joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c535
Capabilities:
Hide graphical window

Disassembly:
push dword [0x43c108]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x40c554
push 0
push dword [0x43c108]
call dword [sym.imp.USER32.dll_ShowWindow]
ret
push 5
push dword [0x43c108]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x43c108]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
ret

Function at 0x40ccae
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push 0x43c0e0
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.00401988
test al, al
je 0x40ccd9
cmp dword [0x43c334], 0
jne 0x40cce1
cmp dword [0x43c338], 0
jne 0x40cce1
push edi
push ecx
push ecx
call fcn.00401fc4
mov ecx, dword [0x43c10c]
test ecx, ecx
je 0x40cd00
mov eax, dword [ecx]
push 0
push dword [0x43c318]
push edi
call dword [eax + 8]
mov dword [0x43c0d8], eax
jmp 0x40cd05
mov eax, dword [0x43c0d8]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40cd1e
push 0
push dword [0x43c0d8]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.0040230c
call fcn.00408c6a
mov esi, dword [sym.imp.USER32.dll_SetTimer]
mov ebx, 0x40cc7c
push ebx
push 0x1d4c0
push 0x46a
push edi
call esi
push ebx
push 0xea60
push 0x466
push edi
call esi
call fcn.00401988
test al, al
je 0x40cd97
cmp dword [0x43c338], 0
jne 0x40cd97
cmp dword [0x43c334], 0
jne 0x40cd97
push str.tab_play
push dword [0x43c108]
call dword [sym.imp.zbgui.dll_GetPluginByName]
mov esi, eax
push 1
push esi
mov ecx, dword [esi]
call dword [ecx + 0x194]
push 0
push 1
push esi
mov ecx, 0x43e458
call fcn.0040543d
pop edi
pop esi
pop ebx
ret

Function at 0x40ed30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x40ed3b
xor eax, eax
pop ebp
ret
push ebx
push esi
mov esi, dword [ebp + 8]
not ecx
mov ebx, 0xff
cmp esi, 8
jb 0x40edf3
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x433cc0]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x433cc0]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x433cc0]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x433cc0]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x433cc0]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x433cc0]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x433cc0]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x433cc0]
dec edi
jne 0x40ed56
pop edi
test esi, esi
je 0x40ee0c
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x433cc0]
inc edx
dec esi
jne 0x40edf7
not ecx
pop esi
mov eax, ecx
pop ebx
pop ebp
ret
Function at 0x40ee14
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
movsx eax, dl
mov edx, 0xff
mov esi, dword [edi]
xor eax, esi
and eax, edx
shr esi, 8
mov eax, dword [eax*4 + 0x433cc0]
xor eax, esi
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul ecx, eax, 0x8088405
mov eax, dword [edi + 8]
inc ecx
mov dword [edi + 4], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, edx
xor eax, dword [ecx*4 + 0x433cc0]
mov dword [edi + 8], eax
pop edi
pop esi
ret

Function at 0x40f51e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edx
mov esi, ebx
mov eax, ecx
imul esi, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp byte [edi], 0
je 0x40f558
push 0
lea ecx, [ebp + 8]
push ecx
push esi
push eax
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40f553
mov byte [edi + 8], 1
mov eax, dword [ebp + 8]
jmp 0x40f57f
mov edx, dword [edi + 0x1c]
lea eax, [edx + esi]
cmp eax, dword [edi + 0x18]
jbe 0x40f568
mov esi, dword [edi + 0x18]
sub esi, edx
mov ecx, dword [edi + 0x14]
push esi
add ecx, edx
push ecx
push dword [ebp - 4]
call fcn.0041a850
add esp, 0xc
mov eax, esi
add dword [edi + 0x1c], esi
pop edi
xor edx, edx
pop esi
div ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41071f
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x439030]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x410751
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x410751
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [ebx]
test ax, ax
je 0x4107ff
push esi
mov esi, ebx
mov ecx, ebx
cmp ax, 0x2f
je 0x41076e
cmp ax, 0x5c
jne 0x410770
mov esi, ecx
add ecx, 2
movzx eax, word [ecx]
test ax, ax
jne 0x410762
cmp esi, ebx
je 0x4107b4
sub esi, ebx
lea eax, [ebp - 0x414]
and esi, 0xfffffffe
push esi
push ebx
push eax
call fcn.0041a850
add esp, 0xc
cmp esi, 0x208
jae 0x41080f
xor eax, eax
lea edx, [ebp - 0x414]
mov ecx, edi
mov word [ebp + esi - 0x414], ax
call fcn.0041071f
xor eax, eax
mov word [ebp - 0x20c], ax
pop esi
test edi, edi
je 0x4107d0
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4107ff
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0041813f
mov esp, ebp
pop ebp
ret
call fcn.0041a2d3
int3
Function at 0x412d70
Capabilities:
Create directory
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x628
mov eax, dword [0x439030]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x435a20]
movdqu xmm0, xmmword [str.SOFTWARE_]
push esi
push 0x1f4
mov dword [ebp - 0x404], eax
mov esi, ecx
lea eax, [ebp - 0x400]
push 0
push eax
movdqu xmmword [ebp - 0x414], xmm0
call fcn.0041ba00
lea eax, [esi + 0x1254]
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.0041826c
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.0041ba00
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x61c], ax
lea eax, [ebp - 0x61a]
push eax
call fcn.0041ba00
add esp, 0x30
lea eax, [ebp - 0x20c]
push 0
push 0x23
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x4318c0
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0041826c
lea eax, [esi + 0x1048]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0041826c
push str._Data_
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0041826c
add esp, 0x24
lea eax, [ebp - 0x20c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.filecache.ini
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0041826c
add esp, 0xc
lea eax, [ebp - 0x628]
push eax
push 0x20219
push 0
lea eax, [ebp - 0x414]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x412f2f
push dword [ebp - 0x628]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x620], eax
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x628]
push eax
push 0
push 0xf023f
push 0
push 0
push 0
lea eax, [ebp - 0x414]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x412f77
push 4
lea eax, [ebp - 0x620]
push eax
push 4
push 0
push str.InstallID
push dword [ebp - 0x628]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x628]
call esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041813f
mov esp, ebp
pop ebp
ret 4
push dword [ebp + 8]
lea eax, [ebp - 0x61c]
push 0x431ce0
push eax
call fcn.00402d33
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004183e7
add esp, 0x14
cmp eax, 0xffffffff
je 0x412f77
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push eax
push str.InstallID
push str.config
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0041813f
mov esp, ebp
pop ebp
ret 4
Function at 0x413390
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2888
call fcn.00423310
mov eax, dword [0x439030]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x41346d
lea eax, [ebp - 0x2888]
mov dword [ebp - 0x2888], 0x2880
push eax
lea eax, [ebp - 0x2884]
push eax
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x41346d
lea eax, [ebp - 0x2884]
nop
cmp byte [eax + 0x194], 0
jne 0x41342d
cmp byte [eax + 0x195], 0
jne 0x41342d
cmp byte [eax + 0x196], 0
jne 0x41342d
cmp byte [eax + 0x197], 0
jne 0x41342d
cmp byte [eax + 0x198], 0
jne 0x41342d
cmp byte [eax + 0x199], 0
jne 0x41342d
mov eax, dword [eax]
test eax, eax
jne 0x4133e0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041813f
mov esp, ebp
pop ebp
ret 4
movzx ecx, byte [eax + 0x199]
push ecx
movzx ecx, byte [eax + 0x198]
push ecx
movzx ecx, byte [eax + 0x197]
push ecx
movzx ecx, byte [eax + 0x196]
push ecx
movzx ecx, byte [eax + 0x195]
movzx eax, byte [eax + 0x194]
push ecx
push eax
push str._02X__02X__02X__02X__02X__02X
push 0x32
push esi
call fcn.00418250
add esp, 0x24
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0041813f
mov esp, ebp
pop ebp
ret 4
Function at 0x413480
Capabilities:
Create directory
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x628
mov eax, dword [0x439030]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x435a20]
movdqu xmm0, xmmword [str.SOFTWARE_]
push esi
push 0x1f4
mov dword [ebp - 0x404], eax
mov esi, ecx
lea eax, [ebp - 0x400]
push 0
push eax
movdqu xmmword [ebp - 0x414], xmm0
call fcn.0041ba00
lea eax, [esi + 0x1254]
push eax
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.0041826c
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.0041ba00
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x61c], ax
lea eax, [ebp - 0x61a]
push eax
call fcn.0041ba00
add esp, 0x30
lea eax, [ebp - 0x20c]
push 0
push 0x23
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x4318c0
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0041826c
lea eax, [esi + 0x1048]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0041826c
push str._Data_
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0041826c
add esp, 0x24
lea eax, [ebp - 0x20c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.filecache.ini
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0041826c
mov esi, dword [esi + 0x145c]
lea eax, [ebp - 0x628]
add esp, 0xc
neg esi
sbb esi, esi
and esi, 0xb
push eax
push 0x20219
push 0
lea eax, [ebp - 0x414]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x413649
push dword [ebp - 0x628]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x624]
mov dword [ebp - 0x620], esi
push eax
lea eax, [ebp - 0x628]
push eax
push 0
push 0xf023f
push 0
push 0
push 0
lea eax, [ebp - 0x414]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41368f
push 4
lea eax, [ebp - 0x620]
push eax
push 4
push 0
push str.Service_Value
push dword [ebp - 0x628]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x628]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041813f
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebp - 0x61c]
push 0x431ce0
push eax
call fcn.00402d33
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004183e7
add esp, 0x14
cmp eax, 0xffffffff
je 0x41368f
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push eax
push str.Service_Value
push str.config
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0041813f
mov esp, ebp
pop ebp
ret
Function at 0x413770
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ebx, ecx
push edi
mov edi, ebx
lea ecx, [edi + 1]
lea ebx, [ebx]
mov al, byte [edi]
inc edi
test al, al
jne 0x413780
sub edi, ecx
inc edi
push edi
call fcn.004182d8
push edi
mov esi, eax
push 0
push esi
call fcn.0041ba00
push ebx
push edi
push esi
call fcn.004198a4
xor eax, eax
add esp, 0x1c
cmp byte [esi], al
je 0x4137ba
lea esp, [esp]
xor byte [esi], 0x20
inc eax
inc esi
cmp byte [esi], 0
jne 0x4137b0
sub esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x414140
Capabilities:
Hash data with md5

Disassembly:
push esi
push 0x40
mov esi, ecx
mov dword [0x43c370], 1
mov byte [0x43c344], 0
call fcn.004182d8
add esp, 4
mov dword [0x43c368], eax
test eax, eax
je 0x41419c
mov ecx, esi
mov dword [0x43c36c], eax
mov dword [0x43c380], 0x67452301
mov dword [0x43c384], 0xefcdab89
mov dword [0x43c388], 0x98badcfe
mov dword [0x43c38c], 0x10325476
pop esi
jmp fcn.004149f0
pop esi
ret

Function at 0x414c80
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x439030]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.REALTXL_ONLINEUPDATE_WND_CLASS
push 0
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x414cf0
push 0
push str.REALTXL_ONLINEUPDATE_WND_CLASS
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
test edi, edi
je 0x414cf0
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 9
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_BringWindowToTop]
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041813f
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 4]
mov dword [esi], 1
test eax, eax
je 0x414d25
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x414d25
push dword [esi + 4]
call fcn.00415900
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041813f
mov esp, ebp
pop ebp
ret 4
mov ecx, esi
call fcn.00414eb0
test al, al
je 0x414cdb
push esi
push 0xffffffffffffffeb
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [ebp - 0x20]
push 0
push 0
push 0
push eax
call esi
test eax, eax
je 0x414d7c
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
mov edi, edi
lea eax, [ebp - 0x20]
push eax
call edi
lea eax, [ebp - 0x20]
push eax
call ebx
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call esi
test eax, eax
jne 0x414d60
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041813f
mov esp, ebp
pop ebp
ret 4
Function at 0x414da0
Capabilities:
Create directory
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x439030]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
push esi
mov esi, dword [ebp + 8]
push edi
push 0x206
push eax
mov word [ebp - 0x20c], ax
mov edi, ecx
lea eax, [ebp - 0x20a]
push eax
call fcn.0041ba00
add esp, 8
lea eax, [ebp - 0x20c]
push eax
call fcn.004155e0
push str.update
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0041826c
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x432fdc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0041826c
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x20c]
push eax
push ecx
push esi
call fcn.00415700
test eax, eax
je 0x414e76
push 1
push 0
push ebx
lea eax, [ebp - 0x20c]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041813f
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebp + 0x10], 0
je 0x414e94
push 0x10
push 0x4330dc
push 0x4330e8
push dword [edi + 0x1274]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041813f
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4151e0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
lea edx, [edi + 0x24]
lea ecx, [edx + 2]
lea ecx, [ecx]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4151f0
sub edx, ecx
sar edx, 1
je 0x41528b
lea ecx, [edi + 0x106c]
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x415210
sub ecx, edx
sar ecx, 1
jne 0x41528b
push esi
push str.btn_close_0
push dword [edi + 4]
call dword [sym.imp.zbgui.dll_GetPluginByName]
mov esi, eax
push 0
push esi
mov ecx, dword [esi]
call dword [ecx + 0xb0]
mov ecx, dword [esi]
push 1
push esi
call dword [ecx + 0x84]
push eax
call dword [sym.imp.zbgui.dll_Plugin_Redraw]
mov eax, dword [edi + 8]
pop esi
test eax, eax
je 0x41525e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.REAL_EVENT_DOWNLOAD
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push edi
push 0x4152a0
push 0
push 0
mov dword [edi + 8], eax
call fcn.00418820
add esp, 0x18
mov dword [edi + 0xc], eax
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4155e0
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0
push 0x23
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x4318c0
push 0x104
push esi
call fcn.0041826c
add esp, 0xc
push 0x440f38
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x415630
call fcn.00415670
push str.114MPlayer
push 0x440f38
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x440f38
push 0x104
push esi
call fcn.0041826c
push str._Data_
push 0x104
push esi
call fcn.0041826c
add esp, 0x18
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop esi
pop ebp
ret 8

Function at 0x415700
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x33c
mov eax, dword [0x439030]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
push 0x63
mov dword [ebp - 0x33c], eax
lea eax, [ebp - 0x67]
push 0
push eax
mov byte [ebp - 0x68], 0
call fcn.0041ba00
push 0x43ad0c
push 0x43ad1c
push 0x43ad2a
push 0x43ad24
push 0x43acea
push 0x43ad30
push 0x43ad06
push 0x43ad1a
push 0x43ad14
push 0x43ad30
push 0x43ad2a
push 0x43ad2e
push 0x43ad40
push 0x43ad30
push 0x43ace6
push 0x43acf6
push 0x43ad02
lea eax, [ebp - 0x68]
push 0x431b14
push eax
call fcn.00402d01
add esp, 0x58
xor eax, eax
mov word [ebp - 0x338], ax
push 0x206
push eax
lea eax, [ebp - 0x336]
push eax
call fcn.0041ba00
add esp, 0xc
lea eax, [ebp - 0x338]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 2
push 0x104
call fcn.004183a2
mov edi, eax
add esp, 8
test edi, edi
je 0x4158e5
push 0x208
push 0
push edi
call fcn.0041ba00
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x338]
add esp, 0xc
push eax
push edi
call esi
push 0x431b3c
push edi
call esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.online_update.exe
push edi
call esi
xor eax, eax
push 0xc6
push eax
mov word [ebp - 0x130], ax
lea eax, [ebp - 0x12e]
push eax
call fcn.0041ba00
push 0x43ad74
push 0x43ad74
push 0x43ad54
push 0x43abb4
push 0x43ad7c
push 0x43ad80
push 0x43ad78
push 0x43ad74
push 0x43ad8c
push 0x43ad98
lea eax, [ebp - 0x130]
push str._s_s_s_s_s_s_s_s_s_s
push eax
call fcn.00402d1a
add esp, 0x3c
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4158dc
lea eax, [ebp - 0x68]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4158d5
push 0
push 0
push edi
push dword [ebp - 0x33c]
push 0
call eax
test eax, eax
jne 0x4158d5
test ebx, ebx
je 0x4158bd
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041813f
mov esp, ebp
pop ebp
ret 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push edi
call fcn.0041836a
add esp, 4
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041813f
mov esp, ebp
pop ebp
ret 0xc
Function at 0x415900
Capabilities:
Hide graphical window
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push 0
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 1
push ebx
mov ebx, dword [sym.imp.USER32.dll_AttachThreadInput]
push eax
mov dword [ebp - 8], eax
call ebx
mov edi, dword [ebp + 8]
push 1
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push dword [ebp - 4]
push dword [ebp - 8]
call ebx
pop edi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4