joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc83304
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffaec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x514], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0xc828ac
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.00c83290
test eax, eax
jbe 0xc83493
cmp dword [ebp - 8], 0
jbe 0xc83493
mov eax, dword [ebp - 0xc]
call fcn.00c83290
cmp eax, 0x80
jbe 0xc8336d
lea eax, [ebp - 0x510]
mov ecx, pe_nt_image_headers32
mov edx, dword [ebp - 0xc]
call fcn.00c832fc
jmp 0xc83387
mov eax, dword [ebp - 0xc]
call fcn.00c83290
mov ecx, eax
add ecx, ecx
lea eax, [ebp - 0x510]
mov edx, dword [ebp - 0xc]
call fcn.00c832fc
xor edi, edi
lea eax, [ebp - 0x410]
mov dword [eax], edi
inc edi
add eax, 4
cmp edi, 0x100
jne 0xc8338f
xor esi, esi
xor edi, edi
lea ebx, [ebp - 0x410]
lea eax, [ebp - 0x514]
mov edx, dword [ebp - 0xc]
call fcn.00c82624
mov eax, dword [ebp - 0x514]
call fcn.00c82698
push eax
mov eax, edi
pop edx
mov ecx, edx
cdq
idiv ecx
xor eax, eax
mov al, byte [ebp + edx - 0x510]
add esi, dword [ebx]
add eax, esi
and eax, 0x800000ff
jns 0xc833e4
dec eax
or eax, 0xffffff00
inc eax
mov esi, eax
mov al, byte [ebx]
mov edx, dword [ebp + esi*4 - 0x410]
mov dword [ebx], edx
and eax, 0xff
mov dword [ebp + esi*4 - 0x410], eax
inc edi
add ebx, 4
cmp edi, 0x100
jne 0xc833a7
xor esi, esi
xor edx, edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
dec ecx
test ecx, ecx
jl 0xc83493
inc ecx
inc esi
and esi, 0x800000ff
jns 0xc8342d
dec esi
or esi, 0xffffff00
inc esi
add edx, dword [ebp + esi*4 - 0x410]
and edx, 0x800000ff
jns 0xc83444
dec edx
or edx, 0xffffff00
inc edx
mov al, byte [ebp + esi*4 - 0x410]
mov ebx, dword [ebp + edx*4 - 0x410]
mov dword [ebp + esi*4 - 0x410], ebx
and eax, 0xff
mov dword [ebp + edx*4 - 0x410], eax
mov eax, dword [ebp + esi*4 - 0x410]
add eax, dword [ebp + edx*4 - 0x410]
and eax, 0x800000ff
jns 0xc83481
dec eax
or eax, 0xffffff00
inc eax
mov al, byte [ebp + eax*4 - 0x410]
mov ebx, dword [ebp - 0x10]
xor byte [ebx], al
inc dword [ebp - 0x10]
dec ecx
jne 0xc8341c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xc828b3
lea eax, [ebp - 0x514]
call fcn.00c8250c
ret
Function at 0x673c3c62
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x67f27014]
mov dword [ebp - 0xc], eax
jmp 0x673c3cd8
jmp 0x673c3d40
jmp 0x673c3da8
jmp 0x673c3e10
jmp 0x673c3e78
jmp 0x673c3ee0
jmp 0x673c3f48
jmp 0x673c3fb0
jmp 0x673c4018
jmp 0x673c4080
jmp 0x673c40e8
jmp 0x673c4150
cmp dword [ebp - 0xc], 0
je 0x673c552c
mov eax, dword [0x67f27014]
mov dword [0x67f2700c], eax
jmp 0x673c41cc
jmp 0x673c4234
jmp 0x673c429c
jmp 0x673c4304
jmp 0x673c436c
jmp 0x673c43d4
jmp 0x673c443c
jmp 0x673c44a4
jmp 0x673c450c
jmp 0x673c4574
jmp 0x673c45dc
jmp 0x673c4644
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 0xc]
add eax, edx
mov dword [0x67f27008], eax
jmp 0x673c46bc
jmp 0x673c4724
jmp 0x673c478c
jmp 0x673c47f4
jmp 0x673c485c
jmp 0x673c48c4
jmp 0x673c492c
jmp 0x673c4994
jmp 0x673c49fc
jmp 0x673c4a64
jmp 0x673c4acc
jmp 0x673c4b34
mov eax, dword [0x67f27008]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x10], eax
jmp 0x673c4ba7
jmp 0x673c4c0f
jmp 0x673c4c77
jmp 0x673c4cdf
jmp 0x673c4d47
jmp 0x673c4daf
jmp 0x673c4e17
jmp 0x673c4e7f
jmp 0x673c4ee7
jmp 0x673c4f4f
jmp 0x673c4fb7
jmp 0x673c501f
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
sub esp, 0x10
mov dword [0x67f27004], eax
jmp 0x673c50b4
jmp 0x673c511c
jmp 0x673c5184
jmp 0x673c51ec
jmp 0x673c5254
jmp 0x673c52bc
jmp 0x673c5324
jmp 0x673c538c
jmp 0x673c53f4
jmp 0x673c545c
jmp 0x673c54c4
jmp 0x673c552c
nop
leave
ret
Function at 0x673c5f33
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x67f27008]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x67f27008]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x673c5fbb
jmp 0x673c6023
jmp 0x673c608b
jmp 0x673c60f3
jmp 0x673c615b
jmp 0x673c61c3
jmp 0x673c622b
jmp 0x673c6293
jmp 0x673c62fb
jmp 0x673c6363
jmp 0x673c63cb
jmp 0x673c6433
mov dword [ebp - 0x14], 0
jmp 0x673c64a2
jmp 0x673c650a
jmp 0x673c6572
jmp 0x673c65da
jmp 0x673c6642
jmp 0x673c66aa
jmp 0x673c6712
jmp 0x673c677a
jmp 0x673c67e2
jmp 0x673c684a
jmp 0x673c68b2
jmp 0x673c691a
mov dword [ebp - 0x18], 0
jmp 0x673c6989
jmp 0x673c69f1
jmp 0x673c6a59
jmp 0x673c6ac1
jmp 0x673c6b29
jmp 0x673c6b91
jmp 0x673c6bf9
jmp 0x673c6c61
jmp 0x673c6cc9
jmp 0x673c6d31
jmp 0x673c6d99
jmp 0x673c6e01
mov dword [ebp - 0x10], 0
jmp 0x673c6e70
jmp 0x673c6ed8
jmp 0x673c6f40
jmp 0x673c6fa8
jmp 0x673c7010
jmp 0x673c7078
jmp 0x673c70e0
jmp 0x673c7148
jmp 0x673c71b0
jmp 0x673c7218
jmp 0x673c7280
jmp 0x673c72e8
mov dword [ebp - 0x10], 0
jmp 0x673c8b9a
jmp 0x673c735c
jmp 0x673c73c4
jmp 0x673c742c
jmp 0x673c7494
jmp 0x673c74fc
jmp 0x673c7564
jmp 0x673c75cc
jmp 0x673c7634
jmp 0x673c769c
jmp 0x673c7704
jmp 0x673c776c
jmp 0x673c77d4
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [0x67f27004]
add eax, edx
mov dword [ebp - 0x14], eax
jmp 0x673c784d
jmp 0x673c78b5
jmp 0x673c791d
jmp 0x673c7985
jmp 0x673c79ed
jmp 0x673c7a55
jmp 0x673c7abd
jmp 0x673c7b25
jmp 0x673c7b8d
jmp 0x673c7bf5
jmp 0x673c7c5d
jmp 0x673c7cc5
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
mov edx, dword [0x67f2700c]
add eax, edx
mov dword [ebp - 0x18], eax
jmp 0x673c7d3e
jmp 0x673c7da6
jmp 0x673c7e0e
jmp 0x673c7e76
jmp 0x673c7ede
jmp 0x673c7f46
jmp 0x673c7fae
jmp 0x673c8016
jmp 0x673c807e
jmp 0x673c80e6
jmp 0x673c814e
jmp 0x673c81b6
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
jmp 0x673c823a
jmp 0x673c82a2
jmp 0x673c830a
jmp 0x673c8372
jmp 0x673c83da
jmp 0x673c8442
jmp 0x673c84aa
jmp 0x673c8512
jmp 0x673c857a
jmp 0x673c85e2
jmp 0x673c864a
jmp 0x673c86b2
add dword [ebp - 0xc], 0x28
jmp 0x673c871e
jmp 0x673c8786
jmp 0x673c87ee
jmp 0x673c8856
jmp 0x673c88be
jmp 0x673c8926
jmp 0x673c898e
jmp 0x673c89f6
jmp 0x673c8a5e
jmp 0x673c8ac6
jmp 0x673c8b2e
jmp 0x673c8b96
add dword [ebp - 0x10], 1
mov eax, dword [0x67f27008]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x673c72f4
nop
leave
ret

Function at 0x673d6e00
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], 0x67f26040
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.673d6e60
Function at 0x673d6e60
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x67f27378]
test esi, esi
jle 0x673d6f4d
mov edi, dword [0x67f2737c]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x673d6e94
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x673d6f46
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x673d6e80
mov dword [esp], eax
mov esi, eax
call fcn.673d7600
test eax, eax
mov edi, eax
je 0x673d6f8a
mov esi, dword [0x67f2737c]
lea ebx, [ebx + ebx*2]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.673d7710
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x67f2737c]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x673d6f6a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x673d6f3f
sub eax, 0x40
and eax, 0xffffffbf
je 0x673d6f3f
mov eax, dword [esp + 0x20]
add ebx, dword [0x67f2737c]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x673d6f54
add dword [0x67f27378], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor ebx, ebx
jmp 0x673d6e9e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.673d6e00
mov eax, dword [0x67f2737c]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.673d6e00
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.673d6e00
lea esi, [esi]

Function at 0x673d7270
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x67f27388
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x67f27380]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x673d72c5
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x673d72be
test esi, esi
je 0x673d72be
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x673d72a0
mov dword [esp], 0x67f27388
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401580
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cef56
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x50d108]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.CXElement.0
call fcn.00404900
mov ecx, eax
test ecx, ecx
jne 0x4015c7
push 0x80004005
call fcn.00404660
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 4], eax
mov dword [ebp - 4], 0
call fcn.00404900
mov ecx, eax
test ecx, ecx
jne 0x4015ee
push 0x80004005
call fcn.00404660
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0xc], eax
lea esi, [edi + 0x10]
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00402b60
mov dword [esi], eax
xorps xmm0, xmm0
mov eax, dword fs:[0x2c]
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov ecx, dword [eax]
movq qword [edi + 0x28], xmm0
mov dword [edi + 0x28], edi
mov dword [edi + 0x24], vtable.TGeneralObserverObj_class_CXElement_.0
mov eax, dword [0x513de0]
cmp eax, dword [ecx + 4]
jle 0x40169b
push 0x513de0
call fcn.0048a6aa
add esp, 4
cmp dword [0x513de0], 0xffffffff
jne 0x40169b
push 0x4d9060
mov dword [0x50de10], 0x64
mov dword [0x50de14], 0x64
mov byte [0x50de18], 0
call fcn.0048a561
push 0x513de0
call fcn.0048a66b
add esp, 8
mov dword [edi + 0x30], 0x50de10
mov eax, edi
mov dword [edi + 8], 0
mov dword [edi + 0x2c], 0x401ba0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x403ed0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x403ee5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x403f26
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x403f22
nop word [eax + eax]
cmp esi, edx
jae 0x403f26
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x403f10
cmp esi, edx
jb 0x403f2b
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
Function at 0x413480
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
mov ebx, ecx
push esi
push edi
cmp byte [ebx + 0xb4], 0
je 0x4135fb
mov eax, dword [ebx + 0xbc]
test eax, eax
je 0x4134f8
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x38], 0
push ecx
push 0x18
xorps xmm0, xmm0
mov dword [ebp - 0x24], 0
push eax
movups xmmword [ebp - 0x34], xmm0
call dword [sym.imp.GDI32.dll_GetObjectW]
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x34]
je 0x4135dc
mov eax, dword [ebp + 0x14]
sub eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x30]
je 0x4135dc
push dword [ebx + 0xbc]
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebx + 0xbc], 0
push dword [ebx + 0xb8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x4135fb
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
push dword [ebx + 0xb8]
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromFile]
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 8]
push ecx
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.gdiplus.dll_GdipGetImagePixelFormat]
mov ecx, dword [ebp + 0x14]
lea edx, [ebp - 4]
sub ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp + 8]
push edx
push 0
push dword [ebp - 8]
mov dword [ebp - 0x20], vtable.Gdiplus::Bitmap.0
push 0
push ecx
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromScan0]
mov edi, dword [ebp + 0x10]
lea ecx, [ebp - 4]
mov esi, dword [ebp + 0x14]
sub edi, dword [ebp + 8]
sub esi, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
push ecx
push eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
call dword [sym.imp.gdiplus.dll_GdipGetImageGraphicsContext]
mov eax, dword [ebp - 4]
push 7
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.gdiplus.dll_GdipSetInterpolationMode]
push esi
mov esi, dword [ebp - 8]
push edi
mov edi, dword [ebp - 0x10]
push 0
push 0
push edi
push esi
call dword [sym.imp.gdiplus.dll_GdipDrawImageRectI]
push ecx
mov edx, 1
lea ecx, [ebp - 0x20]
call fcn.0040f690
add esp, 4
mov dword [ebx + 0xbc], eax
push esi
test eax, eax
je 0x4135e7
call dword [sym.imp.gdiplus.dll_GdipDeleteGraphics]
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.gdiplus.dll_GdipDisposeImage]
call esi
push edi
call esi
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call dword [sym.imp.gdiplus.dll_GdipDeleteGraphics]
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.gdiplus.dll_GdipDisposeImage]
call esi
push edi
call esi
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x416880
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
mov esi, ecx
mov dword [esp + 0x18], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [esp + 0x10]
mov ecx, esi
push eax
mov eax, dword [esi]
call dword [eax + 0xd0]
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [esp + 0x14]
sub eax, dword [esi + 0x5c]
mov ebx, dword [esp + 0x10]
sub ebx, dword [esi + 0x58]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0
mov dword [eax], 0
mov eax, 0x2e8ba2e9
mov ecx, dword [esi + 0x168]
sub ecx, dword [esi + 0x164]
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x416996
xor edi, edi
nop dword [eax + eax]
mov eax, dword [esi + 0x164]
push dword [esp + 0x14]
add eax, 8
push ebx
add eax, edi
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x41695b
mov eax, dword [esi + 0x164]
cmp dword [eax + edi + 0x20], 0
je 0x41695b
mov eax, dword [ebp + 0x14]
push 1
push 0
push 0
mov dword [eax], 1
mov eax, dword [esi + 0x164]
push dword [eax + edi + 0x24]
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esi + 0x168]
mov eax, 0x2e8ba2e9
sub ecx, dword [esi + 0x164]
add edi, 0x2c
mov ebx, dword [esp + 0xc]
imul ecx
inc ebx
sar edx, 3
mov eax, edx
mov dword [esp + 0xc], ebx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jae 0x41698e
mov ebx, dword [esp + 0x10]
jmp 0x416910
mov eax, dword [ebp + 0x14]
cmp dword [eax], 0
jne 0x4169a3
mov eax, dword [esi]
mov ecx, esi
push esi
push 0x384
call dword [eax + 0x2c]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x41c170
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 0xc]
mov ecx, dword [esi + 0x58]
test ecx, ecx
je 0x41c18a
mov eax, dword [ecx]
push edi
call dword [eax + 0x104]
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
cmp dword [esi + 0xe4], 0
je 0x41c1fd
mov eax, dword [esi + 0xe0]
test eax, eax
je 0x41c1fd
test edi, edi
je 0x41c1bd
push 5
push dword [eax + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
xor eax, eax
pop esi
pop ebp
ret 0x10
push ebx
push 0
push dword [eax + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x38]
mov edi, dword [sym.imp.USER32.dll_GetParent]
call edi
mov ebx, eax
test ebx, ebx
je 0x41c1fc
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41c1fc
push ebx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x41c1fc
push dword [esi + 0x38]
call edi
push eax
call dword [sym.imp.USER32.dll_SetFocus]
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret 0x10

Function at 0x41c210
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x50d108]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 0x14]
mov ecx, dword [esi + 0x58]
test ecx, ecx
je 0x41c233
mov eax, dword [ecx]
call dword [eax + 0x24]
cmp dword [esi + 0xe4], 0
je 0x41c2e9
cmp dword [esi + 0xe0], 0
je 0x41c2e9
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x41c2c5
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x41c2c5
mov eax, dword [esi + 0xe0]
push dword [eax + 0x38]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41c2e9
mov eax, dword [esi + 0xe0]
push 5
push dword [eax + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push dword [esi + 0x38]
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [esi + 0xe0]
lea eax, [ebp - 0x14]
sub dword [ebp - 0x14], 5
add ecx, 0x38
sub dword [ebp - 0x10], 3
add dword [ebp - 0xc], 5
add dword [ebp - 8], 7
push 1
push eax
call fcn.0041da60
jmp 0x41c2e9
mov eax, dword [esi + 0xe0]
push dword [eax + 0x38]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41c2e9
mov eax, dword [esi + 0xe0]
push 0
push dword [eax + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x58]
mov ecx, dword [ebp - 4]
xor eax, eax
mov dword [edi], 0
xor ecx, ebp
pop edi
pop esi
call fcn.0048a7ae
mov esp, ebp
pop ebp
ret 0x10
Function at 0x421590
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x50d108]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 0x14]
mov ecx, dword [esi + 0x1cc]
test ecx, ecx
je 0x4215b9
mov eax, dword [ecx]
call dword [eax + 4]
push 0x104
lea eax, [ebp - 0x20c]
mov dword [esi + 0x18c], 1
push eax
push dword [esi + 0x16c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [esi + 0x198]
lea ecx, [ebp - 0x20c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x42160d
test dx, dx
je 0x421609
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x42160d
add eax, 4
add ecx, 4
test dx, dx
jne 0x4215e7
xor eax, eax
jmp 0x421612
sbb eax, eax
or eax, 1
test eax, eax
jne 0x42162d
push 0x4ec354
push dword [esi + 0x16c]
mov dword [esi + 0x194], eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [esi]
mov ecx, esi
push esi
push 0x1fc
call dword [eax + 0x2c]
mov ecx, dword [ebp - 4]
xor eax, eax
mov dword [edi], 0
xor ecx, ebp
pop edi
pop esi
call fcn.0048a7ae
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4220e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push esi
mov esi, ecx
jne 0x4220f6
mov eax, dword [esi]
push 0
call dword [eax + 0x128]
push dword [ebp + 8]
mov ecx, esi
call fcn.00405cf0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xd8]
test eax, eax
mov ecx, esi
mov eax, dword [esi]
je 0x422128
push 5
call dword [eax + 0x138]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
pop ebp
ret 4
push 0
call dword [eax + 0x138]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop esi
pop ebp
ret 4

Function at 0x4225c0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
push edi
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
test edi, edi
js 0x42263c
mov esi, dword [ebp + 8]
mov ecx, 1
mov eax, dword [esi]
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or ecx, eax
jge 0x4225f5
push edi
mov ecx, esi
call fcn.004041b0
push edi
push dword [esi]
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edi, eax
mov ecx, edi
cmp edi, 0xffffffff
jne 0x42261d
mov ecx, dword [esi]
test ecx, ecx
je 0x422621
push dword [ecx - 8]
push ecx
call fcn.004aca8c
add esp, 8
mov ecx, eax
test ecx, ecx
js 0x42263c
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x42263c
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [esi]
mov word [eax + ecx*2], dx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 4
push 0x80070057
call fcn.00404660
int3