joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4403a0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push 0
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push 0
lea eax, [ebp - 4]
push eax
xor bl, bl
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
call esi
test eax, eax
jne 0x4403ee
push 8
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push eax
lea ecx, [ebp - 4]
push ecx
call esi
test eax, eax
je 0x440465
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push 0
push 0
push 0x8004
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x44040d
xor bl, bl
jmp 0x440465
mov ecx, dword [ebp - 8]
push 0
push 0x10
push 0x55a3b8
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x440409
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0xc]
push edx
push 0x280010
push eax
push 0x6801
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x440409
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push edx
mov edx, dword [ebp - 0xc]
lea eax, [ebp + 0xc]
push eax
push ecx
push 0
push 1
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
setne bl
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov ecx, dword [ebp - 4]
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x440490
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push 0
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push 0
lea eax, [ebp - 4]
push eax
xor bl, bl
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
call esi
test eax, eax
jne 0x4404de
push 8
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push eax
lea ecx, [ebp - 4]
push ecx
call esi
test eax, eax
je 0x440551
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push 0
push 0
push 0x8004
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x4404fd
xor bl, bl
jmp 0x440551
mov ecx, dword [ebp - 8]
push 0
push 0x10
push 0x55a3b8
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x4404f9
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0xc]
push edx
push 0x280010
push eax
push 0x6801
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x4404f9
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
lea edx, [ebp + 0xc]
push edx
push eax
push 0
push 1
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
setne bl
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 4]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x441580
Capabilities:
Check if file exists

Disassembly:
push ebx
xor bl, bl
test esi, esi
je 0x4415c3
cmp word [esi], 0
je 0x4415c3
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4415b7
push esi
mov dword [edi], 0
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x4415ad
mov al, 1
pop ebx
ret
mov al, bl
mov dword [edi], 2
pop ebx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
mov al, bl
pop ebx
ret
mov al, bl
mov dword [edi], 0x57
pop ebx
ret
Function at 0x4415d0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52d7d8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x559024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
xor bl, bl
cmp eax, edi
je 0x4417a3
cmp word [eax], di
je 0x4417a3
push eax
lea esi, [ebp - 0x18]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
call fcn.004fcba0
mov eax, dword [ebp + 8]
push eax
mov eax, esi
mov dword [ebp - 4], edi
call fcn.004417d0
mov edi, eax
xor eax, eax
cmp edi, eax
jle 0x44178a
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
lea esp, [esp]
push 0x5388e8
or esi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x441691
test edi, edi
js 0x441691
mov ecx, dword [ebp - 0x14]
cmp edi, ecx
jge 0x441691
add eax, edi
cmp eax, ecx
jg 0x441691
mov ebx, dword [ebp - 0x18]
lea eax, [ebx + edi*2]
push 0x5388e8
push eax
call fcn.00514c6b
add esp, 8
test eax, eax
je 0x441691
sub eax, ebx
sar eax, 1
mov esi, eax
xor ebx, ebx
mov edi, esi
cmp esi, ebx
jle 0x4416d5
lea ecx, [ebp - 0x30]
push ecx
mov edx, esi
lea ecx, [ebp - 0x18]
call fcn.004fc4b0
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.004fce50
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x30]
lea edi, [esi + 1]
cmp eax, ebx
je 0x4416e0
push eax
call fcn.005134a7
add esp, 4
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
jmp 0x4416e0
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x24]
call fcn.004fce50
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x441749
cmp word [ebx], 0
je 0x441749
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44173a
mov esi, dword [ebp + 8]
push ebx
mov dword [esi], 0
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x441756
mov dword [esi], 2
mov eax, ebx
test ebx, ebx
jne 0x44171d
mov eax, 0x538640
xor bl, bl
test eax, eax
je 0x441764
cmp word [eax], 0
je 0x441764
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x44175a
mov bl, 1
jmp 0x44176a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov esi, edx
jmp 0x441712
mov eax, dword [ebp + 8]
mov dword [eax], 0x57
mov esi, eax
jmp 0x441712
mov bl, 1
jmp 0x44176e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
jmp 0x44176a
mov dword [esi], 0x57
test bl, bl
je 0x441776
test edi, edi
jg 0x441650
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x44178a
push eax
call fcn.005134a7
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4417ac
push eax
call fcn.005134a7
add esp, 4
jmp 0x4417ac
mov ecx, dword [ebp + 8]
mov dword [ecx], 0x57
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x441a40
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c8
mov eax, dword [0x559024]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, word [ebp + 0xc]
mov dword [ebp - 0x2bc], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, esi
mov dword [ebp - 0x2c0], ecx
mov dword [ebp - 0x2c8], edx
call fcn.00440760
test al, al
je 0x441af4
mov ecx, dword [ebp - 0x2c8]
mov edx, dword [ebp - 0x2c0]
push ecx
push edx
push edi
lea eax, [esi + 0x14]
push ebx
mov ebx, dword [ebp - 0x2bc]
mov dword [ebp - 0x2c4], eax
call fcn.00507570
mov ebx, eax
test ebx, ebx
je 0x441af6
mov ax, word [ebp - 0x2bc]
push 0x4003
push 0x2b4
lea ecx, [ebp - 0x2b8]
push ecx
push 0
push 0x53a930
mov word [esi + 0x4c], ax
mov dword [esi + 0x50], ebx
mov dword [esi + 0x6c], edi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x441ae1
mov edx, dword [ebp - 0x2c4]
push eax
call fcn.00507650
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00513498
mov esp, ebp
pop ebp
ret 8
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00513498
mov esp, ebp
pop ebp
ret 8

Function at 0x443750
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 0x40]
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x443765
push 3
push eax
call edi
jmp 0x443773
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + 4]
mov dword [esi + ecx + 0x3c], 6
mov eax, dword [esi + 0xb88]
test eax, eax
je 0x443784
push 0
push eax
call edi
jmp 0x443798
mov edx, dword [esi + 0xb84]
mov eax, dword [edx + 4]
mov dword [esi + eax + 0xb84], 6
mov eax, dword [esi + 0xe34]
test eax, eax
je 0x4437a9
push 5
push eax
call edi
pop edi
ret
mov ecx, dword [esi + 0xe30]
mov edx, dword [ecx + 4]
mov dword [esi + edx + 0xe30], 6
pop edi
ret

Function at 0x4437c0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 0x40]
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x4437d5
push 9
push eax
call edi
jmp 0x4437e3
mov eax, dword [esi + 0x3c]
mov ecx, dword [eax + 4]
mov dword [esi + ecx + 0x3c], 6
mov eax, dword [esi + 0xe34]
test eax, eax
je 0x4437f4
push 0
push eax
call edi
jmp 0x443808
mov edx, dword [esi + 0xe30]
mov eax, dword [edx + 4]
mov dword [esi + eax + 0xe30], 6
mov eax, dword [esi + 0xb88]
test eax, eax
je 0x443819
push 5
push eax
call edi
pop edi
ret
mov ecx, dword [esi + 0xb84]
mov edx, dword [ecx + 4]
mov dword [esi + edx + 0xb84], 6
pop edi
ret

Function at 0x443830
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [edi + 0x13c8]
push esi
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea esi, [edi + 0x3c]
call fcn.00510cd0
pop esi
test al, al
je 0x443857
push edi
call fcn.00444280
mov byte [edi + 0x13cc], 0
mov eax, dword [edi + 0x30]
test eax, eax
je 0x44386f
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
mov ecx, dword [edi + 0x2c]
mov edx, dword [ecx + 4]
mov dword [edi + edx + 0x2c], 6
ret
Function at 0x443ae0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 2
push ebx
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push esi
lea esi, [edi + 0x26c]
jne 0x443b43
mov eax, dword [esi + 0x91c]
test eax, eax
je 0x443b08
push 0
push eax
call ebx
jmp 0x443b1c
mov eax, dword [esi + 0x918]
mov ecx, dword [eax + 4]
mov dword [esi + ecx + 0x918], 6
mov eax, dword [esi + 0xbc8]
test eax, eax
je 0x443b2d
push 5
push eax
call ebx
jmp 0x443b93
mov edx, dword [esi + 0xbc4]
mov eax, dword [edx + 4]
mov dword [esi + eax + 0xbc4], 6
jmp 0x443b93
mov eax, dword [esi + 0xbc8]
test eax, eax
je 0x443b54
push 0
push eax
call ebx
jmp 0x443b68
mov ecx, dword [esi + 0xbc4]
mov edx, dword [ecx + 4]
mov dword [esi + edx + 0xbc4], 6
mov eax, dword [esi + 0x91c]
test eax, eax
je 0x443b79
push 5
push eax
call ebx
jmp 0x443b8d
mov eax, dword [esi + 0x918]
mov ecx, dword [eax + 4]
mov dword [esi + ecx + 0x918], 6
cmp dword [ebp + 0xc], 0
jne 0x443bca
mov ebx, dword [ebp + 8]
lea eax, [edi + 0xb8]
call fcn.00511440
mov ebx, dword [ebp + 0x10]
mov ecx, ebx
call fcn.004450b0
mov eax, dword [ebp + 0x14]
mov edx, ebx
sub edx, dword [edi + 0x1448]
sub eax, dword [edi + 0x144c]
mov dword [edi + 0x1428], edx
mov dword [edi + 0x142c], eax
jmp 0x443bcd
mov ebx, dword [ebp + 0x10]
mov cx, word [edi + 0x13f0]
sub cx, word [edi + 0x13d4]
mov ax, word [edi + 0x13d8]
add cx, word [ebp + 0x14]
add ax, ax
movzx edx, cx
sub bx, ax
mov eax, dword [edi + 0x13c8]
movzx ecx, bx
shl edx, 0x10
or edx, ecx
push edx
mov edx, dword [ebp + 0xc]
push edx
push 5
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x4474d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x534805
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x559024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebx + 4], 0x53adcc
mov dword [ebx + 0x2c], 0x53add4
mov dword [ebx + 0x45dd0], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x14], eax
mov byte [ebx + 0x1c], al
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x24], eax
mov dword [ebx + 0x28], eax
mov dword [ebp - 0x10], eax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], eax
mov byte [ebx + 0x38], al
mov dword [ebp - 4], eax
lea eax, [ebx + 0x3c]
push eax
mov dword [ebx], vtable.CHomeClientWnd.0
call fcn.0044b040
lea edi, [ebx + 0xe68]
call fcn.004fa1e0
lea esi, [ebx + 0x12d8]
call fcn.004f8e50
lea ecx, [ebx + 0x154c]
push ecx
mov byte [ebp - 4], 3
call fcn.004a4010
lea esi, [ebx + 0x13c10]
call fcn.004c9410
lea edx, [ebx + 0x23804]
push edx
mov byte [ebp - 4], 5
call fcn.00481930
lea eax, [ebx + 0x43a24]
push eax
mov byte [ebp - 4], 6
call fcn.00448980
lea ecx, [ebx + 0x44d44]
push ecx
mov byte [ebp - 4], 7
call fcn.0044d600
xor eax, eax
mov dword [ebx + 0x45d9c], eax
mov dword [ebx + 0x45da0], eax
mov dword [ebx + 0x45da4], eax
mov dword [ebx + 0x45da8], eax
mov dword [ebx + 0x45dac], eax
mov dword [ebx + 0x45db0], eax
mov dword [ebx + 0x45db4], eax
mov dword [ebx + 0x45db8], eax
mov dword [ebx + 0x45dbc], eax
mov dword [ebx + 0x45dc0], eax
mov dword [ebx + 0x45dc4], eax
mov byte [ebx + 0x45dc8], al
mov dword [ebx + 0x45dcc], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4480e0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea edi, [esi + 0x45d9c]
push edi
mov ecx, str.BrCcHome.sdd
mov ebx, eax
call fcn.00466b30
cmp byte [ebp + 0x18], 0
lea eax, [esi + 0x45dac]
je 0x448112
push str.ScanFuncPage_Mini_Wnd
jmp 0x448117
push str.ScanFuncPage_Wnd
call fcn.004fcf00
mov eax, dword [edi + 0x10]
test eax, eax
jne 0x448128
mov eax, 0x538640
cmp dword [edi + 8], 0
mov dword [ebp - 4], 0
jle 0x44815d
test eax, eax
je 0x44815d
cmp word [eax], 0
je 0x44815d
mov ecx, dword [edi + 4]
test ecx, ecx
jne 0x44814b
mov ecx, 0x538640
push ecx
push 0
push str.PosiX
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 4], eax
mov ecx, dword [edi + 0x10]
test ecx, ecx
jne 0x448169
mov ecx, 0x538640
xor edx, edx
mov dword [ebp - 8], edx
cmp dword [edi + 8], edx
jle 0x44819c
test ecx, ecx
je 0x44819c
cmp word [ecx], dx
je 0x44819c
mov eax, dword [edi + 4]
test eax, eax
jne 0x448188
mov eax, 0x538640
push eax
push 0
push str.PosiY
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 8], eax
mov edx, eax
mov eax, dword [ebp + 0x18]
sub ebx, dword [esi + 0x45dc0]
mov ecx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp - 4]
push 1
sub ebx, edx
push ebx
push ecx
mov ecx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push ecx
lea edi, [esi + 0x154c]
mov dword [esi + 0x45dbc], edx
call fcn.004a4200
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
push edx
mov edx, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push ecx
push edx
mov edx, dword [ebp - 8]
push eax
add esi, 0x13c10
call fcn.004c9650
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 4]
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 8]
push ecx
mov ecx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 0xc]
push eax
push ecx
push edx
add edi, 0x23804
mov eax, ebx
mov edx, esi
call fcn.00481b40
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edi, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push ebx
push ecx
mov ecx, dword [ebp + 8]
push edi
push edx
add ecx, 0x43a24
mov edx, esi
call fcn.00448d40
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push ebx
push ecx
mov ecx, dword [ebp + 8]
push edi
push edx
add ecx, 0x44d44
mov edx, esi
call fcn.0044d9c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x448270
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [edi + 0x45dc4]
push ebx
push esi
test eax, eax
je 0x448369
cmp eax, 0x5000000
ja 0x4482e4
je 0x4482b9
cmp eax, 0x1000000
je 0x4482ac
cmp eax, 0x3000000
jne 0x448328
lea ecx, [edi + 0x1578]
call fcn.005113b0
jmp 0x448328
lea ecx, [edi + 0x13c3c]
call fcn.005113b0
jmp 0x448328
mov eax, dword [edi + 0x23834]
test eax, eax
je 0x4482ce
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x448328
mov eax, dword [edi + 0x23830]
mov ecx, dword [eax + 4]
mov dword [edi + ecx + 0x23830], 6
jmp 0x448328
cmp eax, 0x6000000
je 0x4482ff
cmp eax, 0x7000000
jne 0x448328
lea ecx, [edi + 0x44d70]
call fcn.005113b0
jmp 0x448328
mov eax, dword [edi + 0x43a54]
test eax, eax
je 0x448314
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x448328
mov edx, dword [edi + 0x43a50]
mov eax, dword [edx + 4]
mov dword [edi + eax + 0x43a50], 6
call fcn.00507f20
mov esi, eax
test esi, esi
je 0x448369
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
push 0xffffffffffffffff
push 0
push 0x830f
push esi
call ebx
push 0xffffffffffffffff
push 0
push 0x8310
push esi
call ebx
push 0xffffffffffffffff
push 0
push 0x8311
push esi
call ebx
push 0xffffffffffffffff
push 0
push 0x8312
push esi
call ebx
mov ebx, dword [ebp + 8]
and ebx, 0x1f000000
cmp ebx, 0x5000000
ja 0x4483d4
je 0x4483bc
cmp ebx, 0x1000000
je 0x4483a4
cmp ebx, 0x3000000
jne 0x448407
lea esi, [edi + 0x154c]
call fcn.004a4400
mov dword [edi + 0x45dc4], ebx
pop esi
pop ebx
pop ecx
pop ebp
ret 4
lea esi, [edi + 0x13c10]
call fcn.004c9780
mov dword [edi + 0x45dc4], ebx
pop esi
pop ebx
pop ecx
pop ebp
ret 4
lea esi, [edi + 0x23804]
call fcn.00481c60
mov dword [edi + 0x45dc4], ebx
pop esi
pop ebx
pop ecx
pop ebp
ret 4
cmp ebx, 0x6000000
je 0x4483fc
cmp ebx, 0x7000000
jne 0x448407
lea esi, [edi + 0x44d44]
call fcn.0044dc40
mov dword [edi + 0x45dc4], ebx
pop esi
pop ebx
pop ecx
pop ebp
ret 4
lea esi, [edi + 0x43a24]
call fcn.00448fc0
pop esi
mov dword [edi + 0x45dc4], ebx
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x448420
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52d8e8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x559024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea esi, [edi + 0x43a24]
call fcn.00449420
lea esi, [edi + 0x44d44]
call fcn.00449420
xor ebx, ebx
cmp byte [0x55adaa], bl
je 0x4484d3
cmp byte [0x55b417], bl
je 0x4484d3
cmp byte [0x55b418], bl
jne 0x4484d3
push 0x55adf2
lea esi, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.004fcba0
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x18]
cmp eax, ebx
jne 0x44849c
mov eax, 0x538640
push eax
lea ebx, [edi + 0xe68]
call fcn.004fa830
lea ecx, [edi + 0xe94]
call fcn.00511390
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
call fcn.004fc190
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0xe98]
cmp eax, ebx
je 0x4484f6
push ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0xe94]
mov ecx, dword [eax + 4]
mov dword [edi + ecx + 0xe94], 6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44b040
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x529f45
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x559024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
push 0x4052a0
push 0x435050
push 5
push 0x2ac
lea eax, [esi + 0x38]
push eax
mov byte [ebp - 4], 1
call fcn.00513bdf
mov ecx, 0xc
lea eax, [esi + 0xd94]
mov edi, edi
mov byte [eax], bl
inc eax
dec ecx
jne 0x44b0c0
mov ecx, 0x10
lea eax, [esi + 0xda0]
mov byte [eax], bl
inc eax
dec ecx
jne 0x44b0d1
mov dword [esi + 0xdb0], ebx
mov dword [esi + 0xdb4], ebx
mov dword [esi + 0xdb8], ebx
mov dword [esi + 0xdbc], ebx
mov ecx, 0x14
lea eax, [esi + 0xdc0]
lea ebx, [ebx]
mov byte [eax], bl
inc eax
dec ecx
jne 0x44b100
mov ecx, 0x14
lea eax, [esi + 0xdd4]
mov byte [eax], bl
inc eax
dec ecx
jne 0x44b111
mov ecx, 0x14
lea eax, [esi + 0xde8]
mov byte [eax], bl
inc eax
dec ecx
jne 0x44b122
mov dword [esi + 0xdfc], ebx
mov ecx, 0xc
lea eax, [esi + 0xe00]
lea esp, [esp]
mov byte [eax], bl
inc eax
dec ecx
jne 0x44b140
mov ecx, 0xc
lea eax, [esi + 0xe10]
mov byte [eax], bl
inc eax
dec ecx
jne 0x44b151
mov ecx, 0x10
lea eax, [esi + 0xe1c]
mov byte [eax], bl
inc eax
dec ecx
jne 0x44b162
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4560c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
push eax
mov ebx, edx
mov ecx, esi
mov dword [esi + 0xd54], eax
mov dword [esi + 0xd58], edi
call fcn.00457930
mov eax, dword [esi + 0x30]
test eax, eax
je 0x456105
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
test eax, eax
jne 0x456113
mov eax, dword [esi + 0x2c]
mov ebx, dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + esi + 0x2c], eax
jmp 0x456113
mov ecx, dword [esi + 0x2c]
mov edx, dword [ecx + 4]
mov dword [esi + edx + 0x2c], 6
mov eax, dword [esi + 0x3e4]
test eax, eax
je 0x456128
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x45613c
mov eax, dword [esi + 0x3e0]
mov ecx, dword [eax + 4]
mov dword [esi + ecx + 0x3e0], 6
add esi, 0x438
call fcn.0045bdc0
mov esi, dword [ebp + 8]
call fcn.00457eb0
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x456680
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x45672b
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
push ecx
push edx
call dword [sym.imp.USER32.dll_WindowFromPoint]
cmp eax, dword [edi + 0x3c4]
je 0x45672b
lea esi, [edi + 0x438]
xor cl, cl
cmp eax, dword [esi + 0xf0]
jne 0x4566c1
mov cl, 1
cmp eax, dword [esi + 0x39c]
jne 0x4566cb
mov cl, 1
cmp eax, dword [esi + 0x648]
jne 0x4566d5
mov cl, 1
cmp eax, dword [esi + 0xb8]
je 0x45672b
test cl, cl
jne 0x45672b
mov eax, dword [edi + 0x3e4]
test eax, eax
je 0x456708
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.0045bdc0
mov dword [edi + 0x1e0], 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x3e0]
mov ecx, dword [eax + 4]
mov dword [edi + ecx + 0x3e0], 6
call fcn.0045bdc0
mov dword [edi + 0x1e0], 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret