joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47c9d0
Capabilities:
Get file size

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0x10]
mov eax, dword [edi + 0x114]
mov esi, eax
test ecx, ecx
mov ebp, dword [esi + 8]
mov dword [esp + 0x14], ebp
lea ebx, [ebp - 1]
je 0x47c9fb
xor edx, edx
mov dword [esp + 0x10], edx
jmp 0x47c9ff
mov edx, dword [esp + 0x10]
test eax, eax
je 0x47ca32
test ebx, ebx
jl 0x47ca32
cmp ebx, dword [eax + 8]
jge 0x47ca32
mov ecx, dword [eax + 0xc]
add ecx, eax
cmp ebx, dword [ecx + 8]
jle 0x47ca24
mov ecx, dword [ecx + 0xc]
test ecx, ecx
je 0x47ca32
add ecx, eax
cmp ebx, dword [ecx + 8]
jg 0x47ca16
lea ebx, [esp + 0x10]
test ebx, ebx
je 0x47ca32
mov edx, ecx
mov dword [esp + 0x10], edx
test edx, edx
jne 0x47ca3f
mov edx, dword [esi + 0xc]
add edx, eax
mov dword [esp + 0x10], edx
mov ecx, dword [edx + 4]
mov ebx, dword [edx]
lea ecx, [ecx + ebx - 1]
cmp ecx, ebp
jge 0x47ca6c
lea edx, [esp + 0x10]
mov ecx, edi
push edx
call fcn.0047cb50
test eax, eax
jl 0x47cb3b
mov eax, dword [edi + 0x114]
mov edx, dword [esp + 0x10]
mov esi, eax
mov ebp, dword [esi + 0x18]
mov ebx, edx
sub ebx, eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x18], ebp
lea ebp, [eax + ebp + 0x20]
mov eax, dword [edi + 0x10c]
test eax, eax
jne 0x47ca90
mov eax, 0xfffffffe
jmp 0x47ca9d
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [esp + 0x10]
cmp eax, ebp
jae 0x47cacc
mov edx, dword [edi + 0x120]
mov ecx, ebp
sub ecx, eax
cmp ecx, edx
ja 0x47cab1
mov ecx, edx
add ecx, eax
push ecx
mov ecx, edi
call fcn.0047c220
test eax, eax
jl 0x47cb3b
mov esi, dword [edi + 0x114]
lea edx, [esi + ebx]
mov dword [esp + 0x10], edx
mov ebx, dword [esp + 0x14]
mov dword [edx + 8], ebx
mov ecx, dword [esi + 8]
inc ecx
mov dword [esi + 0x18], ebp
mov dword [esi + 8], ecx
mov edi, dword [edi + 0x114]
test edi, edi
je 0x47cb1b
test ebx, ebx
jl 0x47cb1b
cmp ebx, dword [edi + 8]
jge 0x47cb1b
mov eax, dword [edi + 0xc]
add eax, edi
cmp ebx, dword [eax + 8]
jle 0x47cb0b
mov eax, dword [eax + 0xc]
test eax, eax
je 0x47cb1b
mov ecx, dword [eax + edi + 8]
add eax, edi
cmp ebx, ecx
jg 0x47cafa
mov edx, dword [eax + 4]
mov ecx, ebx
sub ecx, edx
lea ecx, [ecx + ecx*4]
lea eax, [eax + ecx*4 + 0x10]
jmp 0x47cb1d
xor eax, eax
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
mov dword [eax + 8], ecx
add ecx, 0x20
mov dword [eax + 4], ecx
or ecx, 0xffffffff
mov dword [eax], edx
mov dword [eax + 0x10], ecx
mov dword [eax + 0xc], ecx
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x47cb50
Capabilities:
Get file size

Disassembly:
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x114]
mov ebp, dword [eax + 0x18]
mov eax, dword [esi + 0x11c]
lea ecx, [eax + eax*4]
mov eax, dword [esi + 0x10c]
test eax, eax
lea edi, [ebp + ecx*4 + 0x10]
jne 0x47cb7c
mov eax, 0xfffffffe
jmp 0x47cb85
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, edi
jae 0x47cbab
mov edx, dword [esi + 0x120]
mov ecx, edi
sub ecx, eax
cmp ecx, edx
ja 0x47cb99
mov ecx, edx
add ecx, eax
push ecx
mov ecx, esi
call fcn.0047c220
test eax, eax
jl 0x47cc30
push ebx
mov ebx, dword [esi + 0x114]
lea edx, [esp + 0x14]
mov ecx, dword [ebx + 8]
mov dword [ebx + 0x18], edi
dec ecx
test edx, edx
je 0x47cbc5
xor edi, edi
jmp 0x47cbc9
mov edi, dword [esp + 0x14]
mov edx, dword [esi + 0x114]
test edx, edx
je 0x47cbfe
test ecx, ecx
jl 0x47cbfe
cmp ecx, dword [edx + 8]
jge 0x47cbfe
mov eax, dword [edx + 0xc]
add eax, edx
cmp ecx, dword [eax + 8]
jle 0x47cbf4
mov eax, dword [eax + 0xc]
test eax, eax
je 0x47cbfe
add eax, edx
cmp ecx, dword [eax + 8]
jg 0x47cbe6
lea ecx, [esp + 0x14]
test ecx, ecx
je 0x47cbfe
mov edi, eax
mov dword [edi + 0xc], ebp
mov edi, dword [esi + 0x114]
add ebp, edi
mov eax, ebp
mov dword [eax + 0xc], 0
mov edx, dword [ebx + 8]
mov dword [eax + 4], edx
mov ecx, dword [ebx + 8]
dec ecx
pop ebx
mov dword [eax + 8], ecx
mov edx, dword [esi + 0x11c]
mov ecx, dword [esp + 0x10]
mov dword [eax], edx
mov dword [ecx], eax
xor eax, eax
pop edi
pop esi
pop ebp
ret 4
Function at 0x47cc40
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, dword [esp + 0x1c]
push edi
push 0x218
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
lea eax, [esp + 0xc]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, dword [sym.imp.USER32.dll_ScreenToClient]
lea ecx, [esp + 0xc]
push ecx
push esi
call edi
lea edx, [esp + 0x14]
push edx
push esi
call edi
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
add eax, ecx
mov ecx, dword [0x4f6130]
cdq
fld qword [0x4f0ca0]
sub eax, edx
mov edx, dword [esp + 0x10]
sar eax, 1
mov dword [0x4f6138], eax
mov eax, dword [esp + 0x18]
add eax, edx
push 0xffffffffffffffff
cdq
sub eax, edx
push 0
sar eax, 1
mov dword [0x4f613c], eax
push 0
fstp qword [ecx + 0x70]
mov ecx, dword [0x4f6130]
call fcn.004a14c0
mov eax, dword [0x4f612c]
test eax, eax
je 0x47cdda
mov edi, dword [sym.imp.USER32.dll_IsDlgButtonChecked]
push 0x1fd
push esi
call edi
test eax, eax
je 0x47cd46
mov edx, dword [0x4f612c]
mov ecx, dword [0x4f6130]
push 0xffffffffffffffff
push 0
push edx
call fcn.004a14c0
mov ecx, dword [0x4f6130]
push 0
call fcn.004a2350
mov eax, dword [0x4f6144]
mov ecx, dword [0x4f6140]
push eax
push ecx
mov ecx, dword [0x4f6130]
call fcn.004a25e0
mov ecx, dword [0x4f6130]
push 1
push 1
call fcn.004a1770
mov edx, dword [0x4f6130]
mov eax, dword [0x4f6148]
push 0
mov dword [edx + 0x7c], eax
mov ecx, dword [0x4f6130]
call fcn.004a20c0
mov ecx, dword [0x4f612c]
test ecx, ecx
je 0x47cdda
push 0xffffffffffffffff
call fcn.0049ddf0
test eax, eax
je 0x47cdda
push 0x1fd
push esi
call edi
test eax, eax
je 0x47cdda
mov ecx, dword [0x4f612c]
push 0xffffffffffffffff
call fcn.0049ddf0
mov ecx, dword [0x4f612c]
push 0xffffffffffffffff
mov esi, eax
call fcn.0049de70
mov edi, eax
push 0x44
lea edx, [esi + 2]
lea ecx, [edi + 2]
push ecx
mov ecx, dword [0x4f613c]
push edx
cdq
sub eax, edx
sar eax, 1
sub ecx, eax
mov eax, esi
cdq
sub eax, edx
mov edx, dword [0x4f6138]
sar eax, 1
sub edx, eax
dec ecx
dec edx
push ecx
push edx
push 0
push ebx
mov ebx, dword [sym.imp.USER32.dll_SetWindowPos]
call ebx
mov eax, dword [0x4f6130]
push 0x44
push edi
push esi
mov ecx, dword [eax + 0x50]
push 0
push 0
push 0
push ecx
call ebx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
push 0
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x47dbb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4d408c
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
mov ebx, dword [esp + 0x54]
push ebp
push esi
xor ebp, ebp
push edi
push ebp
mov edi, ecx
push ebx
call fcn.0047f5b0
mov esi, eax
add esp, 8
cmp esi, ebp
je 0x47dd96
lea ecx, [esp + 0x20]
call fcn.0047fa30
push esi
lea ecx, [esp + 0x24]
mov dword [esp + 0x5c], ebp
call fcn.004c3d57
lea eax, [esp + 0x38]
lea ecx, [esp + 0x20]
push eax
call fcn.0047fa80
mov esi, ebx
and esi, 0xffff
call fcn.0047f780
mov ebx, eax
cmp ebx, ebp
je 0x47dd85
push 0xf1
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebp
je 0x47dd85
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
cmp ebx, ebp
je 0x47dd85
xor ecx, ecx
xor edx, edx
mov cx, word [ebx + 4]
mov dx, word [ebx + 2]
push ecx
push edx
lea ecx, [esp + 0x20]
call fcn.0047f790
mov eax, dword [edi + 0x9c]
lea ecx, [edi + 0x9c]
cmp eax, ebp
jne 0x47dccb
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [ecx], eax
mov dword [ecx + 4], edx
push 4
push 4
lea ecx, [esp + 0x30]
call fcn.0047f790
mov ecx, dword [eax + 4]
push ecx
lea ecx, [esp + 0x1c]
mov edx, dword [eax]
lea eax, [esp + 0x34]
push edx
push eax
call fcn.0047f830
mov ecx, dword [eax]
push 0xa
mov dword [edi + 0xa4], ecx
mov ecx, dword [esp + 0x1c]
mov edx, dword [eax + 4]
mov eax, dword [esp + 0x20]
push ebp
push 0x21
push eax
push ecx
lea ecx, [edi + 0x38]
mov dword [edi + 0xa8], edx
call fcn.004bc117
jmp 0x47dce2
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push edx
push eax
call fcn.0047f7b0
test eax, eax
jne 0x47dd85
lea esi, [edi + 0x38]
mov ecx, esi
call fcn.0047fcc0
push 0xf
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_GetSysColor]
lea ecx, [esp + 0x20]
push eax
push ecx
mov ecx, esi
call fcn.0047fccf
cmp word [ebx + 6], 0
jbe 0x47dd57
lea edx, [ebx + 8]
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x10]
xor esi, esi
mov si, word [eax]
test esi, esi
jbe 0x47dd41
push esi
mov ecx, edi
call fcn.0047f5d0
test eax, eax
jge 0x47dd41
mov ecx, dword [esp + 0x14]
mov eax, ecx
inc ecx
mov dword [esp + 0x14], ecx
push eax
push esi
lea ecx, [edi + 0x40]
call fcn.0047f710
mov ecx, dword [esp + 0x10]
inc ebp
add ecx, 2
mov dword [esp + 0x10], ecx
xor ecx, ecx
mov cx, word [ebx + 6]
cmp ebp, ecx
jl 0x47dd13
mov edx, dword [esp + 0x60]
lea ecx, [edi + 0x24]
push edx
call fcn.0047f650
lea ecx, [esp + 0x20]
call fcn.004c3d84
lea ecx, [esp + 0x20]
mov dword [esp + 0x58], 0xffffffff
call fcn.0045d2a0
mov eax, 1
jmp 0x47dd98
lea ecx, [esp + 0x20]
mov dword [esp + 0x58], 0xffffffff
call fcn.0045d2a0
xor eax, eax
mov ecx, dword [esp + 0x50]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x4c
ret 4
Function at 0x47f1c0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
sub esp, 0x40
push esi
push edi
mov edi, dword [esp + 0x4c]
mov esi, ecx
push 9
mov ecx, edi
call fcn.004c28d9
test eax, eax
jle 0x47f1e2
pop edi
xor eax, eax
pop esi
add esp, 0x40
ret 8
mov eax, dword [esp + 0x50]
push ebx
push ebp
push eax
mov ecx, esi
xor ebx, ebx
call fcn.0047f690
mov esi, eax
test esi, esi
je 0x47f2ae
mov ebp, dword [sym.imp.USER32.dll_MapVirtualKeyA]
test ebx, ebx
mov eax, 0x4f0e50
jne 0x47f210
mov eax, 0x4f0e54
push eax
mov ecx, edi
call fcn.004c2806
test byte [esi], 0x10
je 0x47f229
push str.Alt
mov ecx, edi
call fcn.004c2806
test byte [esi], 8
je 0x47f23a
push 0x4f0e60
mov ecx, edi
call fcn.004c2806
test byte [esi], 4
je 0x47f24b
push 0x4f0e68
mov ecx, edi
call fcn.004c2806
test byte [esi], 1
je 0x47f27a
xor ecx, ecx
push 0
mov cx, word [esi + 2]
push ecx
call ebp
lea edx, [esp + 0x10]
push 0x40
shl eax, 0x10
push edx
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
lea eax, [esp + 0x10]
mov ecx, edi
push eax
call fcn.004c2806
jmp 0x47f285
mov cl, byte [esi + 2]
push ecx
mov ecx, edi
call fcn.004c282d
mov ax, word [esi + 4]
mov ebx, 1
test ax, ax
je 0x47f2ae
and eax, 0xffff
lea edx, [eax*4]
sub edx, eax
neg edx
lea esi, [esi + edx*2]
test esi, esi
jne 0x47f202
mov eax, ebx
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x40
ret 8

Function at 0x47f3f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d4194
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
push esi
lea ecx, [esp + 4]
call fcn.0047fc50
xor esi, esi
lea ecx, [esp + 4]
mov dword [esp + 0x68], esi
call fcn.0047fc70
push esi
push esi
push esi
lea ecx, [esp + 0x10]
call fcn.0047fc90
lea ecx, [esp + 0xc]
call fcn.004c0be8
lea eax, [esp + 4]
push 1
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x30], 1
call fcn.004c0d00
lea ecx, [esp + 0x34]
call fcn.0047f610
lea ecx, [esp + 0x34]
mov dword [esp + 0x38], 8
push ecx
push 0x400
push esi
lea ecx, [esp + 0x10]
call fcn.0047faa0
push eax
call dword [sym.imp.USER32.dll_GetMenuItemInfoA]
mov esi, dword [esp + 0x4c]
lea ecx, [esp + 4]
call fcn.004c19f0
lea ecx, [esp + 4]
mov dword [esp + 0x68], 0xffffffff
call fcn.00405100
mov ecx, dword [esp + 0x60]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x68
ret
Function at 0x4804a0
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push ebp
push esi
mov esi, ecx
push edi
push 0
push 0
mov eax, dword [esi + 0x1c]
push 0x418
push eax
call ebx
mov ecx, esi
mov edi, eax
call fcn.00480360
add eax, edi
lea edi, [eax*4]
push edi
call fcn.004bd49b
mov ecx, edi
mov ebp, eax
mov edx, ecx
xor eax, eax
mov edi, ebp
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0
and ecx, 3
push 0
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x1c]
push 0x418
push eax
mov dword [esp + 0x24], ebp
call ebx
mov ebx, eax
xor edi, edi
test ebx, ebx
jle 0x48052b
push edi
mov ecx, esi
call fcn.004c65ab
and eax, 0xffff
add ebp, 4
or eax, 0x10000
inc edi
mov dword [ebp - 4], eax
cmp edi, ebx
jl 0x48050a
mov ebp, dword [esp + 0x14]
mov ecx, esi
mov dword [esp + 0x10], 0
call fcn.00480360
test eax, eax
jle 0x480593
lea ecx, [ebp + edi*4]
xor ebx, ebx
mov dword [esp + 0x14], ecx
mov edx, dword [esi + 0xbc]
mov ecx, esi
mov eax, dword [edx + ebx + 4]
push eax
call fcn.004c6595
cmp eax, 0xffffffff
jne 0x48057a
mov ecx, dword [esi + 0xbc]
mov eax, dword [esp + 0x14]
xor edx, edx
inc edi
mov dx, word [ecx + ebx + 4]
mov dword [eax], edx
add eax, 4
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
mov ecx, esi
inc eax
add ebx, 0x64
mov dword [esp + 0x10], eax
call fcn.00480360
cmp dword [esp + 0x10], eax
jl 0x480548
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x18]
push eax
push ecx
push DrawStatusTextA
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4805d3
mov ecx, dword [esp + 0x18]
lea edx, [edi*4]
push edx
push ebp
push 3
push eax
mov eax, dword [esp + 0x34]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.004bd4c4
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x497140
Capabilities:
Enumerate files on windows
Get common file path
Set current directory

Disassembly:
sub esp, 0x450
push esi
mov esi, ecx
lea ecx, [esp + 0x24c]
push edi
mov eax, dword [esi + 0xb0]
push ecx
push 0x104
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x4f6278
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str..APL
lea edx, [esp + 0x358]
push 0x4f6278
push edx
call fcn.00471100
add esp, 0xc
lea eax, [esp + 0xc]
lea ecx, [esp + 0x354]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x497202
push ebx
mov ebx, dword [esp + 0x460]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea edx, [esp + 0x40]
lea eax, [esp + 0x154]
push edx
push 0x4f6278
push eax
call fcn.00471100
add esp, 0xc
lea ecx, [esp + 0x154]
push ecx
push ebx
mov ecx, esi
call fcn.00497230
lea edx, [esp + 0x14]
push edx
push edi
call ebp
test eax, eax
jne 0x4971b5
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
pop ebp
pop ebx
mov edi, dword [esi + 0xb0]
mov ecx, esi
call fcn.00496ff0
mov ecx, dword [esp + 8]
mov eax, edi
pop edi
sub eax, ecx
pop esi
add esp, 0x450
ret 4
Function at 0x49b770
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov bl, byte [esp + 8]
push esi
push edi
test bl, 1
mov esi, ecx
je 0x49b7ad
mov eax, dword [esi + 8]
xor edi, edi
test eax, eax
jle 0x49b7ad
cmp edi, eax
jge 0x49b797
test edi, edi
jl 0x49b797
mov eax, dword [esi + 4]
mov ecx, dword [eax + edi*4]
jmp 0x49b799
xor ecx, ecx
mov eax, dword [esi + 0xc8]
mov edx, dword [ecx]
push eax
call dword [edx + 0x14]
mov eax, dword [esi + 8]
inc edi
cmp edi, eax
jl 0x49b78b
test bl, 0x10
je 0x49b7e1
mov eax, dword [esi + 0x24]
xor edi, edi
test eax, eax
jle 0x49b7e1
cmp edi, eax
jge 0x49b7cb
test edi, edi
jl 0x49b7cb
mov ecx, dword [esi + 0x20]
mov ecx, dword [ecx + edi*4]
jmp 0x49b7cd
xor ecx, ecx
mov eax, dword [esi + 0xcc]
mov edx, dword [ecx]
push eax
call dword [edx + 0x14]
mov eax, dword [esi + 0x24]
inc edi
cmp edi, eax
jl 0x49b7bf
test bl, 2
je 0x49b815
mov eax, dword [esi + 0x40]
xor edi, edi
test eax, eax
jle 0x49b815
cmp edi, eax
jge 0x49b7ff
test edi, edi
jl 0x49b7ff
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + edi*4]
jmp 0x49b801
xor ecx, ecx
mov eax, dword [esi + 0xd0]
mov edx, dword [ecx]
push eax
call dword [edx + 0x14]
mov eax, dword [esi + 0x40]
inc edi
cmp edi, eax
jl 0x49b7f3
test bl, 4
je 0x49b849
mov eax, dword [esi + 0x5c]
xor edi, edi
test eax, eax
jle 0x49b849
cmp edi, eax
jge 0x49b833
test edi, edi
jl 0x49b833
mov ecx, dword [esi + 0x58]
mov ecx, dword [ecx + edi*4]
jmp 0x49b835
xor ecx, ecx
mov eax, dword [esi + 0xd4]
mov edx, dword [ecx]
push eax
call dword [edx + 0x14]
mov eax, dword [esi + 0x5c]
inc edi
cmp edi, eax
jl 0x49b827
test bl, 8
je 0x49b87d
mov eax, dword [esi + 0x78]
xor edi, edi
test eax, eax
jle 0x49b87d
cmp edi, eax
jge 0x49b867
test edi, edi
jl 0x49b867
mov ecx, dword [esi + 0x74]
mov ecx, dword [ecx + edi*4]
jmp 0x49b869
xor ecx, ecx
mov eax, dword [esi + 0xd8]
mov edx, dword [ecx]
push eax
call dword [edx + 0x14]
mov eax, dword [esi + 0x78]
inc edi
cmp edi, eax
jl 0x49b85b
pop edi
pop esi
pop ebx
ret 4
Function at 0x4a1ec0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x18
push esi
mov esi, ecx
mov ecx, dword [esi + 0x30]
test ecx, ecx
je 0x4a1faf
mov eax, dword [esi + 0x6d0]
push eax
call fcn.0049ddf0
test eax, eax
jle 0x4a1faf
mov edx, dword [esi + 0x4c]
push ebx
push ebp
lea ecx, [esp + 0x14]
push edi
push ecx
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
mov edi, dword [esp + 0x20]
mov ebx, dword [esp + 0x18]
mov eax, dword [esi + 0x6d0]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esi + 0x30]
sub edi, ebx
mov ebx, dword [esp + 0x24]
push eax
sub ebx, edx
call fcn.0049dfa0
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fmul qword [esi + 0x58]
fadd qword [0x4d6e18]
call fcn.004a7d38
mov ecx, dword [esi + 0x6d0]
mov ebp, eax
push ecx
mov ecx, dword [esi + 0x30]
call fcn.0049e050
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fmul qword [esi + 0x58]
fadd qword [0x4d6e18]
call fcn.004a7d38
mov ecx, eax
mov eax, edi
sub eax, ebp
cdq
sub eax, edx
mov edx, 0
sar eax, 1
sets dl
dec edx
and edx, eax
mov eax, ebx
sub eax, ecx
mov dword [esp + 0x10], edx
cdq
sub eax, edx
mov edx, 0
sar eax, 1
sets dl
dec edx
and eax, edx
cmp edi, ebp
jl 0x4a1f8b
mov edi, ebp
cmp ebx, ecx
jge 0x4a1f91
mov ecx, ebx
push 0x44
push ecx
mov ecx, dword [esi + 0x50]
push edi
push eax
mov eax, dword [esp + 0x20]
push eax
push 0
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x18
ret
mov edx, dword [esi + 0x50]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
add esp, 0x18
ret

Function at 0x4a20c0
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x710]
test eax, eax
jne 0x4a213b
mov eax, dword [esi + 0x30]
test eax, eax
je 0x4a213b
mov eax, dword [esi + 0x70c]
mov dword [esi + 0x710], 1
push eax
mov dword [esi + 0x714], 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [esi + 0x708]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea edx, [esp + 4]
push edx
push 4
push esi
push 0x4a2140
push 0
push 0
call fcn.004a899b
mov ecx, dword [esp + 0x24]
add esp, 0x18
mov dword [esi + 0x704], eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [esi + 0x704]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
pop ecx
ret 4
Function at 0x4a2420
Capabilities:
Create thread
Resume thread

Disassembly:
sub esp, 0x18
mov edx, dword [esp + 0x1c]
push esi
mov esi, ecx
mov ecx, dword [esi + 0x5c]
mov eax, dword [esi + 0x58]
mov dword [esp + 8], ecx
mov ecx, dword [esi + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esi + 0x58], edx
mov dword [esi + 0x700], 1
test ecx, ecx
mov dword [esi + 0x5c], eax
je 0x4a25d3
push 0xffffffffffffffff
call fcn.0049dfa0
test eax, eax
je 0x4a25d3
mov ecx, dword [esi + 0x30]
push edi
cmp dword [ecx], 0
je 0x4a255a
push 0xffffffffffffffff
call fcn.0049ddf0
mov ecx, dword [esi + 0x30]
push 0xffffffffffffffff
mov edi, eax
call fcn.0049dfa0
cmp edi, eax
jl 0x4a24a8
mov ecx, dword [esi + 0x30]
push 0xffffffffffffffff
call fcn.0049de70
mov ecx, dword [esi + 0x30]
push 0xffffffffffffffff
mov edi, eax
call fcn.0049e050
cmp edi, eax
jge 0x4a255a
mov ecx, dword [esi + 0x6d0]
push ecx
mov ecx, dword [esi + 0x30]
call fcn.0049daf0
fsubr qword [esp + 0x24]
fcomp qword [0x4d8f30]
fnstsw ax
test ah, 0x41
jne 0x4a255a
mov edx, dword [esi + 0x30]
push 0xffffffffffffffff
push 8
push edx
mov ecx, esi
call fcn.004a14c0
push 0
push 1
mov ecx, esi
call fcn.004a1770
mov eax, dword [esi + 0x710]
test eax, eax
jne 0x4a255a
mov eax, dword [esi + 0x30]
test eax, eax
je 0x4a255a
mov eax, dword [esi + 0x70c]
mov dword [esi + 0x710], 1
push eax
mov dword [esi + 0x714], 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov ecx, dword [esi + 0x708]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea edx, [esp + 0x24]
push edx
push 4
push esi
push 0x4a2140
push 0
push 0
call fcn.004a899b
add esp, 0x18
mov dword [esi + 0x704], eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [esi + 0x704]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, dword [esi + 0x50]
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x18]
mov ecx, dword [esi + 0x10]
cdq
sub eax, edx
mov edi, eax
sar edi, 1
mov eax, edi
add eax, ecx
mov dword [esp + 0x24], eax
fild dword [esp + 0x24]
fmul qword [esi + 0x58]
fdiv qword [esp + 8]
call fcn.004a7d38
sub eax, edi
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x1c]
cdq
sub eax, edx
mov edi, eax
sar edi, 1
add ecx, edi
mov dword [esp + 0x24], ecx
fild dword [esp + 0x24]
fmul qword [esi + 0x58]
fdiv qword [esp + 8]
call fcn.004a7d38
sub eax, edi
mov ecx, esi
mov dword [esi + 0x14], eax
call fcn.004a1df0
mov edx, dword [esi + 0x50]
push 1
push 0
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
add esp, 0x18
ret 8
Function at 0x4a4850
Capabilities:
Get file version info

Disassembly:
sub esp, 8
lea eax, [esp]
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
mov esi, ecx
push eax
push ebx
mov dword [esi], 0
mov dword [esi + 4], 0
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jne 0x4a4889
mov dword [esi], 3
pop edi
pop esi
pop ebx
add esp, 8
ret 4
push edi
call fcn.004bd49b
add esp, 4
mov dword [esi + 4], eax
push eax
push edi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x4a48b2
mov dword [esi], 4
pop edi
pop esi
pop ebx
add esp, 8
ret 4
mov eax, dword [esi + 4]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
push 0x4ed924
push eax
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x4a48dd
mov dword [esi], 5
pop edi
pop esi
pop ebx
add esp, 8
ret 4
lea edi, [esi + 8]
mov esi, dword [esp + 0x18]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
add esp, 8
ret 4