joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4610e0
Capabilities:
Create directory

Disassembly:
sub esp, 0x74
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x78]
push ebx
xor ebx, ebx
mov dword [esp + 0x14], eax
mov byte [esp + 7], bl
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
mov byte [esp + 0x6c], bl
mov byte [esp + 0x6d], bl
mov byte [esp + 0x6e], bl
mov byte [esp + 0x6f], bl
mov byte [esp + 0x70], bl
mov byte [esp + 0x71], 1
mov byte [esp + 0x64], bl
mov byte [esp + 0x65], bl
mov byte [esp + 0x66], bl
mov byte [esp + 0x67], bl
mov byte [esp + 0x68], bl
mov byte [esp + 0x69], 5
mov dword [esp + 0x18], 0xc
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
cmp eax, ebx
jne 0x461161
xor al, al
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.004c8f08
add esp, 0x74
ret
push ebp
push esi
push 0x14
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebp, eax
cmp ebp, ebx
je 0x46126a
push 1
push ebp
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x46126a
mov esi, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
lea ecx, [esp + 0x9c]
push ecx
call esi
test eax, eax
je 0x46126a
lea edx, [esp + 0x14]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [esp + 0x94]
push eax
call esi
test eax, eax
je 0x46126a
push 0x40
lea ecx, [esp + 0x30]
push ebx
push ecx
call fcn.004d1df0
mov edx, dword [esp + 0x1c]
mov ecx, 0x1f01ff
add esp, 0xc
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x4c], ecx
lea ecx, [esp + 0x18]
push ecx
mov eax, 3
mov dword [esp + 0x4c], edx
push ebx
lea edx, [esp + 0x34]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x1c]
push edx
push 2
mov dword [esp + 0x40], 1
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], 5
mov dword [esp + 0x60], 1
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], 2
mov dword [esp + 0x78], eax
call dword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x46126a
mov eax, dword [esp + 0x18]
push ebx
push eax
push 1
push ebp
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x46126a
mov dword [esp + 0x24], ebp
mov byte [esp + 0xf], 1
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x20]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp eax, ebx
je 0x46128b
push eax
call esi
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x461296
push eax
call esi
mov eax, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
cmp eax, ebx
je 0x4612a7
push eax
call esi
cmp ebp, ebx
je 0x4612ae
push ebp
call esi
mov ecx, dword [esp + 0x7c]
mov al, byte [esp + 0xf]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004c8f08
add esp, 0x74
ret
Function at 0x4612d0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x4ed688
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
push esi
push edi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
xor eax, eax
mov word [esp + 0x34], ax
mov eax, edx
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], 0
lea esi, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x461320
sub eax, esi
sar eax, 1
push eax
push edx
lea esi, [esp + 0x38]
call fcn.00401760
push 1
push 0x4fea60
mov eax, 3
mov edx, esi
mov dword [esp + 0x60], 0
call fcn.00437510
mov edi, eax
mov ebx, 8
test edi, edi
jle 0x4613db
lea ecx, [esp + 0x30]
push ecx
mov ecx, edi
xor edx, edx
lea esi, [esp + 0x18]
call fcn.00408160
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x2c], ebx
jae 0x461380
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4613a7
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x2c], ebx
jae 0x461399
lea eax, [esp + 0x18]
push eax
call fcn.004ccc58
add esp, 4
cmp eax, 0xffffffff
je 0x46140e
push 1
lea edx, [esp + 0x14]
push edx
lea eax, [edi + 1]
lea edx, [esp + 0x38]
mov dword [esp + 0x18], 0x5c
call fcn.00437510
mov edi, eax
cmp dword [esp + 0x2c], ebx
jb 0x4613d7
mov eax, dword [esp + 0x18]
push eax
call fcn.004c8f17
add esp, 4
test edi, edi
jg 0x461360
cmp dword [esp + 0x48], ebx
jb 0x4613ee
mov ecx, dword [esp + 0x34]
push ecx
call fcn.004c8f17
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.004c8f08
add esp, 0x4c
ret
cmp dword [esp + 0x2c], ebx
jb 0x461421
mov ecx, dword [esp + 0x18]
push ecx
call fcn.004c8f17
add esp, 4
xor edx, edx
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
mov word [esp + 0x18], dx
cmp dword [esp + 0x48], ebx
jb 0x46144b
mov eax, dword [esp + 0x34]
push eax
call fcn.004c8f17
add esp, 4
xor al, al
jmp 0x4613f0
Function at 0x461780
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x11c], eax
push 0x11c
lea eax, [esp + 4]
push 0
push eax
call fcn.004d1df0
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x4617d5
xor al, al
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.004c8f08
add esp, 0x120
ret
cmp dword [esp + 4], 6
mov ecx, dword [esp + 0x11c]
setb al
xor ecx, esp
call fcn.004c8f08
add esp, 0x120
ret

Function at 0x4618f0
Capabilities:
Get common file path
Move file

Disassembly:
push 0xffffffffffffffff
push 0x4ed64b
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x234], eax
push ebx
push ebp
push esi
mov eax, dword [0x52b360]
xor eax, esp
push eax
lea eax, [esp + 0x24c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x25c]
xor ebx, ebx
cmp edi, ebx
je 0x4619b1
call fcn.00461780
test al, al
je 0x4619b1
mov edx, edi
call fcn.00461aa0
test al, al
jne 0x4619b1
push 0x10
call sub.gdiplus.dll_GdipAlloc
cmp eax, ebx
je 0x4619b1
push edi
mov esi, eax
call fcn.004050f0
mov esi, eax
cmp esi, ebx
je 0x4619b1
lea eax, [esp + 0x2c]
push eax
push 0x50973c
call fcn.00461800
xor ecx, ecx
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], ebx
mov word [esp + 0x1c], cx
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x260], ebx
call fcn.00461bf0
add esp, 0xc
test al, al
jne 0x4619b8
mov eax, dword [esi]
mov edx, dword [eax]
push 1
mov ecx, esi
call edx
lea ecx, [esp + 0x10]
call fcn.004016f0
xor al, al
jmp 0x461a74
cmp word [0x5330a8], bx
jne 0x4619d1
push 0x5330a8
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x206
lea ecx, [esp + 0x42]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x48], ax
call fcn.004d1df0
add esp, 0xc
lea edx, [esp + 0x3c]
push edx
push ebx
push str.wallpaper
push 0x5330a8
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov edx, dword [esi + 4]
push ebx
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x44]
push ecx
push edx
call sub.gdiplus.dll_GdipSaveImageToFile
cmp eax, ebx
je 0x461a1e
mov dword [esi + 8], eax
jmp 0x461a20
xor eax, eax
xor bl, bl
test eax, eax
jne 0x461a5f
cmp dword [esp + 0x28], 8
mov eax, dword [esp + 0x14]
jae 0x461a35
lea eax, [esp + 0x14]
push 3
push eax
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0xffffffffffffffff
test eax, eax
push 0
lea ecx, [esp + 0x18]
push ecx
mov eax, ebp
setne bl
call fcn.00401850
mov edx, edi
call fcn.00461fa0
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
lea ecx, [esp + 0x10]
call fcn.004016f0
mov al, bl
mov ecx, dword [esp + 0x24c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x234]
xor ecx, esp
call fcn.004c8f08
add esp, 0x248
ret
Function at 0x461bf0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x208], eax
test byte [0x534b94], 1
push ebx
mov ebx, dword [esp + 0x214]
jne 0x461c45
or dword [0x534b94], 1
xor eax, eax
push 0x4f9bf0
mov dword [0x534b90], 7
mov dword [0x534b8c], 0
mov word [0x534b7c], ax
call fcn.004c9e97
add esp, 4
cmp dword [0x534b8c], 0
jne 0x461cc2
push esi
push edi
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x16]
push edx
mov word [esp + 0x18], cx
call fcn.004d1df0
add esp, 0xc
push 0
push 0x1c
lea eax, [esp + 0x14]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edi, [esp + 0xc]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x461c82
mov ecx, 0x10
mov esi, 0x509770
lea eax, [esp + 0xc]
rep movsd dword es:[edi], dword [esi]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x461ca1
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x10]
push ecx
mov esi, 0x534b78
call fcn.00401760
pop edi
pop esi
push 0xffffffffffffffff
push 0
push 0x534b78
mov eax, ebx
call fcn.00401850
mov ecx, dword [esp + 0x20c]
pop ebx
xor ecx, esp
mov al, 1
call fcn.004c8f08
add esp, 0x20c
ret

Function at 0x461dd0
Capabilities:
Set registry value

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 4]
push eax
push 0x2001f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
push Ordinal_4
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov dword [esp + 8], 1
test esi, esi
jne 0x461e20
mov edx, dword [esp + 4]
push 4
lea ecx, [esp + 0xc]
push ecx
push 4
push eax
push str.ListviewShadow
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 4]
test eax, eax
je 0x461e2f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
setne al
pop esi
add esp, 8
ret

Function at 0x461e40
Capabilities:
Set registry value

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 4]
push eax
push 0x2001f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer
push Ordinal_4
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov dword [esp + 8], 0
test esi, esi
jne 0x461e90
mov edx, dword [esp + 4]
push 4
lea ecx, [esp + 0xc]
push ecx
push 4
push eax
push str.ForceActiveDesktopOn
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 4]
test eax, eax
je 0x461e9f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
setne al
pop esi
add esp, 8
ret

Function at 0x461eb0
Capabilities:
Delete registry key

Disassembly:
push ecx
push esi
lea eax, [esp + 4]
push eax
push 0x2001f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerDesktop
push Ordinal_4
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x461eec
mov ecx, dword [esp + 4]
push str.Components
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, dword [esp + 4]
test eax, eax
je 0x461efb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
setne al
pop esi
pop ecx
ret
Function at 0x461fa0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x24
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x20], eax
xor eax, eax
mov word [esp + 8], ax
mov eax, edx
push esi
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
lea esi, [eax + 2]
jmp 0x461fd0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x461fd0
sub eax, esi
sar eax, 1
push eax
push edx
lea esi, [esp + 0x10]
call fcn.00401760
lea ecx, [esp + 4]
push ecx
push 0x2001f
push 0
push str.Control_PanelDesktop
push Ordinal_4
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x462040
cmp dword [esp + 0x20], 8
mov eax, dword [esp + 0xc]
jae 0x462023
lea eax, [esp + 0xc]
mov edx, dword [esp + 0x1c]
lea ecx, [edx + edx]
mov edx, dword [esp + 4]
push ecx
push eax
push 1
push 0
push str.ConvertedWallpaper
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 4]
test eax, eax
je 0x46204f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x20], 8
jb 0x462063
mov eax, dword [esp + 0xc]
push eax
call fcn.004c8f17
add esp, 4
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
xor ecx, esp
call fcn.004c8f08
add esp, 0x24
ret

Function at 0x462080
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x16]
mov dword [esp + 0x10], 0
push ecx
mov word [esp + 0x18], ax
call fcn.004d1df0
add esp, 0xc
lea edx, [esp + 4]
push edx
push 0x2001f
push 0
push str.Control_PanelDesktop
push Ordinal_4
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x462107
mov edx, dword [esp + 4]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push str.ConvertedWallpaper
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp + 4]
test eax, eax
je 0x462116
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], 0
mov word [esi + 4], ax
lea eax, [esp + 0xc]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x462131
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x10]
push ecx
call fcn.00401760
mov ecx, dword [esp + 0x214]
mov eax, esi
pop esi
xor ecx, esp
call fcn.004c8f08
add esp, 0x214
ret
Function at 0x462300
Capabilities:
Get file version info

Disassembly:
sub esp, 0x214
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x210], eax
mov eax, dword [esp + 0x21c]
push ebx
push ebp
mov ebp, dword [esp + 0x220]
push esi
push 0x206
xor ebx, ebx
lea edx, [esp + 0x1a]
xor ecx, ecx
push ebx
push edx
mov dword [esp + 0x18], eax
mov word [esp + 0x20], cx
call fcn.004d1df0
add esp, 0xc
push 0x104
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x18], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
jbe 0x4623c6
push edi
push esi
call fcn.004c85fa
add esp, 4
mov edi, eax
push edi
push esi
push ebx
lea eax, [esp + 0x24]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4623bc
lea eax, [edi + 6]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x462392
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 0xb]
and eax, 0xfffffffc
mov ecx, dword [eax + edi + 0xc]
add eax, edi
mov dword [ebp], ecx
mov edx, dword [eax + 8]
mov eax, dword [esp + 0x10]
mov dword [eax], edx
mov bl, 1
push edi
call fcn.004ca215
add esp, 4
pop edi
mov ecx, dword [esp + 0x21c]
pop esi
pop ebp
mov al, bl
pop ebx
xor ecx, esp
call fcn.004c8f08
add esp, 0x214
ret

Function at 0x462430
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
lea eax, [esp + 0xc]
push eax
xor ebx, ebx
push ebp
mov dword [esp + 0x14], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, ebx
jbe 0x4624a7
push edi
push esi
call fcn.004c85fa
add esp, 4
mov edi, eax
push edi
push esi
push ebx
push ebp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x46249d
lea eax, [edi + 6]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x462470
sub eax, edx
mov edx, dword [esp + 0x1c]
sar eax, 1
lea eax, [eax + eax + 0xb]
and eax, 0xfffffffc
mov ecx, dword [eax + edi + 0xc]
add eax, edi
mov eax, dword [eax + 8]
mov dword [edx], ecx
mov ecx, dword [esp + 0x20]
mov dword [ecx], eax
mov bl, 1
push edi
call fcn.004ca215
add esp, 4
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
pop ecx
ret
Function at 0x462dd0
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 0x238
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x234], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x18]
push eax
call fcn.00403c40
lea ecx, [esp + 0x18]
push ecx
push 0x462d60
call dword [sym.imp.USER32.dll_EnumWindows]
mov ebx, dword [sym.imp.USER32.dll_SystemParametersInfoW]
xor esi, esi
push esi
lea edx, [esp + 0x14]
push edx
push 8
push 0x48
mov dword [esp + 0x40], esi
mov dword [esp + 0x20], 8
call ebx
mov eax, dword [esp + 0x14]
push esi
lea ecx, [esp + 0x14]
push ecx
push 8
push 0x49
mov dword [esp + 0x44], eax
mov dword [esp + 0x24], esi
call ebx
mov ecx, dword [esp + 0x28]
mov eax, ecx
sub eax, dword [esp + 0x24]
sar eax, 2
cmp esi, eax
jae 0x462ef1
mov ebp, dword [sym.imp.USER32.dll_GetClassNameW]
mov edi, dword [sym.imp.USER32.dll_SendMessageTimeoutW]
mov edx, dword [esp + 0x24c]
mov eax, dword [esp + 0x24]
cmp dword [eax + esi*4], edx
je 0x462edd
sub ecx, eax
sar ecx, 2
cmp esi, ecx
jb 0x462e79
call fcn.004c96d9
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx + esi*4]
push 0x104
lea eax, [esp + 0x3c]
push eax
push edx
call ebp
lea eax, [esp + 0x38]
push str.TXGuiFoundation
push eax
call fcn.004cd7b7
mov ecx, dword [esp + 0x30]
add esp, 8
test eax, eax
je 0x462edd
sub ecx, dword [esp + 0x24]
sar ecx, 2
cmp esi, ecx
jb 0x462eb7
call fcn.004c96d9
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + esi*4]
lea edx, [esp + 0x30]
push edx
push 0xc8
push 1
push 0xffffffffffffffff
push 0xf020
push 0x112
push ecx
call edi
mov ecx, dword [esp + 0x28]
mov eax, ecx
sub eax, dword [esp + 0x24]
inc esi
sar eax, 2
cmp esi, eax
jb 0x462e5b
xor esi, esi
mov edx, dword [esp + 0x34]
push esi
lea eax, [esp + 0x14]
push eax
push 8
push 0x49
mov dword [esp + 0x24], edx
call ebx
mov eax, dword [esp + 0x24]
cmp eax, esi
je 0x462f16
push eax
call fcn.004c8f17
add esp, 4
mov ecx, dword [esp + 0x18]
push ecx
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
call fcn.004c8f17
mov ecx, dword [esp + 0x248]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004c8f08
add esp, 0x238
ret

Function at 0x462f50
Capabilities:
Hide graphical window
Log keystrokes

Disassembly:
test esi, esi
je 0x462fd9
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x462fd9
push ebx
push ebp
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push 0
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 1
mov ebx, eax
push edi
push ebx
call dword [sym.imp.USER32.dll_AttachThreadInput]
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x462f98
push 9
jmp 0x462f9a
push 1
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov ebp, dword [sym.imp.USER32.dll_SetWindowPos]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
call ebp
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push esi
call ebp
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push edi
push ebx
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop edi
pop ebp
pop ebx
ret
Function at 0x4633b0
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x20
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x1c], eax
cmp dword [0x5332b4], 0
jne 0x4634ac
push edi
mov edi, str.DTLWallPaperDB.dll
lea ecx, [esp + 4]
call fcn.00460ea0
mov eax, dword [esp + 8]
mov edi, 8
cmp dword [esp + 0x1c], edi
jae 0x4633ed
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x5332b4], eax
test eax, eax
je 0x463498
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InitDB
push eax
call esi
mov dword [0x532df0], eax
mov eax, dword [0x5332b4]
push str.UpdateInitParam
push eax
call esi
mov ecx, dword [0x5332b4]
push str.CloseDB
push ecx
mov dword [0x532df4], eax
call esi
mov edx, dword [0x5332b4]
push str.AddWallPaper
push edx
mov dword [0x532df8], eax
call esi
mov dword [0x532dfc], eax
mov eax, dword [0x5332b4]
push str.UpdateWallPaper
push eax
call esi
mov ecx, dword [0x5332b4]
push str.GetWallPaper
push ecx
mov dword [0x532e00], eax
call esi
mov edx, dword [0x5332b4]
push str.FreeWallPaper
push edx
mov dword [0x532e04], eax
call esi
mov dword [0x532e08], eax
mov eax, dword [0x5332b4]
push str.SetSynComID
push eax
call esi
mov dword [0x532e0c], eax
pop esi
cmp dword [esp + 0x1c], edi
pop edi
jb 0x4634ac
mov ecx, dword [esp + 4]
push ecx
call fcn.004c8f17
add esp, 4
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004c8f08
add esp, 0x20
ret
Function at 0x463d40
Capabilities:
Authenticate hmac
Encode data using xor
Hash data with md5

Disassembly:
sub esp, 0x140
mov eax, dword [0x52b360]
xor eax, esp
mov dword [esp + 0x13c], eax
mov eax, dword [esp + 0x144]
push ebx
push ebp
mov ebp, dword [esp + 0x154]
push esi
push edi
xor ebx, ebx
push 0x3f
mov edi, ecx
lea ecx, [esp + 0x8d]
push ebx
push ecx
mov dword [esp + 0x1c], eax
mov esi, edx
mov dword [esp + 0x20], ebx
mov byte [esp + 0x94], bl
call fcn.004d1df0
add esp, 0xc
cmp edi, ebx
jne 0x463d99
mov dword [esp + 0x158], ebx
cmp esi, ebx
jne 0x463eec
xor ebp, ebp
push ebp
lea ecx, [esp + 0x8c]
push esi
push ecx
call fcn.004d0a80
add esp, 0xc
xor eax, eax
jmp 0x463dc0
mov cl, byte [esp + eax + 0x88]
mov dl, cl
xor dl, 0x36
xor cl, 0x5c
mov byte [esp + eax + 0x108], dl
mov byte [esp + eax + 0xc8], cl
inc eax
cmp eax, 0x40
jb 0x463dc0
lea eax, [esp + 0x108]
push eax
mov ebp, 0x67452301
mov eax, 0x40
lea ecx, [esp + 0x1c]
mov byte [esp + 0x84], bl
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], 0xefcdab89
mov dword [esp + 0x24], 0x98badcfe
mov dword [esp + 0x28], 0x10325476
call fcn.004668a0
mov eax, dword [esp + 0x158]
push edi
lea ecx, [esp + 0x1c]
call fcn.004668a0
cmp byte [esp + 0x80], bl
jne 0x463e54
lea esi, [esp + 0x18]
mov byte [esp + 0x80], 1
call fcn.00466940
push 0x10
lea ecx, [esp + 0x74]
push ecx
lea edx, [esp + 0x90]
push 0x10
push edx
call fcn.004c9253
add esp, 0x10
lea eax, [esp + 0xc8]
push eax
mov eax, 0x40
lea ecx, [esp + 0x1c]
mov byte [esp + 0x84], bl
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], 0xefcdab89
mov dword [esp + 0x24], 0x98badcfe
mov dword [esp + 0x28], 0x10325476
call fcn.004668a0
lea ecx, [esp + 0x88]
push ecx
mov eax, 0x10
lea ecx, [esp + 0x1c]
call fcn.004668a0
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x18]
call fcn.00467210
mov ecx, dword [esp + 0x14c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004c8f08
add esp, 0x140
ret
cmp ebp, 0x40
jle 0x463da3
push esi
mov eax, ebp
lea ecx, [esp + 0x1c]
mov byte [esp + 0x84], bl
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], 0x67452301
mov dword [esp + 0x20], 0xefcdab89
mov dword [esp + 0x24], 0x98badcfe
mov dword [esp + 0x28], 0x10325476
call fcn.004668a0
cmp byte [esp + 0x80], bl
jne 0x463f4a
lea esi, [esp + 0x18]
mov byte [esp + 0x80], 1
call fcn.00466940
push 0x10
lea edx, [esp + 0x74]
push edx
lea eax, [esp + 0x90]
push 0x40
push eax
call fcn.004c9253
add esp, 0x10
jmp 0x463db5