joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445f20
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp - 0x208]
push ebx
push esi
push edi
push 0x208
push 0
push eax
call fcn.0049a3b0
add esp, 0xc
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx esi, ax
lea eax, [ebp - 0x208]
push 0x104
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
shr esi, 0xf
not esi
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
mov ebx, eax
and esi, 1
je 0x445f7d
call fcn.00491a51
push 0
call fcn.00492880
pop ecx
xor edi, edi
test ebx, ebx
jle 0x445fb1
push 0x104
lea eax, [ebp - 0x208]
push eax
push edi
push dword [ebp + 0xc]
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
push 0
lea eax, [ebp - 0x208]
push 0
push eax
call fcn.00491763
add esp, 0xc
inc edi
cmp edi, ebx
jl 0x445f83
pop edi
test esi, esi
pop esi
pop ebx
je 0x445fbd
call fcn.0048fa6a
call fcn.0045c8b5
xor eax, eax
inc eax
leave
ret
Function at 0x445fc7
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
push ebx
push esi
push edi
jne 0x44608a
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
xor ebx, ebx
movsx esi, ax
sar esi, 0xf
cmp byte [0x501d06], bl
jne 0x446001
test esi, esi
jne 0x446001
cmp dword [0x52fd24], ebx
je 0x446013
push ebx
push dword [ebp + 8]
call edi
test esi, esi
jne 0x446017
cmp dword [0x52fd24], ebx
jne 0x446017
mov al, 1
jmp 0x446024
push 0x531f98
call fcn.00476f75
pop ecx
mov al, 2
mov byte [0x504abc], al
cmp dword [0x4f7c80], ebx
je 0x44606a
mov eax, dword [0x531f78]
test eax, eax
je 0x44606a
mov esi, dword [sym.imp.USER32.dll_GetParent]
push eax
call esi
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x446061
push dword [0x531f78]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x44606a
push ebx
push dword [0x531f78]
call edi
cmp dword [0x4f7c70], ebx
je 0x44607f
mov eax, dword [0x531f74]
test eax, eax
je 0x44607f
push ebx
push eax
call edi
mov dword [0x52fd24], ebx
jmp 0x446171
cmp dword [ebp + 0xc], 0
jne 0x446171
cmp byte [0x504abc], 2
jne 0x4460af
mov al, byte [0x501d06]
cmp al, 1
je 0x4460af
cmp al, 2
je 0x4460af
call fcn.0047707d
xor ebx, ebx
cmp dword [0x53370c], ebx
je 0x4460c4
mov dword [0x53370c], ebx
call fcn.00469bfd
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
jne 0x4460e5
cmp dword [0x5332a4], ebx
jne 0x4460e5
push 8
push esi
call edi
cmp byte [0x504abc], bl
je 0x4460f4
push ebx
call fcn.00468d52
pop ecx
cmp dword [0x4f7c74], ebx
jne 0x446103
push esi
call fcn.0048ca79
pop ecx
push ebx
push 0x2a
push 0x113
push esi
mov byte [0x504abc], bl
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x5332a4], ebx
jne 0x446127
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp dword [0x4f7c80], ebx
je 0x44613d
mov eax, dword [0x531f78]
test eax, eax
je 0x44613d
push 8
push eax
call edi
cmp dword [0x4f7c70], ebx
je 0x446153
mov eax, dword [0x531f74]
test eax, eax
je 0x446153
push 8
push eax
call edi
cmp dword [0x505104], ebx
je 0x44616a
mov ecx, dword [0x531f7c]
test ecx, ecx
je 0x44616a
push 8
push ecx
call edi
push ebx
call fcn.00468d52
pop ecx
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
pop ebp
ret
Function at 0x44617e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
sub eax, 0x202
je 0x4461c6
sub eax, 3
jne 0x44622d
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push dword [ebp + 8]
push 0
push dword [ebp - 4]
push dword [ebp - 8]
push 2
push dword [0x531e60]
call dword [sym.imp.USER32.dll_TrackPopupMenu]
jmp 0x44622d
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push edi
push 0x11
call esi
bt ax, 0xf
jae 0x4461e2
push 0
push 0x9cf9
jmp 0x4461f4
push 0x10
call esi
bt ax, 0xf
jae 0x446204
push 0
push 0x9c5d
push 0x111
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x44622b
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x446224
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 9
push edi
call esi
push 5
push edi
call esi
jmp 0x44622b
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
xor eax, eax
inc eax
leave
ret
Function at 0x4493ed
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x588
lea eax, [ebp - 0x588]
push ebx
push esi
push 0x208
xor ebx, ebx
push ebx
push eax
call fcn.0049a3b0
push 0x100
lea eax, [ebp - 0x178]
push ebx
push eax
call fcn.0049a3b0
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x588]
add esp, 0x18
push eax
push 0x104
call esi
push 0x50
lea eax, [ebp - 0x54]
push ebx
push eax
call fcn.0049a3b0
add esp, 0xc
cmp dword [0x50c720], ebx
jne 0x4495e5
push edi
push 0x7ff00
push 0x40
mov dword [0x50c720], 1
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, dword [ebp + 0xc]
mov edi, eax
push 0
mov dword [ebp - 0x5c], 0x58
mov dword [ebp - 0x58], ebx
call fcn.00489938
mov ecx, dword [ebp + 8]
neg ecx
mov dword [ebp - 4], eax
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x178]
push 0x80
sbb ecx, ecx
mov dword [ebp - 0x40], edi
push eax
add ecx, 0xfb
mov dword [ebp - 0x3c], 0x3ff7f
push ecx
call fcn.00441947
mov dword [ebp - 0x2c], eax
add esp, 0x10
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], 0x4cada0
mov dword [ebp - 0x30], eax
test eax, eax
jne 0x4494d2
mov ecx, dword [0x531bc4]
call fcn.0040c29e
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 0x81a04
cmp ebx, dword [0x531f70]
jne 0x4494e6
call fcn.0044901f
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
test eax, eax
je 0x449595
push 0x208
lea eax, [ebp - 0x380]
push 0
push eax
call fcn.0049a3b0
add esp, 0xc
lea eax, [ebp - 0x380]
push eax
push 0x104
call esi
mov ecx, dword [0x531bc4]
lea eax, [ebp - 0x380]
push eax
call fcn.0040c2a4
cmp dword [ebp + 8], 0
je 0x44953d
xor esi, esi
call fcn.00491a51
jmp 0x449544
call fcn.00492412
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor ecx, ecx
cmp word [edi + eax*2 + 2], cx
je 0x44956e
push edi
call fcn.00491112
test byte [0x504ac8], 1
pop ecx
je 0x44958a
push esi
push 2
call fcn.00492e83
jmp 0x449588
push ecx
push 1
push edi
call fcn.00490c45
add esp, 0xc
cmp eax, 0xffffffff
jne 0x44958a
xor eax, eax
push eax
push edi
call fcn.00491330
pop ecx
pop ecx
cmp dword [ebp + 8], 0
je 0x449595
call fcn.0048fa6a
lea eax, [ebp - 0x588]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp ebx, dword [0x531f70]
jne 0x4495af
call fcn.00448ee8
push 1
push 0x20e
push 0x200
push dword [0x531f70]
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x4495af
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
call esi
push edi
call esi
xor eax, eax
mov dword [0x50c720], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44d628
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
mov edi, ebx
cmp dword [ebp + 0x10], ebx
jne 0x44d658
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov edi, eax
push 0x2e
pop eax
cmp ax, word [edi]
jne 0x44d6f0
add edi, 2
push 0xffffffffffffffff
push 0x4ccb6c
push 0xffffffffffffffff
push edi
push 1
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringW]
push 2
pop ecx
cmp eax, ecx
jne 0x44d67e
mov esi, dword [ebp + 8]
mov dword [esi + 8], ecx
jmp 0x44d6fa
push 0xffffffffffffffff
push 0x4d2f7c
push 0xffffffffffffffff
push edi
push 1
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x44d6a6
mov esi, dword [ebp + 8]
mov dword [esi + 8], 4
jmp 0x44d6fa
push 0x208
lea eax, [ebp - 0x208]
push ebx
push eax
call fcn.0049a3b0
add esp, 0xc
lea eax, [ebp - 0x208]
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x503b80
push eax
call esi
push str.winamp.lng
lea eax, [ebp - 0x208]
push eax
push eax
call esi
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x44d6f4
xor eax, eax
jmp 0x44d759
mov esi, dword [ebp + 8]
mov dword [esi + 8], ebx
push dword [ebp + 0xc]
cmp dword [ebp + 0x10], ebx
jne 0x44d71d
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
sub edi, eax
sar edi, 1
dec edi
push edi
mov edi, dword [ebp + 0x14]
push eax
push dword [ebp + 0x18]
push edi
call fcn.0044efab
jmp 0x44d729
push dword [ebp + 0x18]
mov edi, dword [ebp + 0x14]
push edi
call fcn.0040c4d6
mov eax, dword [ebp + 0xc]
mov dword [esi], eax
mov dword [esi + 4], edi
cmp dword [ebp + 0x1c], ebx
je 0x44d753
push 0xffffffffffffffff
push eax
push 0xffffffffffffffff
push dword [ebp + 0x1c]
push 1
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x44d753
xor ebx, ebx
inc ebx
xor eax, eax
mov dword [esi + 0xc], ebx
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44decd
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x458
xor eax, eax
push esi
mov esi, dword [ebp + 0xc]
cmp word [0x503f90], ax
jne 0x44df06
test esi, esi
je 0x44deee
cmp word [esi], ax
jne 0x44df06
push str._tWinamp_Default_Language
push 0x4b6
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
jmp 0x44e04f
push ebx
push edi
push 0x208
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.0049a3b0
mov ebx, dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x208]
add esp, 0xc
mov edi, 0x5043a0
test esi, esi
cmovne edi, esi
push str.readme.txt
push edi
push eax
call ebx
lea eax, [ebp - 0x208]
push 0x4cc550
push eax
call fcn.004a33b3
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x44e036
push str.read_me.txt
push edi
lea eax, [ebp - 0x208]
push eax
call ebx
lea eax, [ebp - 0x208]
push 0x4cc550
push eax
call fcn.004a33b3
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x44e036
push 0x250
push eax
lea eax, [ebp - 0x458]
push eax
call fcn.0049a3b0
add esp, 0xc
lea eax, [ebp - 0x208]
push str..txt
push edi
push eax
call ebx
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
xor eax, eax
mov word [ebp - 0x208], ax
cmp esi, 0xffffffff
je 0x44e014
lea eax, [ebp - 0x42c]
push eax
push edi
lea eax, [ebp - 0x208]
push eax
call ebx
test eax, eax
jne 0x44dff4
lea eax, [ebp - 0x458]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x44dfcd
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x208]
push 0x4cc550
push eax
call fcn.004a33b3
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x44e036
push 0
push 0
push 0x11e
call fcn.00441947
add esp, 0xc
push eax
push 0x4b6
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
jmp 0x44e04d
push 0x4b6
push dword [ebp + 8]
push esi
call fcn.004527ac
push esi
call fcn.004a3458
add esp, 0x10
pop edi
pop ebx
pop esi
leave
ret
Function at 0x44ee93
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
lea eax, [ebp - 0x80]
push ebx
push edi
push 0x80
xor edi, edi
push edi
push eax
call fcn.0049a3b0
add esp, 0xc
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jb 0x44eef2
push 0x31
push 0x40
lea eax, [ebp - 0x80]
push eax
push 0x10a
call fcn.00441947
add esp, 0xc
push eax
push edi
push edi
push 0x68
call fcn.00441947
add esp, 0xc
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
je 0x44ef01
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x44ef48
push 0x104
push dword [ebp + 0xc]
xor eax, eax
push 0x503f90
mov word [0x504198], ax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
call fcn.0041414f
push 0x19
push str.show_prefs
call fcn.0041202d
pop ecx
pop ecx
push 0x87
push edi
push 0x400
push dword [0x531f70]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x44ef67
mov eax, dword [ebp + 0xc]
cmp word [eax], di
jne 0x44ef56
push 0x3c
pop ecx
mov word [eax], cx
push 0x104
push eax
push 0x504198
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
pop edi
pop ebx
leave
ret
Function at 0x452298
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x498
push ebx
push esi
push edi
xor edi, edi
cmp word [0x504ce0], di
je 0x4524aa
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, 0x400
push 0x661
push edi
push ebx
push dword [0x531f70]
call esi
cmp eax, 0x10000
jg 0x452480
push 0x279
push edi
push ebx
push dword [0x531f70]
call esi
cmp eax, 0x10000
jg 0x4524fb
push 0x208
lea eax, [ebp - 0x248]
push edi
push eax
call fcn.0049a3b0
mov ebx, dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x248]
add esp, 0xc
push str.readme.txt
push 0x504ee8
push eax
call ebx
lea eax, [ebp - 0x248]
push 0x4cc550
push eax
call fcn.004a33b3
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x452491
push str.read_me.txt
push 0x504ee8
lea eax, [ebp - 0x248]
push eax
call ebx
lea eax, [ebp - 0x248]
push 0x4cc550
push eax
call fcn.004a33b3
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x452491
push str.file_id.diz
push 0x504ee8
lea eax, [ebp - 0x248]
push eax
call ebx
lea eax, [ebp - 0x248]
push 0x4cc550
push eax
call fcn.004a33b3
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x452491
push str..txt
push 0x504ee8
lea eax, [ebp - 0x248]
push eax
call ebx
lea eax, [ebp - 0x498]
push eax
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
xor eax, eax
mov word [ebp - 0x248], ax
cmp esi, 0xffffffff
je 0x452471
lea eax, [ebp - 0x46c]
push str.pledit.txt
push eax
call fcn.0049e71a
pop ecx
pop ecx
test eax, eax
je 0x45241d
lea eax, [ebp - 0x46c]
push str.viscolor.txt
push eax
call fcn.0049e71a
pop ecx
pop ecx
test eax, eax
je 0x45241d
lea eax, [ebp - 0x46c]
push str.region.txt
push eax
call fcn.0049e71a
pop ecx
pop ecx
test eax, eax
jne 0x452431
lea eax, [ebp - 0x498]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4523d8
jmp 0x452446
lea eax, [ebp - 0x46c]
push eax
push 0x504ee8
lea eax, [ebp - 0x248]
push eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
cmp ax, word [ebp - 0x248]
jne 0x452471
lea eax, [ebp - 0x248]
push 0x4cbf48
push eax
call fcn.004a33b3
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x452491
push edi
push edi
push 0x11e
call fcn.00441947
add esp, 0xc
push eax
push 0x4b6
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
jmp 0x45250a
push 0x4b6
push dword [ebp + 8]
push esi
call fcn.004527ac
push esi
call fcn.004a3458
add esp, 0x10
jmp 0x45250a
mov esi, 0x100
lea eax, [ebp - 0x348]
push esi
push edi
push eax
call fcn.0049a3b0
push 0x40
lea eax, [ebp - 0x40]
push edi
push eax
call fcn.0049a3b0
add esp, 0x18
lea eax, [ebp - 0x40]
push 0x4d7594
push 0x40
push eax
push 0x175
call fcn.00441922
add esp, 0xc
push eax
lea eax, [ebp - 0x348]
push esi
push eax
call fcn.00405a8d
add esp, 0x10
lea eax, [ebp - 0x348]
push eax
push 0x4b6
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4525f5
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x670
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x4526bd
xor edi, edi
cmp word [0x504ce0], di
je 0x4526c4
push 0x504ce0
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov ebx, eax
mov ecx, 0x504ce0
mov dword [ebp + 8], ebx
cmp ebx, ecx
je 0x4526c7
push 0x104
lea eax, [ebp - 0x218]
push eax
push ecx
push 0x502f50
call fcn.0047ab47
add esp, 0x10
test eax, eax
je 0x4526c7
push 0x502f50
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.0047abea
add esp, 0xc
test eax, eax
je 0x4526c7
cmp eax, 2
je 0x4526c7
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4526c7
push edi
push 0x104
lea eax, [ebp - 0x218]
push eax
push edi
lea eax, [ebp - 0x10]
push 0x504ce0
push eax
call fcn.00451c3a
add esp, 0x18
test eax, eax
je 0x4526c7
push dword [ebp + 0xc]
xor eax, eax
inc eax
mov dword [ebp - 4], eax
mov edi, eax
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
jne 0x4526c7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
and dword [ebp + 8], edi
push 0x4cdb38
push 0x502f50
lea eax, [ebp - 0x670]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x468]
push eax
lea eax, [ebp - 0x670]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x452761
mov ecx, dword [ebp + 8]
xor eax, eax
test edi, edi
cmovne ecx, eax
lea eax, [ebp - 0x218]
push ecx
push 0x104
push eax
mov eax, dword [ebp - 0x468]
and eax, 0x10
push eax
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00451c3a
add esp, 0x18
test eax, eax
je 0x452748
cmp dword [ebp - 4], 0
push 1
pop eax
push dword [ebp + 0xc]
cmovne edi, eax
lea eax, [ebp - 0x10]
push eax
call esi
test eax, eax
je 0x45275a
lea eax, [ebp - 0x468]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4526f9
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp word [0x50cdd0], 0
mov ebx, 0x50cdd0
jne 0x452780
push 0x40
push ebx
push 0x174
call fcn.00441947
add esp, 0xc
and dword [ebp - 0x10], 0
xor eax, eax
push dword [ebp + 0xc]
test edi, edi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], 3
sete al
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
call esi
neg eax
sbb eax, eax
neg eax
jmp 0x4526bf
Function at 0x4527ac
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1080c
call fcn.004990f0
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push edi
push esi
push 1
xor ebx, ebx
push 3
push eax
mov dword [ebp - 0xc], ebx
mov byte [ebp - 5], bl
mov word [ebp - 4], bx
mov byte [ebp - 2], bl
call fcn.004a371a
add esp, 0x10
cmp eax, 1
jne 0x4527fe
cmp byte [ebp - 4], 0xef
jne 0x4527fe
cmp byte [ebp - 3], 0xbb
jne 0x4527fe
cmp byte [ebp - 2], 0xbf
jne 0x4527fe
mov byte [ebp - 5], al
jmp 0x452923
push ebx
push ebx
push esi
call fcn.004a3b2c
push esi
push 1
lea eax, [ebp - 4]
push 2
push eax
call fcn.004a371a
add esp, 0x1c
cmp eax, 1
jne 0x452918
cmp byte [ebp - 4], 0xff
jne 0x452918
cmp byte [ebp - 3], 0xfe
jne 0x452918
push 0x10800
lea eax, [ebp - 0x1080c]
push ebx
push eax
call fcn.0049a3b0
push esi
lea edi, [ebp - 0x1080c]
mov ebx, 0x400
mov eax, edi
push ebx
push eax
call fcn.004a323b
push esi
call fcn.004a34dc
add esp, 0x1c
jmp 0x4528ef
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xc]
jne 0x45286e
sub ecx, edx
sar ecx, 1
cmp word [edi + ecx*2 - 2], 0xa
jne 0x4528a2
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xc]
jne 0x45288b
sub ecx, edx
sar ecx, 1
xor eax, eax
mov word [edi + ecx*2 - 2], ax
push 0x4cbf10
push 0x8400
push edi
call fcn.0040ad38
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xc]
jne 0x4528b7
sub ecx, edx
sar ecx, 1
lea edi, [edi + ecx*2]
mov eax, edi
lea ecx, [ebp - 0x1080c]
sub eax, ecx
and eax, 0xfffffffe
cmp eax, 0x10000
jg 0x4528f7
push esi
push ebx
push edi
call fcn.004a323b
push esi
call fcn.004a34dc
add esp, 0x10
test eax, eax
je 0x452869
xor eax, eax
mov word [ebp - 0x80e], ax
lea eax, [ebp - 0x1080c]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
jmp 0x4529f4
push ebx
push ebx
push esi
call fcn.004a3b2c
add esp, 0xc
push 0x8400
lea eax, [ebp - 0x840c]
push ebx
push eax
call fcn.0049a3b0
push esi
lea edi, [ebp - 0x840c]
mov eax, edi
push 0x400
push eax
call fcn.004a3230
push esi
call fcn.004a34dc
add esp, 0x1c
test eax, eax
jne 0x4529b0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
call ebx
cmp byte [eax + edi - 1], 0xa
jne 0x45296f
push edi
call ebx
xor ecx, ecx
mov byte [eax + edi - 1], cl
push 0x4cbf18
push 0x8400
push edi
call fcn.0040acbc
push edi
call ebx
add edi, eax
lea ecx, [ebp - 0x840c]
mov eax, edi
sub eax, ecx
cmp eax, 0x8000
jg 0x4529ae
push esi
push 0x400
push edi
call fcn.004a3230
push esi
call fcn.004a34dc
add esp, 0x10
test eax, eax
je 0x45295c
xor ebx, ebx
cmp byte [ebp - 5], 0
lea eax, [ebp - 0x840c]
mov byte [ebp - 0x40d], bl
je 0x4529e7
push 0xfde9
push eax
call fcn.00405018
pop ecx
pop ecx
mov esi, eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push esi
call fcn.004a1b5f
pop ecx
jmp 0x4529f4
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x453c8b
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movaps xmm0, xmmword [0x4d3f90]
movups xmmword [ebp - 0x50], xmm0
push ebx
movaps xmm0, xmmword [0x4d3fb0]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
movups xmmword [ebp - 0x40], xmm0
push esi
movaps xmm0, xmmword [0x4d3fc0]
xor esi, esi
movups xmmword [ebp - 0x30], xmm0
movaps xmm0, xmmword [0x4d3f80]
movups xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [0x4d3f70]
movups xmmword [ebp - 0x10], xmm0
xor eax, eax
cmp dword [0x531f5c], eax
sete al
push eax
push dword [ebp + esi*4 - 0x50]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call ebx
inc esi
cmp esi, 0x14
jb 0x453cd2
push 0x4f3
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
xor edx, edx
cmp dword [0x531f5c], edx
sete dl
xor ecx, ecx
cmp edx, eax
setne cl
push ecx
push 0x587
push dword [ebp + 8]
call esi
push eax
call ebx
cmp dword [0x531f5c], 0
je 0x453d40
push 5
push 0x4f5
push dword [ebp + 8]
call esi
push eax
call ebx
pop esi
pop ebx
leave
ret

Function at 0x455c25
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4c7395
call fcn.0049911c
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
xor ebx, ebx
mov dword [edi], vtable.PaletteManager.0
lea esi, [edi + 0xc]
mov dword [ebp - 4], ebx
push ebx
mov ecx, esi
mov dword [ebp - 0x14], esi
call fcn.00455b7f
mov dword [esi], vtable.PtrListQuickMultiSorted_struct_SkinElementAlias__class_SortSkinElementAlias_.0
lea esi, [edi + 0x30]
mov byte [ebp - 4], 1
push ebx
mov ecx, esi
mov dword [ebp - 0x14], esi
call fcn.00455b4e
mov dword [esi], vtable.PtrListQuickMultiSorted_struct_SkinColorElement__class_SortSkinColorElement_.0
lea esi, [edi + 0x54]
mov byte [ebp - 4], 2
push ebx
mov ecx, esi
mov dword [ebp - 0x14], esi
call fcn.00455bb0
mov dword [esi], vtable.PtrListQuickMultiSorted_class_SkinCursorElement__class_SortSkinCursorElement_.0
lea esi, [edi + 0x78]
mov byte [ebp - 4], 3
push ebx
mov ecx, esi
mov dword [ebp - 0x14], esi
call fcn.00455b1d
mov dword [esi], vtable.PtrListQuickMultiSorted_struct_SkinBitmapElement__class_SortSkinBitmapElement_.0
lea esi, [edi + 0x9c]
mov byte [ebp - 4], 4
push ebx
mov ecx, esi
mov dword [ebp - 0x14], esi
call fcn.00498e4e
mov dword [esi], vtable.PtrList_class_ElementRegionServer_.0
lea eax, [edi + 0xac]
mov dword [eax], vtable.PaletteGC.0
mov dword [eax + 4], edi
lea esi, [edi + 0xb4]
mov byte [ebp - 4], 6
mov dword [esi], vtable.GammaFilterFactory.0
push ebx
mov dword [edi + 4], 1
mov dword [edi + 8], ebx
mov ecx, dword [0x531bc0]
push eax
call fcn.00476d2a
mov ecx, dword [0x531bbc]
push esi
push ebx
push 0xa
call fcn.00406ad0
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret