joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412fdc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x413101
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.00412dec
mov esi, eax
mov eax, dword [0x4522c0]
cmp byte [eax], 0
je 0x4130a9
mov eax, dword [0x4520c4]
call fcn.00404510
call fcn.0040430c
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x412fb4]
call fcn.00407fbc
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x41311c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x4130e5
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x452078]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x455c40]
call fcn.00408080
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413108
lea eax, [ebp - 4]
mov edx, dword [0x412fb4]
call fcn.00407fc8
ret

Function at 0x4150c8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.004061a4
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
mov edi, eax
cmp edi, 0x104
jbe 0x415072
mov eax, edi
add eax, eax
call fcn.004041c4
mov esi, eax
jmp 0x415074
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
push edi
push esi
call sub.user32.dll_CharUpperBuffW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x4150ad
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x415097
mov eax, esp
cmp esi, eax
je 0x4150ba
mov eax, esi
call fcn.004041e0
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x4150f4
cmp bl, 0
je 0x4150f0
cmp bl, 0x41
jl 0x4150eb
cmp bl, 0x5a
jg 0x4150eb
or bl, 0x20
xor al, bl
inc esi
jmp 0x4150cf
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x415034
Function at 0x43eddc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x43ee92
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, esi
call fcn.00406830
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
jbe 0x43ee7c
lea eax, [ebp - 4]
mov edx, edi
call fcn.00406afc
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebp - 0x10]
push eax
mov eax, esi
call fcn.00406830
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x43ee7c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x43eea4
mov eax, dword [ebp - 4]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x43ee7c
cmp dword [ebp - 0xc], 0x34
jne 0x43ee7c
mov bl, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
mov esi, eax
mov edi, edx
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43ee99
lea eax, [ebp - 4]
call fcn.00406794
ret
Function at 0x440630
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x440830
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
mov edx, 0x24
call fcn.0043f4c4
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov eax, dword [ebp - 0x14]
mov dword [0x4514ac], eax
mov eax, dword [ebp - 0xc]
mov dword [0x4514b0], eax
mov eax, dword [ebp - 0x24]
mov dword [0x4514b4], eax
mov eax, dword [0x4523f0]
cmp dword [eax], 2
sete byte [0x450c5c]
push 0x44083c
call sub.kernel32.dll_GetModuleHandleW_1
lea edx, [ebp - 4]
call fcn.0043ebc8
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp byte [0x450c5c], 0
jne 0x4406bf
lea edx, [ebp - 0x5c]
mov eax, dword [ebp - 4]
call fcn.0043eddc
test al, al
je 0x4406bf
mov eax, dword [ebp - 0x4c]
mov dword [0x458520], eax
jmp 0x4406c6
xor eax, eax
mov dword [0x458520], eax
call fcn.0044030c
and eax, 0x7f
cmp eax, 0x14
ja case.0x4406d7.0
jmp dword [eax*4 + 0x4406de]
mov byte [0x450c48], 1
jmp case.0x4406d7.0
mov byte [0x450c4c], 1
jmp case.0x4406d7.0
mov byte [0x450c50], 1
jmp case.0x4406d7.0
mov byte [0x450c54], 1
jmp case.0x4406d7.0
mov byte [0x450c58], 1
jmp case.0x4406d7.0
mov byte [0x450c60], 1
mov byte [0x450c64], 1
jmp case.0x4406d7.0
mov byte [0x450c60], 1
mov byte [0x450c68], 1
jmp case.0x4406d7.0
mov byte [0x450c60], 1
mov byte [0x450c68], 1
mov byte [0x450c6c], 1
jmp case.0x4406d7.0
mov byte [0x450c70], 1
jmp case.0x4406d7.0
mov byte [0x450c74], 1
jmp case.0x4406d7.0
mov byte [0x450c78], 1
jmp case.0x4406d7.0
mov byte [0x450c7c], 1
jmp case.0x4406d7.0
mov byte [0x450c80], 1
jmp case.0x4406d7.0
mov byte [0x450c84], 1
jmp case.0x4406d7.0
mov byte [0x450c88], 1
jmp case.0x4406d7.0
mov byte [0x450c8c], 1
jmp case.0x4406d7.0
mov byte [0x450c90], 1
jmp case.0x4406d7.0
mov byte [0x450c94], 1
jmp case.0x4406d7.0
mov byte [0x450c98], 1
jmp case.0x4406d7.0
mov byte [0x450c9c], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x440837
lea eax, [ebp - 4]
call fcn.00406794
ret

Function at 0x4440dc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 0x14], edx
xor edx, edx
push ebp
push 0x444140
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 0xe]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xe]
mov ecx, 7
call fcn.0040698c
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetACP_1
mov edx, eax
pop eax
call fcn.0040eef8
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x444147
lea eax, [ebp - 0x14]
call fcn.00406794
ret
Function at 0x445378
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x44538d
add esp, 0xfffffff0
call fcn.004050ec
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 8]
xor edx, edx
mov eax, ebx
call fcn.00404bbc
lea eax, [ebx + 0xc]
mov edx, esi
call fcn.004067a4
mov eax, esi
call fcn.00406830
push eax
movzx eax, byte [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CreateMutexW
mov edi, eax
mov dword [ebx + 8], edi
test edi, edi
jne 0x4453e1
mov ecx, dword [0x452314]
mov dl, 1
mov eax, dword [0x444f4c]
call fcn.0043a458
call fcn.00405690
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
sete al
mov byte [ebx + 4], al
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x445408
call fcn.00405144
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x402540
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c7d1b
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4f80c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.CXElement.0
call fcn.00405000
mov ecx, eax
test ecx, ecx
je 0x402642
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 4], eax
mov dword [ebp - 4], 0
call fcn.00405000
mov ecx, eax
test ecx, ecx
je 0x40264c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0xc], eax
lea esi, [edi + 0x10]
mov byte [ebp - 4], 1
push 0x1c
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004989e3
xorps xmm0, xmm0
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov eax, dword fs:[0x2c]
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov ecx, dword [eax]
movq qword [edi + 0x28], xmm0
mov dword [edi + 0x28], edi
mov dword [edi + 0x24], vtable.TGeneralObserverObj_class_CXElement_.0
mov eax, dword [0x50db24]
cmp eax, dword [ecx + 4]
jg 0x402656
mov dword [edi + 0x30], 0x4f8e8c
mov eax, edi
mov dword [edi + 8], 0
mov dword [edi + 0x2c], 0x402e30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00404de0
push 0x80004005
call fcn.00404de0
push 0x50db24
call fcn.00498cfc
add esp, 4
cmp dword [0x50db24], 0xffffffff
jne 0x40261a
push 0x4d2430
mov dword [0x4f8e8c], 0x64
mov dword [0x4f8e90], 0x64
mov byte [0x4f8e94], 0
call fcn.00498c6b
push 0x50db24
call fcn.00498cab
add esp, 8
jmp 0x40261a

Function at 0x404860
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4048bb
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4048bb
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x4048aa
cmp esi, edx
jae 0x4048bb
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x404898
cmp esi, edx
jae 0x4048bb
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x40d7a0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0xec], 0
je 0x40d7f4
mov eax, dword [esi + 0xe8]
test eax, eax
je 0x40d7f4
push dword [eax + 0x38]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40d7f4
mov eax, dword [esi + 0xe8]
push edi
push 0
push dword [eax + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x38]
mov edi, dword [sym.imp.USER32.dll_GetParent]
call edi
test eax, eax
je 0x40d7f3
push dword [esi + 0x38]
call edi
push eax
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
mov eax, dword [esi + 0xe8]
test eax, eax
je 0x40d80e
mov dword [esi + 0xe8], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov eax, dword [esi + 0x64]
test eax, eax
je 0x40d82b
mov dword [esi + 0x64], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x68]
test eax, eax
je 0x40d83f
mov dword [esi + 0x68], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x6c]
test eax, eax
je 0x40d853
mov dword [esi + 0x6c], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [esi + 0x60]
test ecx, ecx
je 0x40d876
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [esi + 0x60]
test eax, eax
je 0x40d876
mov dword [esi + 0x60], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
pop esi
pop ebp
ret 0x10
Function at 0x412df0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
mov esi, ecx
mov dword [esp + 0x18], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [esp + 0x10]
mov ecx, esi
push eax
mov eax, dword [esi]
call dword [eax + 0xc8]
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [ebp + 0x14]
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
sub edx, dword [esi + 0x58]
sub ebx, dword [esi + 0x5c]
mov dword [eax], 0
mov eax, dword [esi + 0x16c]
mov ecx, dword [esi + 0x168]
sub eax, ecx
sar eax, 2
imul eax, eax, 0xba2e8ba3
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0xc], 0
test eax, eax
je 0x412eeb
xor edi, edi
push ebx
lea eax, [ecx + 8]
push edx
add eax, edi
push eax
call dword [sym.imp.USER32.dll_PtInRect]
mov ebx, dword [ebp + 0x14]
test eax, eax
je 0x412eb5
mov eax, dword [esi + 0x168]
cmp dword [edi + eax + 0x20], 0
je 0x412eb5
push 1
mov dword [ebx], 1
mov eax, dword [esi + 0x168]
push 0
push 0
push dword [edi + eax + 0x24]
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esi + 0x16c]
add edi, 0x2c
mov ecx, dword [esi + 0x168]
sub eax, ecx
mov edx, dword [esp + 0xc]
sar eax, 2
inc edx
imul eax, eax, 0xba2e8ba3
mov dword [esp + 0xc], edx
cmp edx, eax
jae 0x412ee6
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
jmp 0x412e73
cmp dword [ebx], 0
jne 0x412ef8
mov eax, dword [esi]
mov ecx, esi
push esi
push 0x384
call dword [eax + 0x28]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x422250
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x4f80c0]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
cmp eax, 0x5f7
je 0x422350
cmp eax, 0x5f8
je 0x422350
cmp eax, 0x201
jne 0x422294
mov ecx, dword [esi + 0x170]
push 2
jmp 0x4223da
cmp eax, 0x202
jne 0x4223e2
mov eax, dword [esi + 0x58]
mov ecx, dword [esi + 0x5c]
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
mov eax, dword [esi]
mov dword [esp + 0xc], ecx
mov ecx, esi
call dword [eax + 0xc8]
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [esi + 0x60]
sub eax, dword [esi + 0x58]
mov ecx, dword [esp + 4]
add eax, ecx
mov edx, dword [esp + 8]
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 0x64]
sub eax, dword [esi + 0x5c]
add eax, edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x20], eax
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [esp + 0x10]
lea eax, [esp + 0x18]
push dword [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
mov ecx, dword [esi + 0x170]
test eax, eax
mov eax, dword [ecx]
je 0x422349
push 1
call dword [eax + 0x158]
push ecx
mov ecx, esi
call fcn.00420d10
xor eax, eax
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00498d60
mov esp, ebp
pop ebp
ret 0x14
push 0
jmp 0x4223dc
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
mov dword [esp + 0xc], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esi + 0x58]
mov ecx, dword [esi + 0x5c]
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
mov eax, dword [esi]
mov dword [esp + 0x14], ecx
mov ecx, esi
call dword [eax + 0xc8]
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [esi + 0x60]
sub eax, dword [esi + 0x58]
mov ecx, dword [esp + 0xc]
add eax, ecx
mov edx, dword [esp + 0x10]
push dword [esp + 8]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x64]
sub eax, dword [esi + 0x5c]
push dword [esp + 8]
add eax, edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x28], eax
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x24], edx
call dword [sym.imp.USER32.dll_PtInRect]
mov ecx, dword [esi + 0x170]
test eax, eax
je 0x4223d8
push 1
jmp 0x4223da
push 0
mov eax, dword [ecx]
call dword [eax + 0x158]
mov ecx, dword [esp + 0x24]
xor eax, eax
pop esi
xor ecx, esp
call fcn.00498d60
mov esp, ebp
pop ebp
ret 0x14
Function at 0x423230
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c9645
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4f80c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x194], 0
je 0x4232ad
call fcn.00405000
mov ecx, eax
test ecx, ecx
je 0x423383
mov eax, dword [ecx]
call dword [eax + 0xc]
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
push 0x4dd498
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.00404960
test al, al
jne 0x423363
push 0
push 0x4dd498
mov ecx, esi
call fcn.00404c10
jmp 0x423363
call fcn.00405000
mov ecx, eax
test ecx, ecx
je 0x423383
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 1
push dword [edi + 0x16c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ebx, [eax + 1]
test ebx, ebx
js 0x423379
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, ebx
or eax, ecx
jge 0x423302
push ebx
lea ecx, [ebp - 0x10]
call fcn.00404b70
mov esi, dword [ebp - 0x10]
push ebx
push esi
push dword [edi + 0x16c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, 0xffffffff
jne 0x423321
push dword [esi - 8]
push esi
call fcn.004a52f6
add esp, 8
test eax, eax
js 0x423379
cmp eax, dword [esi - 8]
jg 0x423379
xor ecx, ecx
mov dword [esi - 0xc], eax
lea edi, [esi - 0x10]
mov word [esi + eax*2], cx
push edi
call fcn.00404710
mov esi, dword [ebp + 8]
add eax, 0x10
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov dword [esi], eax
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x423363
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00404de0
push 0x80004005
call fcn.00404de0
int3
Function at 0x424790
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c97cd
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push esi
push edi
mov eax, dword [0x4f80c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x1c]
mov ecx, 0x50d5f8
push eax
call fcn.00424e40
or ebx, 0xffffffff
mov ecx, dword [eax]
mov edi, dword [eax + 4]
cmp ecx, edi
je 0x4247fa
mov dword [ebp - 0x14], ecx
cmp dword [ecx + 0x14], esi
je 0x42487c
lea ecx, [ebp - 0x14]
call fcn.00403690
mov ecx, dword [ebp - 0x14]
cmp ecx, edi
jne 0x4247e2
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
push eax
call fcn.00404710
mov edi, eax
mov dword [ebp - 0x18], esi
add esp, 4
lea ecx, [edi + 0x10]
mov dword [ebp - 0x1c], ecx
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004250e0
mov byte [ebp - 4], 0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x42483d
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x4fcd44]
test eax, eax
je 0x424855
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x424946
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.004aef55
add esp, 4
call fcn.004aef34
mov esi, eax
call fcn.00405000
mov ecx, eax
test ecx, ecx
je 0x42497b
jmp 0x424886
mov esi, 0x80004005
jmp 0x424948
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push esi
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push str.x_GeneralNotify_lu
push eax
call fcn.0041f980
mov esi, dword [ebp - 0x14]
add esp, 0xc
mov ecx, 0x4fcd50
push esi
call fcn.004256b0
push 0x2c
lea eax, [ebp - 0x48]
mov dword [ebp - 0x4c], 0x30
push 0
push eax
call fcn.0049a960
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x24], 0x4fcd50
mov dword [ebp - 0x44], 0x424e10
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
push 0
push dword [ebp - 0x38]
push 0
push 0xfffffffffffffffd
push 0x64
push 0x64
push 0
push 0
push 0
push str.CGeneralObserverMgrWnd
push dword [ebp - 0x24]
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0
push eax
mov dword [0x4fcd44], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x424946
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x424967
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00404de0
int3
Function at 0x42ad30
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push edi
mov edi, ecx
cmp dword [edi + 0x84], eax
je 0x42ad99
mov dword [edi + 0x84], eax
push esi
mov esi, dword [edi + 0x34]
cmp esi, dword [edi + 0x38]
je 0x42ad82
mov ecx, dword [esi]
test ecx, ecx
je 0x42ad7a
cmp dword [edi + 0x84], 0
je 0x42ad6f
cmp dword [edi + 0x88], 0
je 0x42ad6f
mov edx, 1
jmp 0x42ad71
xor edx, edx
mov eax, dword [ecx]
push edx
call dword [eax + 0xd4]
add esi, 4
cmp esi, dword [edi + 0x38]
jne 0x42ad50
mov ecx, dword [edi + 0x40]
pop esi
test ecx, ecx
je 0x42ad8f
call fcn.00406880
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x134]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xd0]
mov edx, dword [edi]
mov ecx, edi
test eax, eax
je 0x42adc1
push 5
call dword [edx + 0x13c]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop edi
pop ebp
ret 4
push 0
call dword [edx + 0x13c]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop edi
pop ebp
ret 4

Function at 0x42ade0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push edi
mov edi, ecx
cmp dword [edi + 0x88], eax
je 0x42ae3d
mov dword [edi + 0x88], eax
push esi
mov esi, dword [edi + 0x34]
cmp esi, dword [edi + 0x38]
je 0x42ae32
mov ecx, dword [esi]
test ecx, ecx
je 0x42ae2a
cmp dword [edi + 0x84], 0
je 0x42ae1f
cmp dword [edi + 0x88], 0
je 0x42ae1f
mov edx, 1
jmp 0x42ae21
xor edx, edx
mov eax, dword [ecx]
push edx
call dword [eax + 0xd4]
add esi, 4
cmp esi, dword [edi + 0x38]
jne 0x42ae00
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x134]
pop esi
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xd0]
mov edx, dword [edi]
mov ecx, edi
test eax, eax
je 0x42ae65
push 5
call dword [edx + 0x13c]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop edi
pop ebp
ret 4
push 0
call dword [edx + 0x13c]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop edi
pop ebp
ret 4

Function at 0x42b730
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
call dword [eax + 0x88]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call fcn.0042ca70
mov edx, eax
test edx, edx
jne 0x42b754
mov eax, 0x80004005
pop esi
ret
mov ecx, esi
lea eax, [esi + 0x104]
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
mov ecx, edx
call fcn.0042c9b0
test eax, eax
je 0x42b779
push 0
push dword [esi + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [esi + 0x10c], 0
xor eax, eax
pop esi
ret