joyce8/EMBER2024-capa huggingface dataset:
Function at 0x478640
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [esp + 8], 0
je 0x478650
mov eax, esi
call fcn.00453d30
jmp 0x47865d
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [esp + 4]
test eax, eax
js 0x4786b8
je 0x4786b8
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call ebp
push 1
push 0x8000012f
mov edi, eax
call fcn.004013c0
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
add esp, 8
push esi
call ebx
test eax, eax
je 0x4786b5
add edi, dword [esp + 0x10]
call ebp
mov ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x4786b5
push 1
push 0x8000012f
call fcn.004013c0
add esp, 8
push esi
call ebx
test eax, eax
jne 0x478694
pop edi
pop ebp
pop ebx
mov eax, esi
ret
Function at 0x4788b0
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x8e60
call fcn.00493ca0
mov eax, dword [esp + 0x8e68]
push ebx
push ebp
mov ebp, dword [esp + 0x8e6c]
push esi
mov esi, ecx
mov cl, byte [edx]
xor ebx, ebx
cmp cl, 0x41
je 0x4788db
cmp cl, 0x61
jne 0x478939
cmp byte [edx + 1], bl
jne 0x478939
cmp byte [edi], bl
jne 0x478939
cmp byte [eax], bl
jne 0x478939
cmp byte [esi], bl
jne 0x478939
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
cmp esi, ebx
je 0x47891a
cmp byte [ebp + 0xca], bl
jne 0x47891a
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x478918
push esi
call fcn.004794a0
add esp, 4
test al, al
je 0x47891a
xor esi, esi
cmp byte [esp + 0x8e7c], bl
je 0x47892d
cmp esi, ebx
je 0x47892d
mov dword [ebp + 0xa4], esi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x8e60
ret
cmp cl, bl
jne 0x47895a
cmp byte [edi], bl
jne 0x47895a
cmp byte [eax], bl
jne 0x47895a
cmp byte [esi], bl
jne 0x47895a
mov eax, ebp
call fcn.00478ab0
pop esi
pop ebp
pop ebx
add esp, 0x8e60
ret
push esi
push edi
push edx
push ebp
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x828], 0x49b8bd
mov byte [esp + 0xc45], bl
mov dword [esp + 0xc48], ebx
mov dword [esp + 0xc4c], ebx
mov dword [esp + 0xc50], ebx
mov dword [esp + 0xc54], ebx
mov dword [esp + 0xc58], ebx
mov dword [esp + 0xc5c], ebx
mov dword [esp + 0xc68], ebx
mov dword [esp + 0xc6c], ebx
call fcn.00479600
test eax, eax
je 0x478a69
test byte [esp + 0xc], 2
mov al, byte [esp + 0x8e78]
mov ecx, dword [esp + 0x8e80]
mov edx, dword [esp + 0x8e84]
mov byte [esp + 0xc35], al
mov dword [esp + 0xc44], ecx
mov dword [esp + 0xc48], edx
je 0x478a75
mov eax, dword [esp + 0x828]
cmp eax, 0xffff
je 0x478a41
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x478a69
cmp byte [ebp + 0xca], bl
jne 0x478a3a
mov esi, dword [esp + 0x828]
call fcn.00479510
cmp al, bl
jne 0x478a3a
mov eax, dword [esp + 0x828]
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x40000000
je 0x478a69
mov eax, dword [esp + 0x828]
cmp dword [esp + 0xc5c], eax
je 0x478a5a
lea esi, [esp + 0xc]
mov dword [esp + 0xc5c], eax
call fcn.00479a40
push ebx
lea ecx, [esp + 0x10]
push ecx
call fcn.00479b00
test eax, eax
jne 0x478a85
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x8e60
ret
lea edx, [esp + 0xc]
push edx
push 0x478b30
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0xc3c]
cmp byte [esp + 0x8e7c], bl
je 0x478a9f
cmp eax, ebx
je 0x478a9f
mov dword [ebp + 0xa4], eax
pop esi
pop ebp
pop ebx
add esp, 0x8e60
ret
Function at 0x478cb0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x8018
call fcn.00493ca0
push ebx
push ebp
mov ebp, dword [esp + 0x8028]
push esi
push edi
mov edi, dword [esp + 0x802c]
mov esi, ecx
test edi, edi
je 0x478cd9
mov ecx, edi
call fcn.004147f0
cmp dword [esp + 0x8038], 0
jne 0x478cee
mov dword [esp + 0x8038], 0x1f4
cmp dword [esp + 0x803c], 1
jge 0x478d03
mov dword [esp + 0x803c], 0x32
cmp ebp, 1
jge 0x478d0d
mov ebp, 1
test esi, esi
je 0x478eda
mov ebx, dword [sym.imp.USER32.dll_SendMessageTimeoutA]
lea eax, [esp + 0x20]
push eax
push 0x7d0
push 2
push 0
push 0
push 0x406
push esi
call ebx
test eax, eax
je 0x478eda
cmp ebp, dword [esp + 0x20]
jg 0x478eda
push 0x8000
xor eax, eax
mov ecx, esi
lea edi, [esp + 0x1c]
call fcn.00475ab0
mov edi, eax
add esp, 4
mov dword [esp + 0x1c], edi
test edi, edi
je 0x478ed3
dec ebp
mov byte [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x24], eax
jmp 0x478d80
lea ecx, [esp + 0x14]
push ecx
push 0x7d0
push 2
push 0
push ebp
push 0x403
push esi
call ebx
test eax, eax
je 0x478df7
mov edx, 0x7fff
cmp word [esp + 0x14], dx
ja 0x478e4e
lea eax, [esp + 0x14]
push eax
push 0x7d0
push 2
push edi
push ebp
push 0x402
push esi
call ebx
test eax, eax
je 0x478df7
movzx ecx, word [esp + 0x14]
mov eax, dword [esp + 0x18]
push 0
inc ecx
push ecx
lea edx, [esp + 0x30]
push edx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x478e49
mov edx, dword [esp + 0x8034]
lea eax, [esp + 0x28]
call fcn.004781e0
test al, al
jne 0x478e74
cmp dword [esp + 0x802c], 0
jne 0x478e58
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x478ea7
mov edi, dword [esp + 0x8038]
test edi, edi
js 0x478e2e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x24]
add ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x478e8c
mov edx, dword [esp + 0x803c]
push 1
push edx
call fcn.004013c0
mov edi, dword [esp + 0x24]
add esp, 8
jmp 0x478d80
mov byte [esp + 0x28], 0
cmp dword [esp + 0x802c], 0
je 0x478ea7
mov eax, dword [esp + 0x802c]
push 1
push 0
push 0xffffffffffffffff
lea edx, [esp + 0x34]
push edx
push eax
call fcn.00477500
mov esi, eax
jmp 0x478eac
mov eax, dword [0x4adaf4]
push 1
push 0
push 0xffffffffffffffff
push 0x49b8d8
push eax
call fcn.00477500
jmp 0x478e4e
mov ecx, dword [0x4adaf4]
push 1
push 0
push 0xffffffffffffffff
push 0x49cf28
push ecx
call fcn.00477500
mov edi, dword [esp + 0x1c]
mov esi, 1
push 0x8000
push 0
push edi
mov edi, dword [esp + 0x24]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8018
ret
mov edi, dword [esp + 0x802c]
mov eax, 0x49cf28
test edi, edi
jne 0x478ee8
mov eax, 0x49d1e8
mov ecx, dword [0x4a9978]
test byte [ecx + 0xe0], 1
jne 0x478f15
mov edx, dword [0x4adaf4]
push 1
push 0
push 0xffffffffffffffff
push eax
push edx
call fcn.00477500
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8018
ret
mov ecx, dword [0x4ae61c]
push 0x49b8bd
push 0
push eax
call fcn.0042f3d0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8018
ret
Function at 0x479a40
Capabilities:
Get graphical window text

Disassembly:
push ecx
mov ecx, dword [esi + 0xc50]
test ecx, ecx
je 0x479af7
mov eax, dword [esi]
test eax, eax
je 0x479af7
push edi
test al, 1
jne 0x479a69
mov eax, dword [esi + 0x80c]
cmp byte [eax], 0
je 0x479a82
push 0x7fff
lea edi, [esi + 0xc58]
push edi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
jne 0x479a82
mov byte [edi], al
test byte [esi], 4
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
je 0x479a9d
mov edx, dword [esi + 0xc50]
lea ecx, [esi + 0xc54]
push ecx
push edx
call edi
test byte [esi], 0x20
je 0x479ad8
mov ecx, dword [esi + 0xc50]
lea eax, [esp + 4]
push eax
push ecx
call edi
test eax, eax
je 0x479ad8
movzx edx, byte [esi + 0xc28]
mov ecx, dword [esp + 4]
push edx
lea eax, [esi + 0x8d58]
call fcn.0044fde0
add esp, 4
test eax, eax
jne 0x479ad8
mov byte [esi + 0x8d58], al
test byte [esi], 8
pop edi
je 0x479af7
mov ecx, dword [esi + 0xc50]
push 0x101
lea eax, [esi + 0x8c57]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClassNameA]
pop ecx
ret

Function at 0x47a240
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x8e5c
call fcn.00493ca0
mov eax, dword [esp + 0x8e60]
mov eax, dword [eax + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x47a2ed
mov dword [esp + 0xc44], eax
lea eax, [esp + 4]
push eax
push 0x47a9c0
mov dword [esp + 0xc], ebx
mov dword [esp + 0x818], 0x49b8bd
mov byte [esp + 0xc35], bl
mov dword [esp + 0xc38], ebx
mov dword [esp + 0xc3c], ebx
mov dword [esp + 0xc40], ebx
mov dword [esp + 0xc44], ebx
mov dword [esp + 0xc48], ebx
mov dword [esp + 0xc58], ebx
mov dword [esp + 0xc5c], ebx
mov byte [esp + 0xc50], cl
mov dword [esp + 0xc54], edx
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [esp + 0xc34], ebx
je 0x47a2ed
mov ecx, dword [0x4a9978]
mov eax, dword [ecx + 0x54]
cmp eax, 0xffffffff
jle 0x47a2ed
push 1
push eax
call fcn.004013c0
add esp, 8
mov eax, 1
pop ebx
add esp, 0x8e5c
ret 4
Function at 0x47a300
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
cmp dword [edi + 8], 0
jne 0x47a31c
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov eax, dword [0x4a9978]
push eax
push esi
mov ecx, edi
call fcn.0047a7c0
cmp byte [edi], 0
mov dword [esp + 0x10], eax
je 0x47a353
test eax, eax
jne 0x47a357
mov ecx, dword [esp + 0x1c]
push eax
push ecx
push edi
call fcn.0047a410
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
test eax, eax
jne 0x47a3d6
test esi, esi
je 0x47a3d6
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
push 1
push 0x8000012f
mov ebx, eax
call fcn.004013c0
mov edi, dword [sym.imp.USER32.dll_IsWindow]
add esp, 8
push esi
call edi
test eax, eax
je 0x47a3b5
mov edi, edi
call ebp
lea ecx, [ebx + 0x1f4]
sub ecx, eax
cmp ecx, 5
jle 0x47a3b5
push 1
push 0x8000012f
call fcn.004013c0
add esp, 8
push esi
call edi
test eax, eax
jne 0x47a390
mov edx, dword [0x4a9978]
mov eax, dword [edx + 0x54]
cmp eax, 0xffffffff
jle 0x47a3ce
push 1
push eax
call fcn.004013c0
add esp, 8
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
cmp byte [edi], 0
je 0x47a3f0
mov ecx, dword [esp + 0x1c]
push 0
push ecx
push edi
call fcn.0047a410
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov edx, dword [esp + 0x1c]
push edx
mov ecx, edi
call fcn.0047a590
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x47a590
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x8e68
call fcn.00493ca0
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 8], ebx
je 0x47a710
xor cl, cl
mov eax, edi
call fcn.0047a730
test eax, eax
jne 0x47a5c5
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8e68
ret 4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, eax
mov eax, dword [0x4a9978]
push eax
push ebp
mov ecx, edi
call fcn.0047a7c0
test eax, eax
je 0x47a5e8
xor eax, eax
mov dword [0x4ae26c], eax
jmp 0x47a5ed
mov eax, dword [0x4ae26c]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x824], 0x49b8bd
mov dword [esp + 0xc44], ebx
mov dword [esp + 0xc48], ebx
mov dword [esp + 0xc4c], ebx
mov dword [esp + 0xc64], ebx
mov dword [esp + 0xc68], ebx
cmp byte [esp + 0x8e7c], bl
je 0x47a633
mov byte [esp + 0xc41], bl
cmp eax, ebx
je 0x47a63b
mov byte [esp + 0xc41], 1
mov ecx, dword [0x4ae268]
mov edx, dword [edi + 8]
mov esi, dword [sym.imp.USER32.dll_EnumWindows]
mov dword [esp + 0xc54], eax
lea eax, [esp + 0x18]
push eax
push 0x47a890
mov dword [esp + 0xc58], ecx
mov dword [esp + 0xc60], edx
call esi
mov eax, dword [esp + 0xc48]
cmp eax, ebx
je 0x47a6e8
lea ecx, [esp + 0x10]
push ecx
push 0x479370
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
call esi
mov esi, dword [esp + 0x14]
cmp esi, ebx
je 0x47a6a5
mov edx, dword [esp + 0xc48]
call fcn.00479f50
mov dword [esp + 0xc48], esi
mov eax, dword [esp + 0xc48]
call fcn.00478390
mov edx, dword [esp + 0xc48]
call fcn.00479f50
mov edx, dword [0x4a9978]
mov eax, dword [edx + 0x54]
cmp eax, 0xffffffff
jle 0x47a710
push 1
push eax
call fcn.004013c0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8e68
ret 4
mov eax, dword [0x4ae26c]
cmp eax, ebx
je 0x47a710
cmp eax, 1
setg al
mov dword [0x4ae26c], ebx
cmp al, bl
je 0x47a710
mov edx, ebp
call fcn.00479f50
push ebx
mov ecx, edi
call fcn.0047a590
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x8e68
ret 4
Function at 0x48e924
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a8df0]
jne 0x48e92e
repz ret
jmp fcn.00492ee7

Function at 0x490fa1
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4a8df0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0048b642
and dword [ebp - 0x14], 0
cmp dword [0x4abb2c], 0
mov dword [ebp - 0x18], eax
jne 0x491054
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4910fc
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4910fc
mov esi, dword [fcn.004873c0]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4abb2c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4abb30], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4abb34], eax
call edi
push eax
call esi
mov dword [0x4abb3c], eax
test eax, eax
je 0x491054
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4abb38], eax
mov eax, dword [0x4abb38]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.004873c4]
cmp eax, ecx
je 0x4910ad
cmp dword [0x4abb3c], ecx
je 0x4910ad
push eax
call esi
push dword [0x4abb3c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4910ad
test ebx, ebx
je 0x4910ad
call edi
test eax, eax
je 0x4910a4
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4910a4
test byte [ebp - 8], 1
jne 0x4910ad
or dword [ebp + 0x10], 0x200000
jmp 0x4910e0
mov eax, dword [0x4abb30]
cmp eax, dword [ebp - 0x18]
je 0x4910e0
push eax
call esi
test eax, eax
je 0x4910e0
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4910e0
mov eax, dword [0x4abb34]
cmp eax, dword [ebp - 0x18]
je 0x4910e0
push eax
call esi
test eax, eax
je 0x4910e0
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4abb2c]
call esi
test eax, eax
je 0x4910fc
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4910fe
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048e924
leave
ret
Function at 0x48ee74
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a9b30]
jne 0x48ee7e
repz ret
jmp fcn.00493927

Function at 0x491ab1
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4a9b30]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0048c052
and dword [ebp - 0x14], 0
cmp dword [0x4acb0c], 0
mov dword [ebp - 0x18], eax
jne 0x491b64
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x491c0c
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x491c0c
mov esi, dword [fcn.00488080]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4acb0c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4acb10], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4acb14], eax
call edi
push eax
call esi
mov dword [0x4acb1c], eax
test eax, eax
je 0x491b64
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4acb18], eax
mov eax, dword [0x4acb18]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.00488084]
cmp eax, ecx
je 0x491bbd
cmp dword [0x4acb1c], ecx
je 0x491bbd
push eax
call esi
push dword [0x4acb1c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x491bbd
test ebx, ebx
je 0x491bbd
call edi
test eax, eax
je 0x491bb4
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x491bb4
test byte [ebp - 8], 1
jne 0x491bbd
or dword [ebp + 0x10], 0x200000
jmp 0x491bf0
mov eax, dword [0x4acb10]
cmp eax, dword [ebp - 0x18]
je 0x491bf0
push eax
call esi
test eax, eax
je 0x491bf0
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x491bf0
mov eax, dword [0x4acb14]
cmp eax, dword [ebp - 0x18]
je 0x491bf0
push eax
call esi
test eax, eax
je 0x491bf0
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4acb0c]
call esi
test eax, eax
je 0x491c0c
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x491c0e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048ee74
leave
ret

Function at 0x43b645
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x43b3c1
sub edi, ebx
dec ebx
push 0xadf8f351
mov edi, dword [esp]
add esp, 4
call fcn.0043b67c
or edi, ebx
add ebx, 0xeb742cf2
xor dword [eax], ecx
mov edi, ebx
inc eax
mov edi, ebx
cmp eax, esi
jne fcn.0043b645
mov edi, ebx
dec edi
ret
Function at 0x403300
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x460c2c]
mov ecx, dword [0x4606bc]
push ebx
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x403377
mov edi, dword [sym.imp.KERNEL32.dll_GetDevicePowerState]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCalendarInfoW]
mov esi, ecx
mov dword [ebp - 4], eax
cmp dword [0x460c2c], 0x959
jne 0x403368
push 0
push 0
call edi
push 0
push 0
push 0
push 0
push 0
push 0
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
push esi
call fcn.004030c0
add esi, 8
sub dword [ebp - 4], 1
jne 0x40332a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408700
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4585b8]
jne 0x40870a
repz ret
jmp fcn.0040cf0b

Function at 0x40cc2e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004095e1
and dword [ebp - 4], 0
cmp dword [0x45e670], 0
mov ebx, eax
jne 0x40ccdf
push 0x401b58
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40cd90
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401b4c
push edi
call esi
test eax, eax
je 0x40cd90
push eax
call fcn.0040956f
mov dword [esp], 0x401b3c
push edi
mov dword [0x45e670], eax
call esi
push eax
call fcn.0040956f
mov dword [esp], 0x401b28
push edi
mov dword [0x45e674], eax
call esi
push eax
call fcn.0040956f
mov dword [esp], 0x401b0c
push edi
mov dword [0x45e678], eax
call esi
push eax
call fcn.0040956f
pop ecx
mov dword [0x45e680], eax
test eax, eax
je 0x40ccdf
push 0x401af4
push edi
call esi
push eax
call fcn.0040956f
pop ecx
mov dword [0x45e67c], eax
mov eax, dword [0x45e67c]
cmp eax, ebx
je 0x40cd37
cmp dword [0x45e680], ebx
je 0x40cd37
push eax
call fcn.004095ea
push dword [0x45e680]
mov esi, eax
call fcn.004095ea
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40cd37
test edi, edi
je 0x40cd37
call esi
test eax, eax
je 0x40cd2e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40cd2e
test byte [ebp - 0xc], 1
jne 0x40cd37
or dword [ebp + 0x10], 0x200000
jmp 0x40cd70
mov eax, dword [0x45e674]
cmp eax, ebx
je 0x40cd70
push eax
call fcn.004095ea
pop ecx
test eax, eax
je 0x40cd70
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40cd70
mov eax, dword [0x45e678]
cmp eax, ebx
je 0x40cd70
push eax
call fcn.004095ea
pop ecx
test eax, eax
je 0x40cd70
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45e670]
call fcn.004095ea
pop ecx
test eax, eax
je 0x40cd90
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40cd92
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100010b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x101284f8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101636d0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
xor ebp, ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x24], fcn.100cf978
mov dword [esp + 0x28], fcn.100cfa42
mov dword [esp + 0x2c], fcn.100cf89b
lea ebx, [edi + 0x1c]
push ebx
mov dword [esp + 0x3c], ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 0xc]
push edi
lea esi, [esp + 0x18]
mov dword [esp + 0x24], eax
call fcn.10001210
mov eax, dword [edi]
cmp eax, ebp
je 0x10001138
mov ecx, dword [edi + 0x18]
cmp ecx, ebp
jne 0x10001130
mov ecx, fcn.100cf89b
push eax
call ecx
add esp, 4
mov dword [edi], ebp
push ebx
mov dword [edi + 4], ebp
mov dword [edi + 8], ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
xor esi, esi
cmp ebx, ebp
jle 0x10001167
cmp dword [edi + esi*4], ebp
je 0x10001162
mov ecx, dword [edi + esi*4]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
call eax
inc esi
cmp esi, ebx
jl 0x10001153
mov dword [esp + 0x38], 0xffffffff
cmp edi, ebp
je 0x10001186
mov eax, dword [esp + 0x2c]
cmp eax, ebp
jne 0x10001180
mov eax, fcn.100cf89b
push edi
call eax
add esp, 4
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x10003340
Capabilities:
Get common file path

Disassembly:
cmp dword [edi + 0x120], 0
je 0x10003353
mov dword [edi + 0x120], 0
push ebp
push esi
lea esi, [edi + 8]
mov ecx, 1
mov dword [edi + 4], 0
call fcn.100632f0
cmp byte [esi + 0x114], 0
je 0x10003377
add esi, 4
jmp 0x10003379
mov esi, dword [esi]
xor eax, eax
mov word [esi + 4], ax
call fcn.100680e0
cmp word [eax + 0x4d4], 0
lea esi, [eax + 0x4d4]
jne 0x100033ba
mov ebp, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push esi
push 0
push 0
push 0x23
push 0
call ebp
test eax, eax
je 0x100033ba
push esi
push 1
push 0
push 0x23
push 0
call ebp
test eax, eax
je 0x100033ba
xor esi, esi
push esi
push 0x1013c7e4
mov edx, edi
call fcn.10062cd0
push 0x1013c82c
push 0x1013c7e4
mov edx, edi
call fcn.10062cd0
push str.SogouInputComponentsPicfaceJson
push 0x1013c7e4
mov edx, edi
call fcn.10062cd0
add esp, 0x18
pop esi
mov al, 1
pop ebp
ret

Function at 0x10003400
Capabilities:
Get common file path

Disassembly:
cmp dword [edi + 0x120], 0
je 0x10003413
mov dword [edi + 0x120], 0
push ebp
push esi
lea esi, [edi + 8]
mov ecx, 1
mov dword [edi + 4], 0
call fcn.100632f0
cmp byte [esi + 0x114], 0
je 0x10003437
add esi, 4
jmp 0x10003439
mov esi, dword [esi]
xor eax, eax
mov word [esi + 4], ax
call fcn.100680e0
cmp word [eax + 0x4d4], 0
lea esi, [eax + 0x4d4]
jne 0x1000347a
mov ebp, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push esi
push 0
push 0
push 0x23
push 0
call ebp
test eax, eax
je 0x1000347a
push esi
push 1
push 0
push 0x23
push 0
call ebp
test eax, eax
je 0x1000347a
xor esi, esi
push esi
push 0x1013c7e4
mov edx, edi
call fcn.10062cd0
push 0x1013c82c
push 0x1013c7e4
mov edx, edi
call fcn.10062cd0
push str.SogouInputComponentsPicfaceDownload
push 0x1013c7e4
mov edx, edi
call fcn.10062cd0
add esp, 0x18
pop esi
mov al, 1
pop ebp
ret