joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416f80
Capabilities:
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [0x4ef418]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp word [0x4f6704], 0
jne 0x416fc3
xor eax, eax
mov ebx, 0x4f6704
push eax
push 0x26
push ebx
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.internet_exploreriexplore.exe
push ebx
call fcn.0047e398
add esp, 8
push edi
push esi
push 0x4f6704
call fcn.00417030
add esp, 0xc
test eax, eax
je 0x416fed
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045bb2d
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [ebp - 0x14]
mov dword [eax], 4
lea ecx, [ebp + 0xc]
push ecx
push esi
push eax
push str.Version
push str.SoftwareMicrosoftInternet_Explorer
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
xor ebx, ebx
test eax, eax
jne 0x416fd9
xor ebx, ebx
cmp word [esi], 0
setne bl
jmp 0x416fd9

Function at 0x417030
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x4010
call fcn.00460860
mov ebx, dword [ebp + 8]
mov eax, dword [0x4ef418]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x4010]
push 0x4000
push 0
push edi
call fcn.00463600
add esp, 0xc
lea eax, [ebp - 0x4014]
mov dword [eax], 0xffffffff
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
lea ecx, [eax - 0x4000]
xor esi, esi
cmp ecx, 0xffffc001
jb 0x4170b8
push edi
push eax
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4170b8
xor eax, eax
dec eax
lea ecx, [ebp - 0x4018]
mov dword [ecx], eax
lea edx, [ebp - 0x401c]
mov dword [edx], eax
push edx
push ecx
push 0x4d861a
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x4170cf
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045bb2d
mov eax, esi
add esp, 0x4010
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x4018]
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov edx, ecx
and edx, 0xffff
shr ecx, 0x10
mov edi, eax
and edi, 0xffff
shr eax, 0x10
mov ebx, dword [ebp + 0xc]
push edx
push ecx
push edi
push eax
push str._d._d._d._d
push esi
push ebx
call fcn.00491080
add esp, 0x1c
mov word [ebx + esi*2 - 2], 0
xor esi, esi
inc esi
jmp 0x4170b8
Function at 0x417510
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x4ef418]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
inc eax
mov dword [ebp - 0x1c], eax
xor ecx, ecx
lea esi, [ebp - 0x14]
mov dword [esi], ecx
push esi
push eax
push ecx
push str.Software360360se6Chrome
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, esi
mov edi, dword [esi]
mov esi, 0
mov bl, 1
test eax, eax
cmove esi, edi
jne 0x4175be
xor edx, edx
dec edx
lea eax, [ebp - 0x18]
mov dword [eax], edx
mov edx, 4
mov dword [ebp - 0x14], edx
lea ebx, [ebp - 0x1c]
push ecx
push ebx
push eax
xor eax, eax
push eax
push str.joininexperience
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor edx, edx
cmp dword [ebx], edx
mov ebx, 0xffffffff
lea eax, [ebp - 0x18]
mov dword [eax], ebx
setne bl
mov eax, 4
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x20]
mov dword [ecx], edx
lea eax, [ebp - 0x14]
push eax
push ecx
lea eax, [ebp - 0x18]
push eax
push edx
push str.fulldump
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x20]
xor ecx, ecx
cmp dword [eax], ecx
je 0x4175be
mov byte [0x4f5dc4], 1
test esi, esi
je 0x4175c9
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045bb2d
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4175e0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
call fcn.00417510
test al, al
je 0x417649
mov edi, dword [ebp + 8]
call fcn.00417650
sub esp, 4
call fcn.004178e0
add esp, 4
call fcn.004185c0
mov esi, eax
push edi
call fcn.00418a20
add esp, 4
test esi, esi
je 0x41761a
call fcn.00419320
mov eax, dword [0x4f5da8]
test eax, eax
je 0x417638
xor esi, esi
push 0x8000
push esi
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [0x4f5da8], esi
call fcn.00416870
add eax, 0x5d120
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
pop edi
pop ebp
ret
Function at 0x417650
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
mov eax, 0x1470
call fcn.00460860
mov esi, esp
mov eax, dword [0x4ef418]
xor eax, ebp
mov dword [esi + 0x1468], eax
cmp byte [0x4f36f0], 0
je 0x417690
mov ecx, dword [esi + 0x1468]
xor ecx, ebp
call fcn.0045bb2d
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [esi + 0x420]
push 0x1048
push 0
push eax
call fcn.00463600
add esp, 0xc
mov eax, dword [0x4f5d9c]
mov ecx, dword [0x4f269c]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x417897
mov edi, 0x4f5d90
cmp byte [0x4f5d9b], 0
jns 0x4176e1
mov edi, dword [0x4f5d90]
xor ebx, ebx
test edi, edi
je 0x417740
push edi
call fcn.0047d960
add esp, 4
xor ebx, ebx
cmp eax, 0x3ffffffe
jg 0x417740
lea ecx, [eax + 1]
mov dword [esi + 0xc], ecx
lea ecx, [eax*2 + 2]
lea eax, [eax*2 + 5]
and eax, 0xfffffffc
call fcn.00460860
mov ebx, esp
and ebx, 0xfffffff0
mov esp, ebx
push ecx
push 0xff
push ebx
call fcn.00463600
add esp, 0xc
mov word [ebx], 0
push dword [esi + 0xc]
push ebx
push 0xffffffffffffffff
push edi
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
cmove ebx, eax
mov eax, 0x4f4d4a
mov ecx, 0x4f3b02
mov edi, 0x823
push 0x4f4f52
push ebx
push eax
push 0x4f493a
push 0x4f4732
push 0x4f452a
push 0x4f4322
push 0x4f411a
push 0x4f3f12
push ecx
push 0x4f36f2
xor edx, edx
push edx
push edx
push ecx
push eax
push str.http:__pvstat.qihoo.com_dimana.gif__pdt360se6bq_dim_kpid__guid__ver_dim_v360se6___s___sm_dmts_diname_sifver_simod_simodver_sicode_sioff_sios_siie_smid_spt_spid_s
push edi
lea eax, [esi + 0x420]
push eax
call fcn.00491080
add esp, 0x48
call fcn.00416870
mov edi, eax
mov ecx, eax
call fcn.004b0470
lea ebx, [edi + 0x5d530]
push 0x1048
xor eax, eax
push eax
push ebx
call fcn.00463600
add esp, 0xc
mov eax, 0x4d820e
lea ecx, [esi + 0x420]
push ecx
push eax
mov eax, 0x823
push eax
push ebx
call fcn.00491140
add esp, 0x10
lea eax, [esi + 0x218]
mov ecx, 0x208
push ecx
xor ebx, ebx
push ebx
push eax
call fcn.00463600
add esp, 0xc
lea eax, [esi + 0x10]
mov ecx, 0x208
push ecx
push ebx
push eax
mov ebx, eax
call fcn.00463600
add esp, 0xc
mov eax, 0x103
lea ecx, [esi + 0x218]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebx
push eax
push 0x4d8548
lea eax, [esi + 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea ebx, [edi + 0x5d120]
mov eax, 0x208
push eax
xor eax, eax
push eax
push ebx
call fcn.00463600
add esp, 0xc
lea eax, [esi + 0x10]
push eax
mov eax, 0x4d820e
push eax
mov eax, 0x103
push eax
push ebx
call fcn.004911a0
add esp, 0x10
mov dword [edi + 0x2468], 1
mov dword [edi + 0x26a8], 0x1388
mov ecx, edi
call fcn.004b0280
mov ecx, edi
push 0x1f40
call fcn.004b0660
lea eax, [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x41767b
push 0x4f5d9c
call fcn.00459bb7
add esp, 4
cmp dword [0x4f5d9c], 0xffffffff
jne 0x4176c7
xorps xmm0, xmm0
movsd qword [0x4f5d90], xmm0
mov dword [0x4f5d98], 0
push 0x4f5d9c
call fcn.00459c2d
add esp, 4
jmp 0x4176c7
Function at 0x419320
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x630
mov esi, esp
mov eax, dword [0x4ef418]
xor eax, ebp
mov dword [esi + 0x628], eax
lea eax, [esi + 0xc]
mov dword [eax], 0
push eax
call fcn.00419730
add esp, 4
mov dword [0x4f5da8], eax
test eax, eax
jne 0x41936e
mov ecx, dword [esi + 0x628]
xor ecx, ebp
call fcn.0045bb2d
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, 0x208
xor ecx, ecx
lea edi, [esi + 0x420]
push eax
push ecx
push edi
call fcn.00463600
add esp, 0xc
mov eax, 0x103
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ebx, [esi + 0x218]
mov eax, 0x208
push eax
xor eax, eax
push eax
push ebx
call fcn.00463600
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebx
push eax
push 0x4d8548
push edi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
call fcn.00416870
mov edi, eax
mov ecx, eax
call fcn.004b0470
lea ebx, [edi + 0x5d530]
push 0x1048
xor eax, eax
push eax
push ebx
call fcn.00463600
add esp, 0xc
mov eax, 0x4d820e
push str.http:__crash.browser.360.cn_interface_dumpinfo_
push eax
push 0x823
push ebx
call fcn.00491140
add esp, 0x10
lea ebx, [edi + 0x5d120]
mov eax, 0x208
push eax
xor eax, eax
push eax
push ebx
call fcn.00463600
add esp, 0xc
lea eax, [esi + 0x218]
push eax
mov eax, 0x4d820e
push eax
mov eax, 0x103
push eax
push ebx
call fcn.004911a0
add esp, 0x10
mov dword [edi + 0x26a8], 0x2710
lea ecx, [esi + 0x10]
mov eax, 0x208
push eax
xor eax, eax
push eax
push ecx
call fcn.00463600
add esp, 0xc
sub esp, 0x54
mov ebx, esp
and ebx, 0xfffffff0
mov esp, ebx
pcmpeqd xmm0, xmm0
movdqa xmmword [ebx], xmm0
xor eax, eax
dec eax
mov dword [ebx + 0x50], eax
movdqa xmmword [ebx + 0x40], xmm0
movdqa xmmword [ebx + 0x30], xmm0
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
mov word [ebx], 0
push 0x2a
push ebx
push eax
push str.___________________________7d9114302a0cb6
xor eax, eax
push eax
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
cmove ebx, eax
push ebx
push str.multipart_form_data__boundary_s
mov eax, 0x103
push eax
lea eax, [esi + 0x10]
push eax
call fcn.00491080
add esp, 0x10
mov eax, dword [esi + 0xc]
mov ecx, dword [0x4f5da8]
mov dword [edi + 0x2480], ecx
mov dword [edi + 0x2484], eax
lea ebx, [edi + 0x2488]
mov eax, 0x208
push eax
xor eax, eax
push eax
push ebx
call fcn.00463600
add esp, 0xc
lea eax, [esi + 0x10]
push eax
mov eax, 0x4d820e
push eax
mov eax, 0x103
push eax
push ebx
call fcn.004911a0
add esp, 0x10
mov ecx, edi
call fcn.004b0280
mov ecx, edi
push 0x2ee0
call fcn.004b0660
lea eax, [esi + 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x419359
Function at 0x4195b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x834
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov eax, dword [0x4ef418]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x834]
push 0x824
push 0
push ebx
call fcn.00463600
add esp, 0xc
cmp dword [ebp + 0x18], 0
je 0x4196cf
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push eax
push dword [ebp + 0x10]
push str.___________________________7d9114302a0cb6
push str.___s_r_nContent_Disposition:_form_data__name__s___filename__s__r_nContent_Type:_application_octet_stream_r_n_r_n
push 0x823
push ebx
call fcn.004910e0
add esp, 0x18
push ebx
call fcn.0047d960
add esp, 4
mov dword [ebp - 0x838], eax
push 0x4d84a9
push esi
call fcn.0047979e
add esp, 8
test eax, eax
je 0x4196c4
mov esi, eax
xor ebx, ebx
push 2
push ebx
push eax
call fcn.0047b7cc
add esp, 0xc
push esi
call fcn.0047baef
add esp, 4
mov edi, eax
push ebx
push ebx
push esi
call fcn.0047b7cc
add esp, 0xc
mov dword [ebp - 0x840], edi
mov eax, dword [ebp - 0x838]
lea ecx, [eax + edi]
add ecx, 2
mov eax, dword [ebp + 0xc]
cmp ecx, dword [eax]
jae 0x4196b4
mov ebx, dword [ebp - 0x838]
push ebx
lea eax, [ebp - 0x834]
push eax
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 0x83c], ecx
call fcn.00463080
add esp, 0xc
add edi, ebx
push esi
push 1
mov ebx, dword [ebp - 0x840]
push ebx
push edi
call fcn.0047b4dc
add esp, 0x10
mov word [ebx + edi], 0xa0d
mov ebx, dword [ebp - 0x83c]
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
push esi
call fcn.0047ad55
add esp, 4
jmp 0x41970d
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
jmp 0x41970d
push esi
push dword [ebp + 0x10]
push str.___________________________7d9114302a0cb6
push str.___s_r_nContent_Disposition:_form_data__name__s__r_n_r_n_s_r_n
push 0x823
push ebx
call fcn.004910e0
add esp, 0x18
push ebx
call fcn.0047d960
add esp, 4
mov esi, eax
xor eax, eax
cmp esi, dword [edi]
jae 0x41970b
push esi
push ebx
push dword [ebp + 8]
call fcn.00463080
add esp, 0xc
mov eax, esi
mov dword [edi], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045bb2d
add esp, 0x834
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x419db0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x10004
call fcn.00460860
mov esi, dword [ebp + 8]
mov eax, dword [0x4ef418]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, esi
call fcn.00430da0
test al, al
je 0x419dfe
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045bb2d
mov eax, ebx
add esp, 0x10004
pop esi
pop edi
pop ebx
pop ebp
ret
push esi
call fcn.0047ad55
add esp, 4
mov bl, 1
jmp 0x419dda
cmp byte [esi + 0xb], 0
jns 0x419e06
mov esi, dword [esi]
push 0x40
push 0x4d8cba
push esi
call fcn.00479793
add esp, 0xc
test eax, eax
je 0x419dd8
mov esi, eax
mov edi, dword [ebp + 0xc]
lea ebx, [ebp - 0x10010]
push 0x10000
push 0xff
push ebx
call fcn.00463600
add esp, 0xc
push esi
push 0x10000
push 1
push ebx
call fcn.0047b4dc
add esp, 0x10
test eax, eax
je 0x419df1
test edi, edi
je 0x419e38
mov ecx, edi
push eax
push ebx
call fcn.00449920
jmp 0x419e38

Function at 0x41a180
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [ebp + 8]
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edx, dword [0x4ef418]
xor edx, ebp
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x18], 0
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x20], 0
test eax, eax
je 0x41a269
mov esi, eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x41a269
mov ebx, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x41a269
mov esi, eax
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
je 0x41a269
mov edi, eax
push ebx
push esi
push eax
call fcn.00463080
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0x1c]
mov dword [ecx], eax
push ecx
push eax
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x41a25c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
push 0x10
call sub.gdiplus.dll_GdipAlloc
mov ebx, eax
mov dword [eax], fcn.00491410
lea esi, [ebp - 0x14]
mov dword [esi], 0
push esi
push dword [ebp - 0x20]
call sub.gdiplus.dll_GdipCreateBitmapFromStream
mov dword [ebx + 8], eax
mov eax, dword [esi]
mov dword [ebx + 4], eax
mov esi, dword [ebp - 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax + 8]
call dword [0x4e925c]
push esi
call ecx
test ebx, ebx
jne 0x41a27e
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045bb2d
mov eax, dword [ebp - 0x20]
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
cmp dword [ebx + 8], 0
mov dword [ebx + 8], 0
jne 0x41a2a0
lea eax, [ebp - 0x18]
push 0
push eax
push dword [ebx + 4]
call sub.gdiplus.dll_GdipCreateHBITMAPFromBitmap
test eax, eax
je 0x41a2a0
mov dword [ebx + 8], eax
mov ecx, ebx
push 1
call fcn.00491410
jmp 0x41a25c
Function at 0x41b9f0
Capabilities:
Create thread
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov esi, ecx
mov ebx, dword [ebp + 0x14]
mov eax, dword [0x4ef418]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
push eax
push eax
push eax
push 0x412270
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x660], eax
test eax, eax
jne 0x41bac1
xor edi, edi
dec edi
lea eax, [ebp - 0x1c]
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
push 0x879
push eax
call fcn.004162e0
add esp, 8
lea ebx, [ebp - 0x28]
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
push 0xadc
push ebx
call fcn.004162e0
add esp, 8
mov eax, 5
mov edi, dword [sym.imp.USER32.dll_KillTimer]
push eax
push dword [esi + 4]
call edi
push 4
push dword [esi + 4]
call edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 0x344]
call edi
mov eax, 5
push eax
push dword [esi + 0x30]
call edi
mov ecx, esi
lea eax, [ebp - 0x1c]
push eax
push ebx
call fcn.0041bae0
cmp byte [ebx + 0xb], 0
jns 0x41baad
push dword [ebp - 0x28]
call fcn.00459b3c
add esp, 4
cmp byte [ebp - 0x11], 0
jns 0x41babe
push dword [ebp - 0x1c]
call fcn.00459b3c
add esp, 4
mov ebx, dword [ebp + 0x14]
xor edi, edi
inc edi
mov dword [ebx], edi
mov dword [esi + 0x24], edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045bb2d
mov eax, edi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x41e030
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov esi, esp
mov edi, ecx
lea ebx, [ebp + 8]
mov eax, dword [0x4ef418]
xor eax, ebp
mov dword [esi + 0x28], eax
pcmpeqd xmm0, xmm0
lea eax, [esi + 0x10]
movdqa xmmword [eax], xmm0
push eax
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
push 1
push dword [ebx]
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [edi + 0x84]
cmp eax, 0xffffffff
jne 0x41e07f
push 9
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
push dword [ebx]
call dword [sym.imp.GDI32.dll_SetTextColor]
push dword [edi + 0x24]
push dword [ebx]
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esi + 0xc], eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jle 0x41e12c
lea ecx, [eax + 1]
mov dword [esi + 8], ecx
lea ecx, [eax*2 + 2]
lea eax, [eax*2 + 5]
and eax, 0xfffffffc
call fcn.00460860
mov ebx, esp
and ebx, 0xfffffff0
mov esp, ebx
push ecx
push 0xff
push ebx
call fcn.00463600
add esp, 0xc
push dword [esi + 8]
push ebx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x41e12c
push 0xfffffffffffffff0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, eax
and ecx, 2
xor edx, edx
inc edx
test al, 1
cmove edx, ecx
lea ecx, [edx + 0x24]
test al, 0xb
cmove ecx, edx
shl eax, 0xd
and eax, 0x100000
add eax, ecx
add eax, 0x200
push eax
lea eax, [esi + 0x10]
push eax
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 8]
push dword [eax]
call dword [sym.imp.USER32.dll_DrawTextW]
push dword [esi + 0xc]
lea eax, [ebp + 8]
push dword [eax]
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esi + 0x28]
xor ecx, ebp
call fcn.0045bb2d
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x420160
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, ecx
mov eax, dword [0x4ef418]
xor eax, ebp
mov dword [ebp - 0x10], eax
push dword [ecx + 0x2c]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
xor esi, esi
inc esi
test eax, eax
je 0x420262
cmp byte [edi + 0x370], 0
je 0x420258
mov ecx, 0x4f368c
call fcn.00411910
lea ebx, [ebp - 0x1c]
push 0x8f0
push ebx
call fcn.004162e0
add esp, 8
cmp byte [ebx + 0xb], 0
jns 0x4201ba
mov ebx, dword [ebp - 0x1c]
lea esi, [ebp - 0x28]
push 0x8ef
push esi
call fcn.004162e0
add esp, 8
cmp byte [esi + 0xb], 0
jns 0x4201d4
mov esi, dword [ebp - 0x28]
push 0x40044
push ebx
push esi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ebx, eax
cmp byte [ebp - 0x1d], 0
jns 0x4201f7
push dword [ebp - 0x28]
call fcn.00459b3c
add esp, 4
cmp byte [ebp - 0x11], 0
mov esi, 1
jns 0x42020d
push dword [ebp - 0x1c]
call fcn.00459b3c
add esp, 4
cmp ebx, 6
je 0x420228
mov dword [edi + 0x380], 0
mov ecx, 0x4f368c
call fcn.004118f0
jmp 0x420262
mov dword [edi + 0x380], 1
mov ecx, 0x4f368c
call fcn.004118f0
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xa
call fcn.00411a60
add esp, 4
call fcn.00411a30
jmp 0x420262
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
xor esi, esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045bb2d
mov eax, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x420b90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x448
mov eax, dword [0x4ef418]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [0x4f6c94], 0
je 0x420bc8
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045bb2d
mov eax, ebx
add esp, 0x448
pop esi
pop edi
pop ebx
pop ebp
ret
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.UpdateLayeredWindow
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4f6c94], eax
xor ebx, ebx
test eax, eax
je 0x420bb1
mov eax, 0x20a
lea edi, [ebp - 0x21a]
push eax
push ebx
push edi
call fcn.00463600
add esp, 0xc
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea esi, [ebp - 0x424]
mov eax, 0x20a
push eax
push ebx
push esi
call fcn.00463600
add esp, 0xc
push 0xffffffffffffffff
push str.dwmapi.dll
push edi
push 0x4d8df6
push 0x209
push esi
call fcn.00491d70
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x420c60
mov byte [0x4f6c98], 1
push str.DwmIsCompositionEnabled
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4f6c9c], eax
mov ecx, dword [ebp + 8]
mov dword [0x4f0124], ecx
lea edi, [ebp - 0x454]
mov dword [edi], 0x30
mov dword [edi + 4], 3
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [edi + 8], eax
xor esi, esi
mov dword [edi + 0xc], esi
mov dword [edi + 0x10], esi
mov dword [edi + 0x14], ecx
mov dword [edi + 0x18], esi
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], 6
mov dword [edi + 0x24], esi
mov eax, dword [str.PerryShadowWnd]
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], esi
push edi
call dword [sym.imp.USER32.dll_RegisterClassExW]
mov bl, 1
jmp 0x420bb1

Function at 0x420e50
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [ebp + 8]
mov dl, byte [ecx + 0xc]
mov ecx, edx
and cl, 9
mov byte [esi + 0xc], cl
test dl, 1
je 0x420e97
cmp cl, 7
ja 0x420e97
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x1c
mov dl, byte [esi + 0xc]
jae 0x420e95
mov ecx, edx
or cl, 4
mov byte [esi + 0xc], cl
test eax, 0x21000000
jne 0x420e97
or dl, 6
mov byte [esi + 0xc], dl
mov ecx, edx
mov eax, dword [esi + 4]
test cl, 2
jne 0x420ead
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 4
push 8
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
pop esi
pop ebp
jmp fcn.00421230