joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4550e0
Capabilities:
Get graphical window text
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x288
mov eax, dword [0x4da6bc]
xor eax, esp
mov dword [esp + 0x284], eax
mov ecx, dword [esp + 0x28c]
push ebx
mov ebx, dword [esp + 0x29c]
push esi
xor esi, esi
mov eax, 1
push edi
mov edi, dword [esp + 0x2a8]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
push 0x100
lea eax, [esp + 0x94]
mov edx, 8
push eax
push ecx
mov dword [esp + 0x70], esi
mov dword [esp + 0x74], esi
mov dword [esp + 0x78], 0xfde9
mov dword [esp + 0x7c], 0xffffffff
mov dword [esp + 0x80], 0xfffffffe
mov dword [esp + 0x84], esi
mov dword [esp + 0x88], esi
mov dword [esp + 0x8c], esi
mov dword [esp + 0x90], esi
mov dword [esp + 0x94], esi
mov dword [esp + 0x98], esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], esi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], esi
mov dword [esp + 0x5c], 2
mov dword [esp + 0x60], 4
mov dword [esp + 0x64], edx
mov dword [esp + 0x68], 4
mov dword [esp + 0x6c], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [esp + 0x29c]
cmp eax, 0xa
ja case.default.0x4551f4
movzx ecx, byte [eax + 0x4552c8]
jmp dword [ecx*4 + 0x4552bc]
mov edx, dword [esp + 0x2a0]
push edx
push edi
lea eax, [esp + 0x98]
push ebx
push eax
call fcn.00454d30
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x284]
xor ecx, esp
call fcn.0049e9d2
add esp, 0x288
ret
mov ecx, dword [esp + 0x2a0]
mov edx, dword [esp + eax*4 + 0x64]
push ecx
push edx
push edi
lea eax, [esp + 0x9c]
push ebx
push eax
call fcn.00454fc0
add esp, 0x14
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x284]
xor ecx, esp
call fcn.0049e9d2
add esp, 0x288
ret
mov ecx, dword [esp + 0x2a0]
mov edx, dword [esp + eax*4 + 0xc]
mov eax, dword [esp + eax*4 + 0x38]
push ecx
push edx
push eax
push edi
lea ecx, [esp + 0xa0]
push ebx
push ecx
call fcn.00454e10
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x284]
xor ecx, esp
call fcn.0049e9d2
add esp, 0x288
ret
mov ecx, dword [esp + 0x290]
mov dword [edi], esi
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.0049e9d2
add esp, 0x288
ret

Function at 0x456c70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov esi, edi
sar esi, 5
inc esi
cmp edi, esi
mov ebp, edi
jl 0x456cb8
mov eax, dword [esp + 0x10]
push ebx
lea ebx, [eax + edi*2 - 2]
lea esp, [esp]
movzx ecx, word [ebx]
push ecx
call fcn.004a09c7
mov edx, edi
shl edx, 5
mov ecx, edi
add eax, edx
shr ecx, 2
add eax, ecx
xor edi, eax
lea eax, [esi + esi]
sub ebp, esi
add esp, 4
sub ebx, eax
cmp ebp, esi
jge 0x456c90
pop ebx
mov eax, edi
pop edi
pop esi
and eax, 0x1f
pop ebp
ret 8
Function at 0x458475
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2c8
mov eax, dword [0x4da6bc]
xor eax, esp
mov dword [esp + 0x2c4], eax
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x68]
cmp eax, 0xffffffff
jne 0x458491
mov eax, dword [esi + 0x44]
test eax, eax
je 0x458491
cmp eax, 1
je 0x458491
mov eax, dword [esi + 0x28]
jmp 0x458495
mov eax, dword [esi + eax*4 + 0x28]
push 0x4bfc48
push eax
call dword [sym.imp.USER32.dll_GetPropW]
mov ebx, eax
mov eax, dword [esi + 0x68]
mov dword [esp + 8], 0
mov dword [esp + 0xc], 1
cmp eax, 0xffffffff
jne 0x4584cc
mov eax, dword [esi + 0x44]
test eax, eax
je 0x4584cc
cmp eax, 1
je 0x4584cc
mov eax, dword [esi + 0x28]
jmp 0x4584d0
mov eax, dword [esi + eax*4 + 0x28]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esi + 0x70]
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
push 0x12
mov dword [esp + 0x1c], eax
call fcn.004816f0
cmp eax, 0xbc614e
jne 0x4584fb
mov eax, dword [esp + 8]
jmp 0x458584
cmp dword [esi + 0xa0], 0
push edi
lea edi, [esi + 0xa0]
jne 0x458581
mov edx, dword [ebx + 4]
push 0
push 0x211
add ebx, 4
push 0x41d
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x45854b
mov eax, dword [0x513f44]
push 0
push 0x19
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_GetIcon]
mov esi, eax
mov eax, dword [edi]
test eax, eax
je 0x458547
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
mov dword [edi], esi
jmp 0x458581
mov esi, dword [esi + 0x94]
cmp esi, 1
jne 0x458563
mov ecx, dword [0x513f44]
push 0
push 0x17
push ecx
jmp 0x458573
cmp esi, 2
jne 0x45859d
mov edx, dword [0x513f44]
push 0
push 0x15
push edx
call dword [sym.imp.COMCTL32.dll_ImageList_GetIcon]
push eax
mov ecx, edi
call fcn.00417390
mov eax, dword [edi]
pop edi
mov ecx, dword [esp + 0x2cc]
pop esi
pop ebx
xor ecx, esp
call fcn.0049e9d2
add esp, 0x2c8
ret 0x10
cmp esi, 3
jne 0x4585ae
mov eax, dword [0x513f44]
push 0
push 0x24
push eax
jmp 0x458573
cmp esi, 4
jne 0x4585c0
mov ecx, dword [0x513f44]
push 0
push 0x23
push ecx
jmp 0x458573
mov ecx, ebx
call fcn.00438b40
mov esi, eax
test esi, esi
je 0x458614
cmp word [esi], 0
je 0x458614
push 0x2b0
lea edx, [esp + 0x24]
push 0
push edx
mov dword [esp + 0x28], 0
call fcn.0049e9f0
add esp, 0xc
push 0x111
push 0x2b4
lea eax, [esp + 0x24]
push eax
push 0x80
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, dword [esp + 0x1c]
push ecx
jmp 0x45857a
test byte [0x5135dc], 1
jne 0x45863b
or dword [0x5135dc], 1
push 0x4b8190
mov dword [0x5135d8], 0
call fcn.0049f344
add esp, 4
cmp dword [0x5135d8], 0
jne 0x458660
mov edx, dword [0x513f44]
push 0
push 0x21
push edx
call dword [sym.imp.COMCTL32.dll_ImageList_GetIcon]
push eax
mov ecx, 0x5135d8
call fcn.00417390
mov eax, dword [0x5135d8]
jmp 0x458583
Function at 0x4590f0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x4c
mov eax, dword [0x4da6bc]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
call fcn.00403350
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ebp, eax
push ebp
push 0xbc614e
push str.DefaultFileFormat
push str.Setting
call edi
mov dword [esp + 0x10], eax
cmp eax, 0xbc614e
jne 0x45912a
mov dword [esp + 0x10], 1
push ebp
push 0xbc614e
push str.DefaultEncoding
push str.Setting
call edi
mov ebx, eax
cmp ebx, 0xbc614e
jne 0x459148
xor ebx, ebx
mov eax, dword [esi + 0x68]
cmp eax, 0xffffffff
jne 0x459161
mov eax, dword [esi + 0x44]
test eax, eax
je 0x459161
cmp eax, 1
je 0x459161
mov esi, dword [esi + 0x28]
jmp 0x459165
mov esi, dword [esi + eax*4 + 0x28]
push 0x4bfc48
push esi
call dword [sym.imp.USER32.dll_GetPropW]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
cmp ebx, 1
jne 0x459195
mov eax, dword [esi + 4]
push 0
push 0x10f
push 0x41d
mov ebx, 0xfde9
push eax
jmp 0x4591c5
cmp ebx, 0x4b0
je 0x4591b5
cmp ebx, 0x4b1
je 0x4591b5
cmp ebx, 0x2ee0
je 0x4591b5
cmp ebx, 0x2ee1
jne 0x4591c7
mov ecx, dword [esi + 4]
push 0
push 0x10f
push 0x41d
push ecx
call edi
mov edx, dword [esi + 4]
push 0
push ebx
push 0x41e
push edx
call edi
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 4]
push 0
push eax
push 0x412
push ecx
call edi
mov edx, dword [esi + 4]
push 0
push 0
push 0x441
push edx
call edi
push ebp
push 0xbc614e
push str.WrapMode
push str.Edit
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 0xbc614e
je 0x459232
test eax, eax
je 0x459232
cmp eax, 3
je 0x459232
cmp eax, 4
je 0x459232
mov ecx, dword [esi + 4]
push 0
movzx eax, ax
push eax
push 0x425
push ecx
call edi
call fcn.004034d0
xor edx, edx
push 0x3e
mov edi, eax
push edx
lea eax, [esp + 0x22]
push eax
mov word [esp + 0x24], dx
call fcn.0049e9f0
add esp, 0xc
push edi
push 0x20
lea ecx, [esp + 0x20]
push ecx
xor esi, esi
push esi
push 0x4b9e1c
push str.Syntax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jbe 0x459291
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x459291
lea eax, [esp + 0x18]
push eax
call fcn.0042d530
mov ecx, eax
call fcn.0042bc20
mov esi, eax
push 0
push esi
mov esi, dword [esp + 0x1c]
mov ecx, esi
call fcn.004589b0
mov ecx, dword [esp + 0x58]
pop edi
mov dword [esi + 0x80], 1
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0049e9d2
add esp, 0x4c
ret 0x10
Function at 0x45a8a4
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, ecx
cmp ax, 0x1b
jne 0x45a8c9
mov eax, dword [esi + 0x28]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esp + 0x14]
mov dword [ecx], 0
xor eax, eax
pop esi
ret 0x10
cmp ax, 0xd
jne 0x45a8b9
mov edx, dword [0x514540]
mov eax, dword [edx + 0xc]
push ebx
push edi
mov ecx, 0x514540
call eax
push 2
lea ecx, [esp + 0x18]
add eax, 0x10
lea edi, [esi + 0x28]
push ecx
mov ecx, edi
mov dword [esp + 0x1c], eax
call fcn.0045a610
push 0x4bee0c
push 0x4bc608
lea ecx, [esp + 0x1c]
call fcn.00418520
push 0x4bee1c
push 0x4bb454
lea ecx, [esp + 0x1c]
call fcn.00418520
mov ebx, dword [esp + 0x14]
mov edx, dword [esi + 0x70]
mov eax, dword [esi + 0x6c]
push 0
push 0
push 0
push 0
push ebx
push 1
push edx
push eax
lea ecx, [esi + 4]
call fcn.004193a0
mov ecx, dword [edi]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebx - 0x10]
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
pop edi
pop ebx
test ecx, ecx
jg 0x45a8c3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
pop esi
ret 0x10
Function at 0x45b685
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x294
mov eax, dword [0x4da6bc]
xor eax, esp
mov dword [esp + 0x290], eax
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x68]
cmp eax, 0xffffffff
jne 0x45b6a1
mov eax, dword [esi + 0x44]
test eax, eax
je 0x45b6a1
cmp eax, 1
je 0x45b6a1
mov eax, dword [esi + 0x28]
jmp 0x45b6a5
mov eax, dword [esi + eax*4 + 0x28]
push 0x4bfc48
push eax
call dword [sym.imp.USER32.dll_GetPropW]
mov ebx, eax
test ebx, ebx
je 0x45b832
mov eax, dword [ebx + 4]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x45b832
mov ecx, dword [ebx + 4]
push edi
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x10], ecx
mov ecx, dword [esi + 0x70]
push 5
call fcn.004816f0
mov eax, dword [ebx + 4]
push 0
push 0
push 0x415
push eax
mov edi, 6
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
jne 0x45b81c
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call edi
mov ecx, 0x8000
test cx, ax
je 0x45b770
push 0x11
call edi
mov edx, 0x8000
test dx, ax
jne 0x45b770
push 0x12
call edi
mov ecx, 0x8000
test cx, ax
jne 0x45b770
push 0x5b
call edi
mov edx, 0x8000
test dx, ax
jne 0x45b770
push 0x5c
call edi
mov ecx, 0x8000
test cx, ax
jne 0x45b770
mov eax, 6
pop edi
mov ecx, dword [esp + 0x298]
pop esi
pop ebx
xor ecx, esp
call fcn.0049e9d2
add esp, 0x294
ret 0x10
mov edx, dword [0x514540]
mov eax, dword [edx + 0xc]
push ebp
mov ecx, 0x514540
call eax
lea ecx, [esp + 0x14]
add eax, 0x10
lea ebx, [esi + 8]
push ecx
mov ecx, ebx
mov dword [esp + 0x18], eax
call fcn.00416600
mov eax, dword [0x5144c8]
push 0x144
lea edx, [esp + 0x1c]
push edx
push 0x3a99
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
mov ebp, dword [esp + 0x14]
push ebp
lea ecx, [esp + 0x1c]
push 0x3a99
push ecx
call fcn.00451790
mov ecx, dword [esi + 0x70]
add esp, 0xc
push 0
push 0
push 0x33
lea edx, [esp + 0x24]
push edx
call fcn.00481520
mov edi, eax
cmp edi, 6
jne 0x45b7fa
mov eax, dword [ebx]
push 0
push 0xe103
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
lea eax, [ebp - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
pop ebp
test edx, edx
jg 0x45b817
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp edi, 6
jne 0x45b82b
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esi + 0x70]
push 6
call fcn.004816f0
mov eax, edi
jmp 0x45b756
xor eax, eax
jmp 0x45b757
Function at 0x45cc80
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x28]
push edi
push eax
call dword [sym.imp.USER32.dll_IsWindow]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x45cd38
push 0
push ecx
mov eax, esp
push 0
push 0x96840000
push 0
push ecx
mov dword [eax], 0
mov eax, esp
mov dword [eax], section..data
mov ecx, dword [esi + 4]
push ecx
lea ecx, [esi + 0x24]
call fcn.0045c3b0
mov edx, dword [esi + 0x28]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x28]
push 0
push 0
push 0x41d
push eax
call edi
mov ecx, dword [esi + 0x28]
push 0
push 6
push 0x41d
push ecx
call edi
mov edx, dword [esi + 0x28]
push 0
push 5
push 0x41d
push edx
call edi
mov eax, dword [esi + 0x28]
push 0
push 0
push 0x43b
push eax
call edi
mov ecx, dword [esi + 0x28]
push 0
push 1
push 0x425
push ecx
call edi
mov edx, dword [esi + 4]
push 0
push 0
push 0x31
push edx
call edi
push 1
push eax
mov eax, dword [esi + 0x28]
push 0x30
push eax
call edi
mov edx, dword [0x514540]
mov eax, dword [edx + 0xc]
mov ecx, 0x514540
call eax
mov ebp, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
lea ecx, [esp + 0x10]
push ecx
push ebp
add eax, 0x10
lea ebx, [esi + 4]
push edx
mov ecx, ebx
mov dword [esp + 0x1c], eax
call fcn.0041ef80
mov edx, dword [esi + 0x28]
mov eax, 0x1fffffff
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0x410
push edx
call edi
mov edx, dword [esi + 0x28]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0x411
push edx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], 0xffffffff
call edi
mov eax, dword [esi + 0x28]
push 0
push 0
push 0x441
push eax
call edi
mov edx, dword [esp + 0x38]
mov eax, dword [ebx]
lea ecx, [esp + 0x24]
push ecx
push edx
push 0x1038
push eax
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], 2
call edi
mov edx, dword [ebx]
mov edi, dword [sym.imp.USER32.dll_ClientToScreen]
lea ecx, [esp + 0x24]
push ecx
push edx
call edi
test eax, eax
je 0x45ce03
mov ecx, dword [ebx]
lea eax, [esp + 0x2c]
push eax
push ecx
call edi
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x24]
mov ecx, dword [esi + 0x28]
push 0x40
push 0x64
push 0xc8
add edx, 2
push edx
push eax
push 0
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edx, dword [esi + 0x28]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esp + 0x38]
mov dword [esi + 0x6c], eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esi + 0x70], ebp
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45ce59
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 8
Function at 0x45d26c
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x90
mov eax, dword [0x4da6bc]
xor eax, esp
mov dword [esp + 0x8c], eax
push ebx
mov ebx, dword [esp + 0xa0]
push esi
mov esi, ecx
mov ecx, dword [esp + 0xa8]
mov dword [ecx], 0
mov eax, dword [ebx + 8]
push edi
cmp eax, 1
je 0x45d425
cmp eax, 2
je 0x45d45a
cmp eax, 6
je 0x45d48e
cmp eax, 3
jne 0x45d306
mov edi, dword [ebx + 0xc]
lea ecx, [esi + 4]
call fcn.00457470
push edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esi + 0x70]
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
push eax
push 0x64
call fcn.004816f0
cmp eax, 0xbc614e
je 0x45d4a6
mov esi, dword [esi + 0x70]
cmp dword [esi + 0x1bc], 0
je 0x45d4a6
mov ecx, dword [esp + 0xa4]
push ebx
push ecx
push 0x10f
lea ecx, [esi + 0x1c0]
call fcn.00430b90
jmp 0x45d4a6
cmp eax, 4
jne 0x45d3c0
mov eax, dword [ebx + 0x18]
mov edx, dword [ebx + 0x24]
mov esi, dword [ebx + 0x20]
lea edi, [edx + eax*2]
push 0x3a
push edi
sub esi, eax
call fcn.0049e52c
add esp, 8
test eax, eax
je 0x45d35e
sub eax, edi
sar eax, 1
cmp eax, esi
jge 0x45d35e
lea ecx, [esp + 0xc]
call fcn.00401e50
push edi
push esi
lea eax, [esp + 0x14]
push 0x4bf94c
push eax
call fcn.00402950
mov ecx, dword [esp + 0x1c]
add esp, 0x10
push 3
push 0
push 0
push ecx
jmp 0x45d3a5
push 0x40
push edi
call fcn.0049e52c
add esp, 8
test eax, eax
je 0x45d4a6
sub eax, edi
sar eax, 1
cmp eax, esi
jge 0x45d4a6
lea ecx, [esp + 0xc]
call fcn.00401e50
push edi
push esi
lea edx, [esp + 0x14]
push 0x4c010c
push edx
call fcn.00402950
mov eax, dword [esp + 0x1c]
add esp, 0x10
push 3
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 0xc]
call fcn.00412910
jmp 0x45d4a6
cmp eax, 5
jne 0x45d4a6
mov dword [ecx], 1
mov eax, dword [0x4d6678]
cmp eax, 1
jne 0x45d3eb
push 0x30
call dword [sym.imp.USER32.dll_MessageBeep]
mov eax, 2
jmp 0x45d4a8
cmp eax, 2
jne 0x45d41b
push 0x3b69
lea ecx, [esp + 0x1c]
call fcn.00401a60
push 0
push 0
push 0x30
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esi + 0x70]
call fcn.00481520
mov eax, 2
jmp 0x45d4a8
mov eax, 1
jmp 0x45d4a8
mov eax, dword [esi + 0x68]
cmp eax, 0xffffffff
jne 0x45d449
mov eax, dword [esi + 0x44]
test eax, eax
je 0x45d449
cmp eax, 1
je 0x45d449
mov eax, dword [esi + 0x28]
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x10], eax
push 0x66
jmp 0x45d482
mov eax, dword [esi + eax*4 + 0x28]
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x10], eax
push 0x66
jmp 0x45d482
mov eax, dword [esi + 0x68]
cmp eax, 0xffffffff
jne 0x45d473
mov eax, dword [esi + 0x44]
test eax, eax
je 0x45d473
cmp eax, 1
je 0x45d473
mov eax, dword [esi + 0x28]
jmp 0x45d477
mov eax, dword [esi + eax*4 + 0x28]
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
push 0x67
mov ecx, dword [esi + 0x70]
mov dword [esp + 0x18], ebx
call fcn.004816f0
mov ecx, dword [esp + 0xa4]
mov edx, dword [esi + 0x70]
mov eax, dword [edx + 8]
push ebx
push ecx
push 0x4e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0049e9d2
add esp, 0x90
ret 0x10
Function at 0x45e6e5
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x108
mov eax, dword [0x4da6bc]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x68]
push edi
cmp eax, 0xffffffff
jne 0x45e702
mov eax, dword [esi + 0x44]
test eax, eax
je 0x45e702
cmp eax, 1
je 0x45e702
mov eax, dword [esi + 0x28]
jmp 0x45e706
mov eax, dword [esi + eax*4 + 0x28]
push 0x4bfc48
push eax
call dword [sym.imp.USER32.dll_GetPropW]
mov eax, dword [eax + 4]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x40b
push eax
call edi
push eax
lea ecx, [esp + 0x10]
call fcn.0040cf30
cmp dword [esi + 0x94], 0
mov ebx, dword [esp + 0xc]
jne 0x45e778
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
test eax, eax
jne 0x45e778
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45e778
mov ecx, dword [esi + 0x70]
mov edx, dword [ecx + 8]
push 0
push 0xe102
push 0x111
push edx
call edi
mov ecx, dword [esi + 0x70]
push 0
push ebx
call fcn.00479560
jmp 0x45e7a7
mov ecx, dword [0x5144c8]
push 0x80
lea eax, [esp + 0x14]
push eax
push 0x3ac3
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
mov ecx, dword [esi + 0x70]
push 0
push 0
push 0x30
lea edx, [esp + 0x1c]
push edx
call fcn.00481520
lea eax, [ebx - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
pop edi
pop esi
pop ebx
test edx, edx
jg 0x45e7c6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.0049e9d2
add esp, 0x108
ret 0x10
Function at 0x45e7e5
Capabilities:
Check if file exists
Delete file

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 8]
push edi
call edx
push eax
lea ecx, [esp + 0x14]
call fcn.0040cf30
mov eax, dword [esi + 0x68]
mov dword [esp + 0x18], 0
cmp eax, 0xffffffff
jne 0x45e81b
mov eax, dword [esi + 0x44]
test eax, eax
je 0x45e81b
cmp eax, 1
je 0x45e81b
mov eax, dword [esi + 0x28]
jmp 0x45e81f
mov eax, dword [esi + eax*4 + 0x28]
push 0x4bfc48
push eax
call dword [sym.imp.USER32.dll_GetPropW]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
mov edi, eax
mov eax, dword [edi + 4]
push 0x415
push eax
call ebx
cmp eax, 1
je 0x45e85a
mov ebp, dword [esp + 0x10]
push ebp
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x45e965
push 0x4bfa34
call fcn.00436dc0
add esp, 4
push eax
lea ecx, [esp + 0x18]
call fcn.0040cf30
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x14]
call fcn.00402640
push 4
push str..htm
lea ecx, [esp + 0x18]
call fcn.004020b0
mov ebp, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push ebp
push edx
call fcn.004a1fd1
add esp, 8
test eax, eax
je 0x45e8f9
mov esi, dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45e8cc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add ebp, 0xfffffff0
lea ecx, [ebp + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45e9a5
mov ecx, dword [ebp]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebp
call edx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret 0x10
mov eax, dword [edi + 4]
push 0
push 0xffffffffffffffff
push 0x41e
push eax
call ebx
cmp eax, 0x4b0
je 0x45e916
cmp eax, 0x4b1
jne 0x45e91b
mov eax, 0xfde9
mov edx, dword [edi + 4]
mov ecx, 1
mov dword [esp + 0x18], ecx
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x24]
push ecx
push ebp
push 0x440
push edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x3c], 0
call ebx
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x45e965
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esi + 8]
mov ecx, dword [esp + 0x18]
push edx
mov dword [esp + 0x24], ecx
mov ecx, dword [esi + 0x70]
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x24], ebp
mov edx, dword [ecx + 8]
push 0x8bd
push edx
call ebx
add ebp, 0xfffffff0
lea eax, [ebp + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45e9a5
mov ecx, dword [ebp]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebp
call eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret 0x10
Function at 0x45ea50
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x45ea5c
lea ecx, [esi - 4]
jmp 0x45ea5e
xor ecx, ecx
push edi
call fcn.0045dc10
mov byte [esi + 0x68], 1
add esi, 0x24
mov ecx, esi
mov dword [esi], eax
call fcn.00457e80
mov eax, dword [esi]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
jne 0x45ea8e
mov ecx, dword [esi]
push 5
push ecx
call edi
mov edx, dword [esi + 4]
push 0
push edx
call edi
cmp dword [esi + 0x1c], 0
pop edi
je 0x45eaa4
mov dword [esi + 0x1c], 0
mov ecx, esi
mov dword [esi + 0x40], 0
call fcn.00457e80
mov eax, dword [esp + 0x14]
mov dword [eax], 0
xor eax, eax
pop esi
ret 0x10