joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422f44
Capabilities:
Read .ini file

Disassembly:
push 0x48
mov eax, 0x4faefd
call fcn.004e336a
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov esi, dword [eax + 4]
cmp dword [eax], esi
je 0x42311e
sub esi, dword [eax]
xor edi, edi
sar esi, 3
test esi, esi
jle 0x42311e
mov eax, dword [eax]
lea ecx, [ebp - 0x2c]
lea eax, [eax + edi*8]
add eax, 4
push eax
call fcn.004028cd
and dword [ebp - 4], 0
mov eax, dword [0x542750]
mov dword [ebp - 0x28], eax
push str.cornurl.ini
push 0x547b18
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push 0x50de04
push eax
call fcn.0040301c
add esp, 0x10
push dword [ebp - 0x28]
push 0
push dword [ebp - 0x2c]
push str.cornurl
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
lea ecx, [ebp - 0x28]
setne bl
call fcn.00403030
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00403030
test bl, bl
je 0x422fec
mov eax, dword [ebp - 0x24]
inc edi
cmp edi, esi
jl 0x422f73
jmp 0x42311e
lea ecx, [ebp - 0x54]
call fcn.0041cb83
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 2
call fcn.00430217
push eax
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 3
call fcn.00402a9f
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.00403030
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x50]
shl edi, 3
mov eax, dword [esi]
add eax, edi
push eax
call fcn.00402a9f
push 0x2b0
mov dword [ebp - 0x38], 1
call fcn.004d6a5a
pop ecx
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 4
test eax, eax
je 0x423059
lea ecx, [ebp - 0x54]
push ecx
mov ecx, eax
call fcn.0042b412
jmp 0x42305b
xor eax, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x30]
mov ebx, dword [ebp - 0x30]
mov dword [ebx + 0x87a0], eax
call fcn.00430217
push ecx
push ecx
mov ecx, esp
mov byte [ebp - 4], 5
push 0x88
push 0x860a0000
xorps xmm0, xmm0
and dword [ecx], 0
mov eax, dword [eax]
push eax
push ecx
mov eax, esp
lea ecx, [ebp - 0x20]
movdqu xmmword [ebp - 0x20], xmm0
push 0
mov dword [eax], ecx
mov ecx, dword [ebx + 0x87a0]
call fcn.004231f2
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 2
call fcn.00403030
mov eax, dword [esi]
lea ecx, [ebp - 0x24]
add eax, 4
add eax, edi
push eax
call fcn.004028cd
mov eax, dword [0x542750]
mov dword [ebp - 0x28], eax
push str.cornurl.ini
push 0x547b18
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 7
push 0x50de04
push eax
call fcn.0040301c
add esp, 0x10
push dword [ebp - 0x28]
push 0x50e100
push dword [ebp - 0x24]
push str.cornurl
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x28]
call fcn.00403030
lea ecx, [ebp - 0x24]
call fcn.00403030
lea ecx, [ebp - 0x50]
call fcn.00403030
lea ecx, [ebp - 0x54]
call fcn.00403030
xor eax, eax
call fcn.004e3319
ret 4
Function at 0x423b97
Capabilities:
Get file version info

Disassembly:
push 0x14
mov eax, 0x4fafe3
call fcn.004e3337
mov dword [ebp - 0x1c], edx
mov esi, ecx
mov eax, dword [0x542750]
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], eax
push ecx
push edx
mov dword [ebp - 4], ecx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
test ebx, ebx
je 0x423c37
push ebx
call fcn.004d5f08
mov edi, eax
pop ecx
test edi, edi
je 0x423c37
push edi
push ebx
xor ebx, ebx
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x423c37
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
push 0x50f2c8
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x423c37
cmp dword [ebp - 0x14], 0x34
jne 0x423c37
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
lea eax, [ebp - 0x10]
push str._d._d._d._d
push eax
call fcn.0040301c
push edi
call fcn.004d5e39
add esp, 0x1c
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.004028cd
lea ecx, [ebp - 0x10]
call fcn.00403030
mov eax, esi
call fcn.004e3305
ret
Function at 0x424640
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x1c], 0
push esi
push edi
mov esi, ecx
jne 0x4247a5
mov eax, dword [ebp + 0xc]
cmp eax, 0x2c
jne 0x42466f
mov ecx, dword [ebp + 0x14]
call fcn.00451f32
mov eax, dword [ebp + 0x18]
and dword [eax], 0
xor eax, eax
inc eax
jmp 0x4247a7
cmp eax, 0x2b
jne 0x42467e
mov ecx, dword [ebp + 0x14]
call fcn.00451a96
jmp 0x424661
cmp eax, 0x111
jne 0x4246c5
mov eax, dword [ebp + 0x10]
movzx eax, ax
push 0
pop edi
sub eax, 0x8008
je 0x4246b1
sub eax, 3
jne 0x4246be
push edi
push dword [esi + 0x14c]
push 0x557
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x4246be
push ecx
push ecx
push dword [esi + 0x14c]
call fcn.004255ea
mov eax, dword [ebp + 0x18]
mov dword [eax], edi
jmp 0x424667
cmp eax, 0x54d
jne 0x4246e5
cmp dword [ebp + 0x10], 0
jne 0x4246d6
xor eax, eax
jmp 0x4246de
push dword [ebp + 0x10]
call fcn.00426588
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
jmp 0x424667
cmp eax, 0x54f
jne 0x4246f6
push dword [ebp + 0x10]
call fcn.0042664d
jmp 0x4246de
cmp eax, 0x54e
jne 0x424721
push 0x105
xor edi, edi
push edi
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_RedrawWindow]
push edi
push edi
push edi
push 0x425e59
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x4246be
cmp eax, 0x550
jne 0x424732
sub esp, 0x10
call fcn.0042670c
jmp 0x4246de
cmp eax, 0x552
jne 0x424750
call fcn.00421a61
push dword [0x548410]
mov ecx, esi
call fcn.004259f4
jmp 0x424661
cmp eax, 0x557
jne 0x424775
cmp dword [ebp + 0x10], 0
jle 0x424769
push dword [ebp + 0x10]
call fcn.004266a0
mov ecx, eax
jmp 0x42476b
xor ecx, ecx
mov eax, dword [ebp + 0x18]
mov dword [eax], ecx
jmp 0x424667
cmp eax, 0x558
jne 0x424789
push dword [ebp + 0x10]
call fcn.00425ae8
jmp 0x424661
push 0
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.00423c99
test eax, eax
jne 0x424667
xor eax, eax
pop edi
pop esi
pop ebp
ret 0x18
Function at 0x424c1d
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4fb0a9
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x5415b0]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov ebx, ecx
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push edi
mov dword [esp + 0x1c], edi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [ebx + 0x74]
mov esi, eax
push dword [ebx + 0x70]
mov dword [esp + 0x1c], esi
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push esi
mov dword [esp + 0x24], eax
call dword [sym.imp.GDI32.dll_SelectObject]
lea eax, [esp + 0x10]
xor edi, edi
push eax
push esi
mov dword [esp + 0x18], edi
call dword [sym.imp.gdiplus.dll_GdipCreateFromHDC]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], eax
mov dword [esp + 0x50], edi
lea ecx, [esp + 0x28]
mov eax, dword [ebx + 0x88]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
call fcn.004152bc
mov byte [esp + 0x50], 1
push dword [ebx + 0x74]
push dword [ebx + 0x70]
push edi
push edi
push dword [esp + 0x3c]
push dword [esp + 0x34]
call dword [sym.imp.gdiplus.dll_GdipFillRectangleI]
mov ecx, dword [esp + 0x24]
test eax, eax
mov dword [esp + 0x40], edi
cmovne ecx, eax
mov dword [esp + 0x3c], edi
lea eax, [ebx + 0xf4]
mov dword [esp + 0x24], ecx
push eax
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [ebx + 0x28]
mov edi, dword [ebp + 8]
jmp 0x424d7d
mov ecx, dword [esi]
test ecx, ecx
je 0x424d7a
mov eax, dword [ecx]
lea edx, [esp + 0x34]
push edx
call dword [eax + 0xc]
test eax, eax
je 0x424d7a
lea eax, [esp + 0x34]
push eax
push edi
call fcn.0043fc05
test eax, eax
je 0x424d7a
mov ecx, dword [esi]
mov eax, dword [ecx + 0x40]
cmp eax, 1
je 0x424d4a
cmp eax, 2
je 0x424d4a
cmp eax, 0x19
je 0x424d4f
mov eax, dword [ecx]
lea edx, [esp + 0x20]
push edx
call dword [eax + 0x10]
jmp 0x424d7a
cmp eax, 0x19
jne 0x424d7a
push 0
push 0x545a04
push 0x544c64
push 0
push ecx
call fcn.004f7704
add esp, 0x14
test eax, eax
je 0x424d7a
push dword [esp + 0x14]
mov edx, dword [eax]
lea ecx, [esp + 0x24]
push ecx
mov ecx, eax
call dword [edx + 0x70]
add esi, 4
cmp esi, dword [ebx + 0x2c]
jne 0x424d07
lea eax, [ebx + 0xf4]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [esp + 0x14]
push 0xcc0020
push dword [edi + 4]
push dword [edi]
push esi
push dword [edi + 0xc]
push dword [edi + 8]
push dword [edi + 4]
push dword [edi]
mov edi, dword [esp + 0x38]
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [esp + 0x1c]
call dword [sym.imp.GDI32.dll_DeleteObject]
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
push edi
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ReleaseDC]
push dword [esp + 0x2c]
call dword [sym.imp.gdiplus.dll_GdipDeleteBrush]
push dword [esp + 0x20]
call dword [sym.imp.gdiplus.dll_GdipDeleteGraphics]
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x424df8
Capabilities:
Capture screenshot

Disassembly:
push 0x20
mov eax, 0x4fb0d4
call fcn.004e3337
mov edi, ecx
cmp dword [0x547b14], 0
jne 0x424f79
cmp dword [edi + 0x70], 0
je 0x424f79
cmp dword [edi + 0x74], 0
je 0x424f79
mov eax, dword [edi + 0x2c]
sub eax, dword [edi + 0x28]
sar eax, 2
test eax, eax
je 0x424f79
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [edi + 0x74]
mov ebx, eax
push dword [edi + 0x70]
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push ebx
mov dword [ebp - 0x18], eax
call dword [sym.imp.GDI32.dll_SelectObject]
lea eax, [ebp - 0x10]
xor esi, esi
push eax
push ebx
mov dword [ebp - 0x10], esi
call dword [sym.imp.gdiplus.dll_GdipCreateFromHDC]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x2c]
mov eax, dword [edi + 0x88]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
call fcn.004152bc
mov byte [ebp - 4], 1
push dword [edi + 0x74]
push dword [edi + 0x70]
push esi
push esi
push dword [ebp - 0x28]
push dword [ebp - 0x20]
call dword [sym.imp.gdiplus.dll_GdipFillRectangleI]
mov ecx, dword [ebp - 0x1c]
test eax, eax
cmovne ecx, eax
lea eax, [edi + 0xf4]
push eax
mov dword [ebp - 0x1c], ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [edi + 0x28]
jmp 0x424f1f
mov ecx, dword [esi]
test ecx, ecx
je 0x424f1c
mov eax, dword [ecx + 0x40]
cmp eax, 1
je 0x424ef0
cmp eax, 2
je 0x424ef0
cmp eax, 0x19
je 0x424ef5
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
push edx
call dword [eax + 0x10]
jmp 0x424f1c
cmp eax, 0x19
jne 0x424f1c
push 0
push 0x545a04
push 0x544c64
push 0
push ecx
call fcn.004f7704
add esp, 0x14
test eax, eax
je 0x424f1c
mov edx, dword [eax]
lea ecx, [ebp - 0x20]
push ebx
push ecx
mov ecx, eax
call dword [edx + 0x70]
add esi, 4
cmp esi, dword [edi + 0x2c]
jne 0x424ecd
lea eax, [edi + 0xf4]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [ebp - 0x14]
xor eax, eax
push 0xcc0020
push eax
push eax
push ebx
push dword [edi + 0x74]
push dword [edi + 0x70]
push eax
push eax
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [ebp - 0x18]
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
push esi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ReleaseDC]
push dword [ebp - 0x28]
call dword [sym.imp.gdiplus.dll_GdipDeleteBrush]
push dword [ebp - 0x20]
call dword [sym.imp.gdiplus.dll_GdipDeleteGraphics]
call fcn.004e3305
ret
Function at 0x425111
Capabilities:
Create directory
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4f7c78
mov eax, dword fs:[0]
push eax
push ecx
push ecx
push esi
mov eax, dword [0x5415b0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
call fcn.004aeb1b
call fcn.004b1cab
call fcn.004303ca
xor esi, esi
test al, al
jne 0x42516a
call fcn.004b1e6e
test eax, eax
jne 0x425186
push esi
push esi
push esi
push 0x4b3f24
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x425186
mov eax, dword [0x548590]
sub eax, dword [0x54858c]
test eax, 0xfffffff8
jne 0x425186
mov ecx, 0x54858c
call fcn.004b39ba
mov eax, dword [0x542750]
mov dword [esp + 8], eax
push 0x547b18
lea eax, [esp + 0xc]
mov dword [esp + 0x1c], esi
push str._sJpgs
push eax
call fcn.0040301c
add esp, 0xc
push esi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [esp + 8]
call fcn.00403030
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4259ae
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x30], 0
jle 0x4259d6
push ebx
push edi
push 2
lea edi, [esi + 0x3c]
pop ebx
cmp dword [edi], 0
je 0x4259ce
push 0
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
add edi, 4
dec ebx
jne 0x4259bf
pop edi
pop ebx
lea eax, [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, esi
call fcn.0042fd08
push esi
call fcn.004d5e25
pop ecx
mov eax, esi
pop esi
ret 4

Function at 0x4259f4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4fb187
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x5415b0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [ebp + 8]
test edx, edx
je 0x425ad4
lea ecx, [edx + 2]
xor edi, edi
mov ax, word [edx]
add edx, 2
cmp ax, di
jne 0x425a31
sub edx, ecx
sar edx, 1
je 0x425ad4
push ecx
lea ecx, [esp + 0x14]
call fcn.004267b4
pop ecx
mov dword [esp + 0x20], edi
cmp byte [0x5483f4], 0
jne 0x425a63
call fcn.0043bb26
push dword [esp + 0x10]
call fcn.004b1fca
call fcn.004b1e6e
mov dword [esi + 0x110], eax
test eax, eax
jle 0x425a84
mov ecx, eax
call fcn.00425213
jmp 0x425a87
xor eax, eax
inc eax
push edi
push eax
push 1
mov ecx, esi
mov dword [esi + 0x114], eax
call fcn.00425394
push 1
push ecx
mov ecx, esi
call fcn.00426107
cmp byte [0x5483f4], 0
jne 0x425acb
push edi
push edi
cmp dword [esi + 0x110], edi
jne 0x425abd
push esi
push 0x4267d0
jmp 0x425ac3
push edi
push 0x425e59
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [esp + 0x10]
call fcn.00403030
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x427be9
Capabilities:
Create thread

Disassembly:
call fcn.00430272
test al, al
jne 0x427c22
call fcn.0043031e
test al, al
jne 0x427c22
push dword [0x547b10]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x427c22
xor eax, eax
push eax
push eax
push dword [0x547b10]
push fcn.00427c4a
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret

Function at 0x427fa2
Capabilities:
Create directory

Disassembly:
push 0x11c
mov eax, 0x4fb574
call fcn.004e336a
mov esi, edx
mov dword [ebp - 0x11c], esi
mov eax, ecx
mov dword [ebp - 0x120], eax
xor ebx, ebx
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], ebx
mov eax, dword [0x542750]
mov dword [ebp - 0x118], eax
push 0x547b18
lea eax, [ebp - 0x118]
mov dword [ebp - 4], 1
push str._sAVATAR
push eax
call fcn.0040301c
add esp, 0xc
push ebx
push dword [ebp - 0x118]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x103
lea eax, [ebp - 0x113]
mov byte [ebp - 0x114], bl
push ebx
push eax
call fcn.004db6f0
add esp, 0xc
test esi, esi
je 0x428043
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x42802b
sub ecx, edx
sar ecx, 1
inc ecx
cmp ecx, 0x3fffffff
jle 0x428047
mov edi, ebx
jmp 0x428065
lea esi, [ecx + ecx]
mov eax, esi
call fcn.004dfec0
mov ecx, esp
push 3
push esi
mov esi, dword [ebp - 0x11c]
mov edx, esi
call fcn.00404eea
mov edi, eax
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x428068
sub edi, ecx
test esi, esi
je 0x428094
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x42807a
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x428098
mov eax, ebx
jmp 0x4280b1
add esi, esi
mov eax, esi
call fcn.004dfec0
mov edx, dword [ebp - 0x11c]
mov ecx, esp
push 3
push esi
call fcn.00404eea
lea ecx, [ebp - 0x114]
mov edx, edi
push ecx
mov ecx, eax
call fcn.00404d57
mov edi, dword [ebp - 0x120]
mov eax, dword [0x542750]
pop ecx
mov dword [edi], eax
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x124], 1
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4280e2
sub ecx, edx
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jg 0x428110
lea eax, [esi + esi]
call fcn.004dfec0
mov ecx, esp
lea edx, [ebp - 0x114]
push 3
push esi
call fcn.00404c22
mov ebx, eax
push ebx
push dword [ebp - 0x118]
push str._s_s.jpg
push edi
call fcn.0040301c
add esp, 0x10
lea ecx, [ebp - 0x118]
call fcn.00403030
mov eax, edi
lea esp, [ebp - 0x138]
call fcn.004e3319
ret

Function at 0x42813e
Capabilities:
Check if file exists

Disassembly:
push 8
mov eax, 0x4fb5a4
call fcn.004e3337
mov edi, edx
mov esi, ecx
and dword [ebp - 0x14], 0
lea ecx, [ebp - 0x10]
call fcn.00427fa2
and dword [ebp - 4], 0
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x428178
mov ecx, esi
lea eax, [ebp - 0x10]
push eax
call fcn.004028cd
jmp 0x42819a
push 0x2710
push dword [ebp - 0x10]
push edi
call dword [sym.imp.Http.dll_public:_static_bool___cdecl_NetTool::DownloadURL_wchar_t_const___wchar_t_const___long_int_]
add esp, 0xc
mov ecx, esi
test al, al
jne 0x42816d
push 0x50e6f0
call fcn.00404e83
lea ecx, [ebp - 0x10]
call fcn.00403030
mov eax, esi
call fcn.004e3305
ret
Function at 0x42943c
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4fb73b
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x5415b0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [0x547b14], 0
jne 0x4295e1
cmp dword [edi + 0x70], 0
je 0x4295e1
cmp dword [edi + 0x74], 0
je 0x4295e1
mov eax, dword [edi + 0x2c]
sub eax, dword [edi + 0x28]
sar eax, 2
test eax, eax
je 0x4295e1
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push esi
mov dword [esp + 0x1c], esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [edi + 0x74]
mov ebx, eax
push dword [edi + 0x70]
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push ebx
mov dword [esp + 0x24], eax
call dword [sym.imp.GDI32.dll_SelectObject]
lea eax, [esp + 0x14]
xor esi, esi
push eax
push ebx
mov dword [esp + 0x1c], esi
call dword [sym.imp.gdiplus.dll_GdipCreateFromHDC]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov dword [esp + 0x40], esi
lea ecx, [esp + 0x28]
mov eax, dword [edi + 0x88]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
call fcn.004152bc
mov byte [esp + 0x40], 1
push dword [edi + 0x74]
push dword [edi + 0x70]
push esi
push esi
push dword [esp + 0x3c]
push dword [esp + 0x34]
call dword [sym.imp.gdiplus.dll_GdipFillRectangleI]
mov ecx, dword [esp + 0x24]
test eax, eax
mov esi, dword [edi + 0x28]
cmovne ecx, eax
mov dword [esp + 0x24], ecx
jmp 0x429589
mov ecx, dword [esi]
test ecx, ecx
je 0x429586
mov eax, dword [ecx + 0x40]
cmp eax, 1
je 0x429558
cmp eax, 2
je 0x429558
cmp eax, 0x21
je 0x42955d
mov eax, dword [ecx]
lea edx, [esp + 0x20]
push edx
call dword [eax + 0x10]
jmp 0x429586
cmp eax, 0x21
jne 0x429586
push 0
push 0x544c7c
push 0x544c64
push 0
push ecx
call fcn.004f7704
add esp, 0x14
test eax, eax
je 0x429586
push ecx
push ebx
lea ecx, [esp + 0x28]
push ecx
mov ecx, eax
call fcn.004146d5
add esi, 4
cmp esi, dword [edi + 0x2c]
jne 0x429534
mov eax, dword [ebp + 8]
mov esi, dword [esp + 0x18]
push 0xcc0020
push dword [eax + 4]
push dword [eax]
push ebx
push dword [eax + 0xc]
push dword [eax + 8]
push dword [eax + 4]
push dword [eax]
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [esp + 0x1c]
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
push esi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ReleaseDC]
push dword [esp + 0x2c]
call dword [sym.imp.gdiplus.dll_GdipDeleteBrush]
push dword [esp + 0x20]
call dword [sym.imp.gdiplus.dll_GdipDeleteGraphics]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42c06e
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [esi + 0x24]
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [esi + 0x148]
call fcn.004382b1
mov ecx, esi
call fcn.00447765
xor eax, eax
pop esi
ret 0x10

Function at 0x42d233
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x1c], 0
jne 0x42d270
cmp dword [ebp + 0xc], 8
push 0
jne 0x42d258
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 0x18]
and dword [eax], 0
xor eax, eax
inc eax
jmp 0x42d272
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00423c99
test eax, eax
jne 0x42d253
xor eax, eax
pop ebp
ret 0x18

Function at 0x42d2ac
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
ret 0x10

Function at 0x42daaf
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x5415b0]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
lea eax, [esp + 8]
mov esi, ecx
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetParent]
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [esi + 0x28]
cmp eax, dword [esi + 0x2c]
je 0x42db82
mov ecx, eax
mov eax, dword [ecx + 0x24]
sub eax, dword [ecx + 0x1c]
test eax, eax
jle 0x42db82
push dword [esp + 0xc]
lea eax, [ecx + 0x1c]
push dword [esp + 0xc]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x42db82
lea eax, [esp + 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [esp + 8]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ScreenToClient]
lea eax, [esp + 0x14]
xorps xmm0, xmm0
push eax
push dword [esi + 4]
movdqu xmmword [esp + 0x1c], xmm0
call dword [sym.imp.USER32.dll_GetClientRect]
push dword [esp + 0xc]
lea eax, [esp + 0x18]
push dword [esp + 0xc]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
neg eax
sbb eax, eax
inc eax
je 0x42db82
cmp dword [esi + 0x44], 0
jne 0x42db9a
push 0
push 0x3e8
push 0x260
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [esi + 0x44], eax
jmp 0x42db9a
cmp dword [esi + 0x44], 0
je 0x42db9a
and dword [esi + 0x44], 0
push 0x260
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, dword [esp + 0x24]
pop esi
xor ecx, esp
call fcn.004d5e2a
mov esp, ebp
pop ebp
ret