MSVCRT.dll_ftell]
push 0
push 0
push dword [ebp + 8]
mov edi, eax
call esi
lea eax, [edi + 1]
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
push dword [ebp + 8]
mov esi, eax
push 1
push edi
push esi
call dword [sym.imp.MSVCRT.dll_fread]
and byte [esi + edi], 0
add esp, 0x30
mov ecx, ebx
push esi
call fcn.00413e57
push esi
call dword [sym.imp.MSVCRT.dll_free]
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00411656
jmp 0x413035
lea eax, [ebp - 0x910]
mov ecx, ebx
push eax
call fcn.00413e57
mov eax, dword [0x45ebd0]
mov eax, dword [eax - 8]
lea edi, [eax + 1]
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov esi, eax
mov ecx, edi
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
test esi, esi
pop edi
je 0x413091
push dword [0x45ebd0]
push esi
call fcn.00432ad0
push 1
push 9
push 0x40a19c
push eax
push esi
push esi
call fcn.0045ac60
add esp, 0x20
mov ecx, ebx
push esi
call fcn.00413e57
push esi
call fcn.0045c12b
pop ecx
mov ecx, dword [ebp - 0xc]
push 1
pop eax
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4130a2
Capabilities:
Hide graphical window

Disassembly:
push 0
push 0x41363d
push dword [esp + 0xc]
push 0x12d
push dword [0x531f10]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x414858
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
cmp dword [0x45ebd8], esi
jne 0x41489f
cmp dword [0x472cb8], esi
je 0x41489f
call fcn.00414b62
test eax, eax
je 0x41489f
call fcn.004275b6
test eax, eax
je 0x41489f
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push esi
push esi
push 0x414a4d
push esi
push esi
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [0x45ebd8], eax
pop esi
leave
ret

Function at 0x41574b
Capabilities:
Hide graphical window

Disassembly:
cmp dword [esp + 4], 0xffffffff
push esi
push edi
mov edi, ecx
jne 0x41575e
mov esi, dword [edi + 0x1fc08]
jmp 0x41576b
push dword [esp + 0xc]
mov ecx, edi
call fcn.0041555e
mov esi, eax
test esi, esi
je 0x4157fd
mov eax, dword [edi + 0x1fc08]
cmp eax, esi
je 0x4157b5
push ebx
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x415794
mov eax, dword [eax + 4]
test eax, eax
je 0x415794
push 0
push eax
call ebx
push 5
mov dword [edi + 0x1fc08], esi
push dword [esi + 4]
call ebx
push esi
mov ecx, 0x4947b0
call fcn.004593e2
lea ecx, [esi + 0x24]
call fcn.00418308
pop ebx
mov ecx, edi
call fcn.0041736d
mov ecx, edi
call fcn.00414f9e
mov eax, dword [edi + 0x1fc08]
mov ecx, 0x4947d8
push dword [eax + 0x10]
call fcn.0043829c
push 0
push 1
push 0x68
call fcn.0042487e
pop ecx
push eax
mov ecx, 0x495220
call fcn.004405d9
push esi
mov ecx, edi
call fcn.0041564d
push esi
mov ecx, edi
call fcn.00417c7f
pop edi
pop esi
ret 4

Function at 0x415ba2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
push ebx
push esi
mov dword [ebp - 4], ecx
push edi
xor ebx, ebx
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x80b]
mov byte [ebp - 0x80c], bl
mov esi, SysReAllocStringLen
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push esi
lea eax, [ebp - 0x80c]
push 0x800
push eax
push 0x40a3f4
push 0x40a3ec
mov dword [ebp - 0xc], 0x104
call fcn.00423f7c
add esp, 0x14
test eax, eax
je 0x415c0c
lea edi, [ebp - 0x80c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x415c44
lea eax, [ebp - 8]
push eax
push 0x40a3c0
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x415c44
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push ebx
push ebx
push 0x40a3b4
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edi, [ebp - 0x80c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x415c8c
cmp dword [0x470f14], ebx
je 0x415c77
mov ecx, dword [ebp - 4]
push 1
push ebx
lea eax, [ebp - 0x80c]
push dword [ebp + 8]
push 2
push eax
call fcn.00415920
jmp 0x415c87
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x80c]
push ebx
push eax
call fcn.00415a4c
push 1
pop eax
jmp 0x415c8e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x415f40
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x45c9a4
call fcn.0045c170
push ecx
push ecx
mov al, byte [ebp - 0xd]
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x14], esi
mov byte [esi + 4], al
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
lea ecx, [esi + 0x30]
mov dword [ebp - 4], edi
call fcn.0042bc79
lea ecx, [esi + 0x14c]
mov byte [ebp - 4], 1
call fcn.00421a21
mov ecx, esi
mov byte [ebp - 4], 2
mov dword [esi], 0x4018dc
mov dword [esi + 0x144], edi
mov dword [esi + 0x3c], edi
call fcn.00417188
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x417522
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 0x10], 0
push esi
push edi
lea eax, [ebp - 8]
mov edi, 0x40a564
push eax
mov esi, SysReAllocStringLen
push edi
push esi
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x417563
lea eax, [ebp - 8]
push eax
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x417563
xor eax, eax
jmp 0x4175df
lea eax, [ebp - 0xc]
xor edi, edi
push eax
lea eax, [ebp - 4]
push eax
push edi
mov esi, 0x40a550
push edi
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x417599
cmp dword [ebp - 4], 1
sete al
mov dword [ebp - 0x10], eax
xor eax, eax
cmp dword [ebp - 4], edi
sete al
mov dword [ebp - 4], eax
jmp 0x4175a0
mov dword [ebp - 4], 1
cmp dword [ebp + 8], edi
je 0x4175b0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4175dc
push dword [ebp - 0xc]
lea eax, [ebp - 4]
push eax
push 4
push edi
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00425c66
mov ecx, 0x4947f8
call fcn.0041bf54
mov eax, dword [ebp - 0x10]
pop edi
pop esi
leave
ret 4
Function at 0x4194ac
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1804
call fcn.0045c140
push esi
mov esi, ecx
mov eax, dword [esi + 0x1fc08]
mov eax, dword [eax + 0x10]
test eax, eax
je 0x419573
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
push eax
call dword [ecx + 0x78]
cmp dword [ebp - 4], 0
je 0x4194fd
lea eax, [ebp - 0x804]
push 0x800
push eax
push dword [ebp - 4]
call fcn.00424811
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp dword [ebp + 8], 0
je 0x419535
mov eax, dword [esi + 0x1fc08]
mov ecx, esi
push dword [eax + 0x10]
call fcn.00418dce
test eax, eax
jne 0x419573
push 0x10
push 0x40a2d4
push 0x9d
call fcn.0042487e
pop ecx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x419573
lea eax, [ebp - 0x804]
push eax
push 0x40a81c
lea eax, [ebp - 0x1804]
push 0x1000
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
mov eax, 0x45e298
push 5
push eax
push eax
lea eax, [ebp - 0x1804]
push eax
push 0x40a814
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop esi
leave
ret 4

Function at 0x419578
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x914
push ebx
push esi
lea eax, [ebp - 0x10]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push eax
mov esi, 0x104
push 0x40a868
mov dword [ebp - 8], ecx
push SysReAllocStringLen
mov dword [ebp - 0xc], esi
call edi
test eax, eax
je 0x4195c1
lea eax, [ebp - 0x10]
push eax
push 0x40a844
push SysReAllocStringLen
call edi
test eax, eax
jne 0x419672
lea eax, [ebp - 0xc]
xor ebx, ebx
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push ebx
push 0x45e298
push dword [ebp - 0x10]
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], ebx
lea esi, [ebp - 0x114]
jbe 0x419672
cmp byte [ebp - 0x114], 0x22
jne 0x419604
lea esi, [ebp - 0x113]
push 0x22
push esi
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x419615
mov byte [eax], bl
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
push edx
mov eax, dword [eax + 0x1fc08]
mov eax, dword [eax + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x78]
cmp dword [ebp - 4], ebx
je 0x419650
lea eax, [ebp - 0x914]
push 0x800
push eax
push dword [ebp - 4]
call fcn.00424811
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 5
lea eax, [ebp - 0x914]
push ebx
push eax
push esi
push 0x40a814
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x41967c
mov ecx, dword [ebp - 8]
push 2
call fcn.00417464
pop edi
pop esi
pop ebx
leave
ret
Function at 0x419fa4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
push esi
push ebx
call fcn.00419f3d
mov eax, esi
add esp, 0xc
cdq
sub eax, edx
xor edi, edi
mov esi, eax
mov eax, dword [ebp + 0xc]
sar esi, 1
test esi, esi
mov dword [ebp + 8], eax
jle 0x419ff4
lea eax, [ebp + 8]
push eax
call fcn.00419f88
add al, 0x11
pop ecx
xor al, byte [edi + ebx]
xor al, 2
mov byte [edi + ebx], al
inc edi
cmp edi, esi
jl 0x419fdb
and byte [esi + ebx], 0
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x41a250
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
mov esi, ecx
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowDC]
mov edi, eax
push 0
push edi
call dword [sym.imp.GDI32.dll_GetClipRgn]
mov ebx, dword [sym.imp.GDI32.dll_SelectClipRgn]
push 0
push edi
mov dword [ebp - 0x14], eax
call ebx
lea eax, [ebp - 0x24]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x20]
neg eax
push eax
mov eax, dword [ebp - 0x24]
neg eax
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
push 0x20
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_CopyRect]
lea eax, [ebp - 0x24]
mov ecx, esi
push eax
push dword [ebp - 8]
push edi
call fcn.0041a0e2
mov eax, dword [ebp - 8]
neg eax
push eax
mov dword [ebp - 4], eax
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_InflateRect]
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_CopyRect]
mov eax, dword [ebp - 0x20]
push dword [ebp - 4]
add eax, 0x16
push dword [ebp - 4]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x24]
push eax
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
mov ecx, esi
call fcn.0041a39c
mov eax, dword [ebp - 0x18]
push 0xcc0020
sub eax, dword [ebp - 0x20]
push 0
push 0
push dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x24]
push eax
push dword [ebp - 8]
push dword [ebp - 8]
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [ebp - 0xc]
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 0x10]
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 0x14]
push edi
call ebx
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x41a39c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
push dword [ebp + 0xc]
mov esi, ecx
push eax
call dword [sym.imp.USER32.dll_CopyRect]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [esi + 0x1c]
mov ebx, dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp + 0xc], eax
push eax
call ebx
push 0xcc0020
push 0x16
xor edi, edi
push 0x16
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push edi
push edi
push dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_StretchBlt]
push dword [ebp - 4]
push dword [ebp + 0xc]
call ebx
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_DeleteDC]
push edi
push edi
push dword [ebp + 8]
mov ecx, esi
call fcn.0041a04e
push edi
push 1
push dword [ebp + 8]
mov ecx, esi
call fcn.0041a04e
push edi
push 2
push dword [ebp + 8]
mov ecx, esi
call fcn.0041a04e
push edi
push 3
push dword [ebp + 8]
mov ecx, esi
call fcn.0041a04e
push edi
push 4
push dword [ebp + 8]
mov ecx, esi
call fcn.0041a04e
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 8
test al, al
je 0x41a475
mov ecx, esi
call fcn.0041a9de
cmp eax, 0xffffffff
je 0x41a475
push 2
push eax
push dword [ebp + 8]
mov ecx, esi
call fcn.0041a04e
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsZoomed]
push edi
push edi
push 0x7f
mov dword [ebp + 0xc], eax
push dword [esi + 4]
mov dword [ebp - 4], 0x10
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, edi
je 0x41a4bb
push 3
push edi
push edi
push 0x10
push 0x10
push eax
xor eax, eax
cmp dword [ebp + 0xc], edi
setne al
inc eax
inc eax
push eax
push 2
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DrawIconEx]
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
push 1
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
dec eax
push dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
lea eax, [edi + eax + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 0x60]
sub eax, 0xc
mov dword [ebp - 0x1c], eax
call dword [sym.imp.GDI32.dll_SetBkMode]
push dword [0x474afc]
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_SetTextColor]
push dword [0x473eac]
push dword [ebp + 8]
call ebx
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x24]
add esi, 0x70
push 0x48824
push eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DrawTextA]
push dword [ebp + 0xc]
push dword [ebp + 8]
call ebx
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x41a5af
Capabilities:
Get graphical window text

Disassembly:
push esi
mov eax, 0x45ec14
push edi
mov edi, dword [esp + 0xc]
push eax
push eax
mov esi, ecx
push edi
call fcn.00425b8a
add esp, 0xc
lea eax, [esi + 0x70]
push 0x800
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 1
mov ecx, esi
call fcn.0041a535
push 0
push 0
push edi
mov dword [esi + 4], edi
call dword [sym.imp.USER32.dll_SetWindowRgn]
pop edi
pop esi
ret 4
Function at 0x41ad18
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x368
push ebx
xor ebx, ebx
push edi
push ebx
push dword [0x531f10]
mov dword [ebp - 0x14], ecx
push 0x1000
push dword [ebp + 8]
push 0x12
push 0x36
push ebx
push ebx
push 0x5600b94c
push ebx
push 0x40a954
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0x10], edi
jne 0x41ad5f
xor eax, eax
jmp 0x41ae6d
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push 0x14
push 0x41e
push edi
call esi
push 0xa000a
push ebx
push 0x420
push edi
call esi
push ebx
push ebx
push 0x421
push edi
call esi
lea eax, [ebp - 0x368]
mov dword [ebp - 8], 1
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
sub dword [ebp - 8], eax
mov byte [ebp + 8], 0x10
mov byte [ebp + 9], 0x10
mov byte [ebp + 0xa], 0x10
mov dword [ebp - 0x20], 0x44d
mov dword [ebp - 0x1c], 0x43d
mov dword [ebp - 0x18], 0x43b
lea edi, [ebp - 0x5c]
cmp ebx, 2
mov dword [edi], ebx
jl 0x41addb
mov eax, dword [ebp - 8]
add eax, ebx
lea eax, [ebp + eax + 8]
mov dword [edi], eax
mov eax, dword [ebp - 0xc]
mov cl, byte [ebp + ebx + 8]
mov eax, dword [eax]
mov dword [edi + 4], eax
mov byte [edi + 8], 4
mov byte [edi + 9], cl
and dword [edi + 0xc], 0
test eax, eax
je 0x41ae13
push 0x104
push dword [ebp - 4]
push eax
push dword [0x531f10]
call dword [sym.imp.USER32.dll_LoadStringA]
mov eax, dword [ebp - 4]
mov dword [edi + 0x10], eax
jmp 0x41ae17
and dword [edi + 0x10], 0
add dword [ebp - 0xc], 4
add dword [ebp - 4], 0x104
inc ebx
add edi, 0x14
cmp ebx, 3
jl 0x41adc9
mov ebx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x10]
push 1
mov ecx, ebx
mov dword [ebx + 0xa1c], edi
call fcn.0041abeb
lea eax, [ebp - 0x5c]
push eax
push 3
push 0x414
push edi
call esi
push 8
push 0
push 0x454
push edi
call esi
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, ebx
call fcn.0041bd68
mov eax, edi
pop esi
pop edi
pop ebx
leave
ret 4

Function at 0x41b896
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
test edi, edi
mov esi, ecx
jl 0x41b8ab
cmp edi, dword [esi + 0xa10]
jl 0x41b8ad
xor edi, edi
mov eax, dword [esi + 0xa14]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [eax + eax*4]
shl eax, 5
and dword [eax + esi + 0x90], 0
mov eax, dword [esi + 0xa14]
lea eax, [eax + eax*4]
shl eax, 5
mov eax, dword [eax + esi + 0xa4]
test eax, eax
je 0x41b8e3
push 0
push eax
call ebx
lea eax, [edi + edi*4]
mov dword [esi + 0xa14], edi
shl eax, 5
mov dword [eax + esi + 0x90], 1
mov eax, dword [esi + 0xa14]
lea ecx, [eax + eax*4]
shl ecx, 5
cmp dword [ecx + esi + 0xa4], 0
jne 0x41b92b
push eax
mov ecx, esi
call fcn.0041b767
mov ecx, dword [esi + 0xa14]
lea ecx, [ecx + ecx*4]
shl ecx, 5
mov dword [ecx + esi + 0xa4], eax
mov ecx, esi
call fcn.0041b113
mov eax, dword [esi + 0xa14]
push 5
lea eax, [eax + eax*4]
shl eax, 5
push dword [eax + esi + 0xa4]
call ebx
mov eax, dword [esi + 0xa14]
mov ecx, esi
mov dword [0x472810], eax
call fcn.0041bcc2
pop edi
pop esi
pop ebx
ret 4