joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412490
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4124a9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4124e4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4124e0
lea ebx, [ebx]
cmp esi, eax
jae 0x4124e4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4124d0
cmp esi, eax
jb 0x4124ea
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x4175f0
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x46f299
mov eax, dword fs:[0]
push eax
push ecx
push ebp
push esi
push edi
mov eax, dword [0x492bec]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebp, ecx
mov dword [esp + 0x10], 0
mov eax, dword [ebp + 0xc]
push eax
mov dword [esp + 0x20], 0
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov edx, dword [0x493fc0]
mov esi, eax
mov eax, dword [edx + 0xc]
mov ecx, 0x493fc0
call eax
mov edi, dword [esp + 0x24]
add eax, 0x10
mov dword [edi], eax
mov ecx, 1
mov dword [esp + 0x10], ecx
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, esi
or eax, ecx
mov dword [esp + 0x1c], 0
jge 0x417670
push esi
mov ecx, edi
call fcn.00412b20
mov eax, dword [edi]
test esi, esi
jl 0x4176d0
cmp esi, dword [eax - 8]
jg 0x4176d0
mov dword [eax - 0xc], esi
mov ecx, dword [edi]
mov byte [esi + ecx], 0
mov edx, dword [ebp + 0xc]
inc esi
push esi
push eax
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test eax, eax
je 0x4176a9
push ecx
push eax
call dword [sym.imp.MSVCR90.dll_strnlen]
add esp, 8
test eax, eax
jl 0x4176d0
mov ecx, dword [edi]
cmp eax, dword [ecx - 8]
jg 0x4176d0
mov dword [ecx - 0xc], eax
mov ecx, dword [edi]
mov byte [eax + ecx], 0
mov eax, edi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret 4
push 0x80070057
call fcn.0040c870
int3

Function at 0x4178f0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x46f01e
mov eax, dword fs:[0]
push eax
push ecx
push ebp
push esi
push edi
mov eax, dword [0x492bec]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
call fcn.00422d40
mov dword [esi], vtable.dsSkinBase.0
mov eax, dword [0x493fc0]
mov edx, dword [eax + 0xc]
xor edi, edi
mov ecx, 0x493fc0
mov dword [esp + 0x1c], edi
lea ebp, [esi + 0x18]
call edx
add eax, 0x10
mov dword [ebp], eax
mov eax, dword [0x493fc0]
mov edx, dword [eax + 0xc]
mov ecx, 0x493fc0
mov byte [esp + 0x1c], 1
call edx
add eax, 0x10
mov dword [esi + 0x2c], eax
push edi
push 0x47ee18
mov ecx, ebp
mov byte [esp + 0x24], 2
mov dword [esi + 0x14], edi
call fcn.00412c00
mov eax, SysReAllocString
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
lea eax, [esi + 0x48]
push eax
mov dword [esi + 0x20], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x24], 1
mov dword [esi + 0x28], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], 0x64
mov dword [esi + 0x44], edi
call dword [sym.imp.USER32.dll_SetRectEmpty]
mov dword [esi + 0x58], edi
mov dword [esi + 0x8c], edi
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret
Function at 0x417b30
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x424
mov eax, dword [0x492bec]
xor eax, esp
mov dword [esp + 0x420], eax
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
test eax, eax
je 0x417cbf
lea ecx, [eax + 0x4c]
mov dword [esi + 0x1c], ecx
mov eax, dword [eax + 0xc]
test eax, eax
je 0x417cbf
push ebx
push ebp
push edi
add eax, 0x1c
lea edi, [esi + 0x2c]
push eax
mov ecx, edi
call fcn.00414500
mov eax, dword [edi]
push 0x47622c
push eax
call dword [sym.imp.MSVCR90.dll__mbsicmp]
add esp, 8
test eax, eax
jne 0x417bc4
push 0x3ff
push eax
lea edx, [esp + 0x39]
push edx
mov byte [esp + 0x3c], al
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x400
lea eax, [esp + 0x34]
push eax
mov ecx, esi
call fcn.00422e20
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [esp + 0x30]
push ecx
mov ecx, edi
call fcn.00413720
mov edx, dword [edi]
cmp dword [edx - 0xc], 0
je 0x417bd3
mov ecx, esi
call fcn.004170c0
mov eax, dword [esi + 0x14]
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + 0x2c]
mov ebp, dword [eax + 0x30]
cmp ebx, 0x7fffffff
jne 0x417bef
cmp ebp, ebx
je 0x417ca5
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.00422e60
push eax
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.USER32.dll_CopyRect]
mov eax, dword [esi + 0x24]
cmp eax, 0x64
je 0x417c30
cmp eax, 0x65
je 0x417c30
lea eax, [esp + 0x10]
push eax
mov ecx, esi
call fcn.00422e20
push eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.004231d0
add esp, 8
mov edi, dword [esp + 0x10]
cmp ebx, 0x7fffffff
je 0x417c45
lea ecx, [edi + ebx]
mov dword [esp + 0x18], ecx
jmp 0x417c49
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
cmp ebp, 0x7fffffff
je 0x417c5e
lea eax, [edx + ebp]
mov dword [esp + 0x1c], eax
jmp 0x417c62
mov eax, dword [esp + 0x1c]
mov ebx, dword [esi + 0x24]
cmp ebx, 0x64
je 0x417c89
cmp ebx, 0x65
je 0x417c89
push 1
sub eax, edx
push eax
sub ecx, edi
push ecx
push edx
push edi
mov ecx, esi
call fcn.00422e20
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
jmp 0x417ca5
push 2
sub eax, edx
push eax
sub ecx, edi
push ecx
push 0
push 0
push 0xfffffffffffffffe
mov ecx, esi
call fcn.00422e20
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, esi
call fcn.00416f90
mov ecx, esi
call fcn.00422e20
mov ecx, dword [esi + 0x1c]
push eax
call fcn.00438f60
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x424]
pop esi
xor ecx, esp
call fcn.0046d6fc
add esp, 0x424
ret
Function at 0x419770
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x46f10b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x492bec]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [0x493fc0]
mov edx, dword [eax + 0xc]
mov ecx, 0x493fc0
call edx
add eax, 0x10
mov dword [esi + 0x28], eax
push fcn.0041df50
push 0x4141c0
push 0x13
push 4
lea eax, [esi + 0x3c]
xor edi, edi
push eax
mov dword [esp + 0x2c], edi
call fcn.0046d820
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0xc], 0xa
mov dword [esi + 0x10], 6
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], 8
mov dword [esi + 0x8c], 2
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x24], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x41d970
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
sar ecx, 2
test ecx, ecx
jle 0x41d999
mov edx, dword [esp + 0xc]
push esi
mov esi, dword [eax]
xor esi, edx
xor esi, 0x56795679
dec ecx
mov dword [eax], esi
add eax, 4
test ecx, ecx
jne 0x41d984
pop esi
ret 0xc
Function at 0x421dd0
Capabilities:
Check if file exists
Get file attributes
Get file size
Read file on windows

Disassembly:
sub esp, 8
mov edx, dword [esp + 0xc]
push ebx
push esi
mov ebx, ecx
push edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0
lea edi, [ebx + 0x14]
test edx, edx
jne 0x421df3
xor eax, eax
jmp 0x421e01
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x421df8
sub eax, esi
push eax
push edx
mov ecx, edi
call fcn.00412c00
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x421f0b
test al, 0x10
jne 0x421f0b
mov eax, dword [edi]
push 0
push 0
push 3
push 0
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x421e70
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [edi]
push eax
push str.open_file__s_failed__GetLastError_is__d
add ebx, 0x1c
push ebx
call fcn.0041e810
push 0x6f
call fcn.00416dc0
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret 4
push ebp
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
push ebx
call sub.mfc90.dll_Ordinal_265
add esp, 4
push 0
lea ecx, [esp + 0x14]
push ecx
push ebx
mov ebp, eax
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x421ee0
cmp ebx, dword [esp + 0x10]
jne 0x421ee0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push edx
push ebp
call fcn.004219d0
test eax, eax
jne 0x421ed1
push 0x6e
call fcn.00416dc0
add esp, 4
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret 4
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 8
ret 4
mov eax, dword [edi]
mov ecx, dword [esp + 0x14]
push eax
add ecx, 0x1c
push str.read_all_file_failed__s
push ecx
call fcn.0041e810
push 0x6f
call fcn.00416dc0
add esp, 0x10
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret 4
mov edx, dword [edi]
push edx
push str.the_file_for_unpack__s_is_not_valid
add ebx, 0x1c
push ebx
call fcn.0041e810
push 0x6f
call fcn.00416dc0
add esp, 0x10
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret 4
Function at 0x4227b0
Capabilities:
Link many functions at runtime

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
mov esi, ecx
push edi
xor ebx, ebx
push str.Msimg32.dll
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 0x2c], ebx
mov dword [esp + 0x14], 1
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x38], eax
cmp eax, ebx
je 0x4227fd
push str.AlphaBlend
push eax
call edi
mov dword [esi], eax
mov eax, dword [esi + 0x38]
push str.GradientFill
push eax
call edi
mov dword [esi + 4], eax
jmp 0x422810
push 0x67
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.00416dc0
add esp, 4
mov dword [esp + 0x10], ebx
push str.ComCtl32.dll
call ebp
mov dword [esi + 0x3c], eax
cmp eax, ebx
je 0x422855
push 0x476b1c
push eax
call edi
mov ecx, dword [esi + 0x3c]
push 0x476b08
push ecx
mov dword [esi + 8], eax
call edi
mov edx, dword [esi + 0x3c]
push str.CreateToolbarEx
push edx
mov dword [esi + 0xc], eax
call edi
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x3c]
push str.ImageList_Draw
push eax
call edi
mov dword [esi + 0x28], eax
jmp 0x42286f
push 0x6a
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x28], ebx
call fcn.00416dc0
add esp, 4
mov dword [esp + 0x10], ebx
push str.UxTheme.dll
call ebp
mov dword [esi + 0x44], eax
cmp eax, ebx
je 0x42288a
push str.IsThemeActive
push eax
call edi
mov dword [esi + 0x34], eax
jmp 0x422890
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x34], ebx
push str.User32.dll
call ebp
mov dword [esi + 0x40], eax
cmp eax, ebx
je 0x4228eb
push 0x476aa4
push eax
call edi
mov ecx, dword [esi + 0x40]
push 0x476a94
push ecx
mov dword [esi + 0x20], eax
call edi
mov edx, dword [esi + 0x40]
push str.MonitorFromRect
push edx
mov dword [esi + 0x14], eax
call edi
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x40]
push 0x476a70
push eax
call edi
mov ecx, dword [esi + 0x40]
push str.UpdateLayeredWindow
push ecx
mov dword [esi + 0x1c], eax
call edi
pop edi
mov dword [esi + 0x24], eax
mov eax, dword [esp + 0xc]
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x10]
pop edi
mov dword [esi + 0x20], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x24], ebx
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x42fb20
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x10
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
je 0x42fb67
mov ecx, dword [esi + 0xc]
lea eax, [esp + 4]
push eax
push 0
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esi + 0x14]
lea edx, [esp + 0x1c]
push edx
add ecx, 0x4c
call fcn.00438700
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x18]
push eax
push ecx
mov ecx, dword [esi + 0x14]
add ecx, 0x4c
call fcn.00438800
pop esi
add esp, 0x10
ret 0x18

Function at 0x42fb70
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x30
push ebx
push ebp
mov ebp, dword [esp + 0x3c]
push esi
mov esi, ecx
cmp dword [esi + 0x94], 0
push edi
je 0x42fba0
call fcn.00422e20
push eax
mov ecx, esi
call fcn.00422e20
push eax
push ebp
lea ecx, [esi + 0x90]
call fcn.00443b10
mov eax, dword [esi + 0x14]
mov edi, dword [esp + 0x48]
test eax, eax
je 0x42fbb4
push edi
lea ecx, [eax + 0x4c]
call fcn.00438700
mov ecx, dword [edi]
mov edx, dword [edi + 4]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [edi + 8]
mov dword [eax + 4], edx
mov edx, dword [edi + 0xc]
mov dword [eax + 8], ecx
push ebp
mov ecx, esi
mov dword [eax + 0xc], edx
call fcn.0042f9f0
mov ecx, esi
call fcn.00422e80
mov ebx, eax
lea eax, [esp + 0x30]
push eax
mov ecx, esi
call fcn.00422e40
push eax
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.USER32.dll_CopyRect]
lea edx, [esp + 0x20]
push edx
push 0
push 0x419
mov ecx, esi
call fcn.00422e20
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
sub esp, 0x10
mov eax, esp
push ebp
test bl, 2
je 0x42fc40
mov edi, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
add edi, 7
xor ebx, ebx
sub ecx, dword [esp + 0x24]
mov dword [eax], ebx
mov edx, 8
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edi
jmp 0x42fc61
mov ecx, dword [esp + 0x30]
sub ecx, dword [esp + 0x28]
mov ebx, dword [esp + 0x34]
xor edx, edx
mov edi, 8
mov dword [eax], edi
add ebx, 7
mov dword [eax + 4], edx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ecx
mov ecx, esi
call fcn.0042f9c0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x30
ret 0xc

Function at 0x431670
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
push esi
mov esi, dword [esp + 0x30]
xor eax, eax
cmp esi, eax
mov dword [esp + 4], 0x61
mov dword [esp + 8], 0x11
mov dword [esp + 0xc], 0x33
mov dword [esp + 0x10], 0x75
mov dword [esp + 0x14], 0x25
mov dword [esp + 0x18], 0x68
mov dword [esp + 0x1c], 0xd1
mov dword [esp + 0x20], 0x12
mov dword [esp + 0x24], eax
jle 0x4316d7
mov ecx, dword [esp + 0x2c]
mov edx, eax
and edx, 7
mov dl, byte [esp + edx*4 + 4]
xor byte [eax + ecx], dl
inc eax
cmp eax, esi
jl 0x4316c6
pop esi
add esp, 0x24
ret
Function at 0x432290
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, 8
jne 0x4322a8
xor edi, edi
jmp 0x4322ba
cmp ebx, 9
jne 0x4322b2
lea edi, [ebx - 8]
jmp 0x4322ba
cmp ebx, 0x14
jne 0x4322ba
lea edi, [ebx - 0x12]
mov eax, dword [esi + 0x134]
cmp eax, 0xffffffff
je 0x4322ea
cmp eax, edi
je 0x4322ea
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x4322e5
mov dword [esi + 0x134], 0xffffffff
or edi, 0xffffffff
jmp 0x4322ef
cmp edi, 0xffffffff
jne 0x432303
mov eax, dword [esp + 0x24]
mov edx, dword [esi]
mov edx, dword [edx + 8]
push eax
push ebx
push 0xa0
mov ecx, esi
call edx
push edi
mov ecx, esi
call fcn.00431950
call fcn.00431d60
test eax, eax
je 0x432319
call fcn.00432210
cmp dword [esi + 0x200], 0
jne 0x43235b
mov eax, dword [esi + 0xc]
mov dword [esi + 0x200], 1
mov dword [esp + 0x14], eax
mov eax, dword [0x49362c]
mov dword [esp + 0xc], 0x10
mov dword [esp + 0x10], 0x12
mov dword [esp + 0x18], 0xffffffff
test eax, eax
je 0x43235b
lea ecx, [esp + 0xc]
push ecx
call eax
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret 8
Function at 0x432c70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xd4
mov eax, dword [0x492bec]
xor eax, esp
mov dword [esp + 0xd0], eax
mov eax, dword [esp + 0xd8]
push ebx
push esi
mov esi, dword [esp + 0xe4]
push edi
mov edi, ecx
xor ebx, ebx
mov dword [esp + 0xc], esi
mov dword [edi + 0xac], esi
mov dword [edi + 0xb4], eax
cmp esi, ebx
je 0x432e32
mov ecx, dword [0x493630]
cmp ecx, ebx
je 0x432e92
push ebp
push 0x14
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x4c4
push 0x50001040
push eax
call ecx
push esi
mov dword [edi + 0xb0], eax
call dword [sym.imp.USER32.dll_GetMenuItemCount]
mov ebp, eax
push 0x64
lea eax, [esp + 0x80]
push ebx
push eax
mov dword [esp + 0x20], ebp
call sub.MSVCR90.dll_memset
add esp, 0xc
xor esi, esi
cmp ebp, ebx
jle 0x432e31
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
mov edi, edi
push 0x30
lea ecx, [esp + 0x3c]
push ebx
push ecx
call sub.MSVCR90.dll_memset
mov ecx, dword [esp + 0x1c]
add esp, 0xc
lea eax, [esp + 0x38]
push eax
push 1
push esi
lea edx, [esp + 0x88]
push ecx
mov dword [esp + 0x48], 0x30
mov dword [esp + 0x4c], 0x15
mov dword [esp + 0x50], ebx
mov dword [esp + 0x6c], edx
mov dword [esp + 0x70], 0x64
call dword [sym.imp.USER32.dll_GetMenuItemInfoA]
lea edx, [esp + 0x7c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x63
jle 0x432d89
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x38]
push eax
push 1
push esi
push ecx
mov dword [esp + 0x50], 4
call dword [sym.imp.USER32.dll_SetMenuItemInfoA]
mov byte [esp + 0x7c], bl
xor eax, eax
lea edx, [esp + 0x68]
push edx
mov dword [esp + 0x74], eax
push 0xffffffffffffffff
mov dword [esp + 0x74], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], eax
mov eax, dword [edi + 0xb0]
push 0x415
push eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], esi
mov byte [esp + 0x80], 4
mov byte [esp + 0x81], 0x10
mov dword [esp + 0x84], ebx
mov dword [esp + 0x88], ebx
call ebp
xor eax, eax
lea edx, [esp + 0x18]
push edx
push esi
mov dword [esp + 0x24], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x3c], eax
mov eax, dword [edi + 0xb0]
push 0x442
lea ecx, [esp + 0x88]
push eax
mov dword [esp + 0x28], 0x20
mov dword [esp + 0x2c], 2
mov dword [esp + 0x40], ecx
call ebp
inc esi
cmp esi, dword [esp + 0x14]
jl 0x432d10
pop ebp
mov eax, dword [edi + 0xb0]
cmp eax, ebx
je 0x432e73
mov edx, dword [edi]
push ebx
push 1
push ebx
push eax
mov eax, dword [edx + 0x24]
mov ecx, edi
call eax
mov esi, dword [edi + 0xb0]
push str.2008_dskin_set_this_hwnd_no_skin
push esi
call dword [sym.imp.USER32.dll_GetPropA]
test eax, eax
jne 0x432e73
push esi
push str.2008_dskin_set_this_hwnd_no_skin
push esi
call dword [sym.imp.USER32.dll_SetPropA]
mov dword [edi + 0xc8], esi
mov eax, 1
mov ecx, dword [esp + 0xdc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0046d6fc
add esp, 0xd4
ret 8
push 0x6b
call fcn.00416dc0
add esp, 4
xor eax, eax
jmp 0x432e78
Function at 0x433920
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4706a6
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x492bec]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.dsImage.0
mov dword [esp + 0x14], 1
call fcn.004338b0
mov eax, dword [esi + 0x30]
sub eax, 0x10
mov byte [esp + 0x14], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43397f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi + 4]
sub eax, 0x10
mov dword [esp + 0x14], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4339a6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x433a30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4706e6
mov eax, dword fs:[0]
push eax
push ecx
push ebp
push esi
push edi
mov eax, dword [0x492bec]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov dword [esi], vtable.dsImage.0
mov eax, dword [0x493fc0]
mov edx, dword [eax + 0xc]
mov ecx, 0x493fc0
lea ebp, [esi + 4]
call edx
add eax, 0x10
mov dword [ebp], eax
mov eax, dword [0x493fc0]
mov edx, dword [eax + 0xc]
xor edi, edi
mov ecx, 0x493fc0
mov dword [esp + 0x1c], edi
call edx
add eax, 0x10
mov dword [esi + 0x30], eax
push edi
push 0x47ee18
mov ecx, ebp
mov byte [esp + 0x24], 1
mov dword [esi + 0xc], edi
call fcn.00412c00
mov dword [esi + 8], 0xffffffff
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], 1
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret
Function at 0x436820
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x470901
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x492bec]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov dword [esi], vtable.dsWidgetTabItem.0
mov eax, dword [0x493fc0]
mov edx, dword [eax + 0xc]
mov ecx, 0x493fc0
lea edi, [esi + 8]
call edx
add eax, 0x10
mov dword [edi], eax
mov eax, dword [0x493fc0]
mov edx, dword [eax + 0xc]
xor ebx, ebx
mov ecx, 0x493fc0
mov dword [esp + 0x20], ebx
lea ebp, [esi + 0xc]
call edx
add eax, 0x10
mov dword [ebp], eax
mov eax, dword [0x493fc0]
mov edx, dword [eax + 0xc]
mov ecx, 0x493fc0
mov byte [esp + 0x20], 1
call edx
add eax, 0x10
mov dword [esi + 0x10], eax
push ebx
push 0x47ee18
mov ecx, edi
mov byte [esp + 0x28], 2
call fcn.00412c00
push ebx
push 0x47ee18
mov ecx, ebp
call fcn.00412c00
xor eax, eax
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0x38], eax
mov byte [esi + 0x34], bl
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], 1
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4