joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416e30
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b4
mov eax, dword [0x4e5114]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1a8], 0
push 0x416c80
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x1a8]
push eax
push 0
push str.Wifi
lea ecx, [ebp - 0x1ac]
push ecx
call fcn.004172a0
add esp, 8
mov ecx, eax
call fcn.00407ab0
push eax
call fcn.00417330
add esp, 0xc
test eax, eax
jne 0x416e95
mov dword [ebp - 0x1a4], 1
jmp 0x416e9f
mov dword [ebp - 0x1a4], 0
mov dl, byte [ebp - 0x1a4]
mov byte [ebp - 0x195], dl
lea ecx, [ebp - 0x1ac]
call fcn.00411830
movzx eax, byte [ebp - 0x195]
test eax, eax
je 0x416f2a
push 0
push 0x4d2e34
lea ecx, [ebp - 0x1b0]
push ecx
call fcn.004172a0
add esp, 8
mov ecx, eax
call fcn.00407ab0
push eax
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x19c], eax
lea ecx, [ebp - 0x1b0]
call fcn.00411830
mov edx, dword [ebp - 0x19c]
push edx
call dword [sym.imp.USER32.dll_IsZoomed]
test eax, eax
jne 0x416f16
push 1
mov eax, dword [ebp - 0x19c]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0x19c]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
xor eax, eax
jmp 0x41704d
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0
jge 0x416f4a
xor eax, eax
jmp 0x41704d
call fcn.00416aa0
test eax, eax
jne 0x416f97
mov edx, dword [ebp - 0x1a8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x1b4]
push ecx
call fcn.00417170
add esp, 4
mov ecx, eax
call fcn.00407ab0
push eax
call fcn.00416b50
add esp, 0xc
lea ecx, [ebp - 0x1b4]
call fcn.00411830
xor eax, eax
jmp 0x41704d
push str..ACP
push 0
call fcn.0049a1c1
add esp, 8
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
push 4
call fcn.00417100
add esp, 4
mov edx, dword [ebp + 8]
push edx
call fcn.0040bbc0
mov ecx, eax
call fcn.00416a80
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x416feb
mov eax, 1
jmp 0x41704d
call fcn.00425200
push 0x96
push str.....SoftSkinWifiShareSkin
mov ecx, dword [ebp + 8]
push ecx
call fcn.00417060
add esp, 0xc
push 0
mov edx, dword [ebp + 8]
push edx
push 0
mov ecx, 0x4e8ef4
call fcn.0041cc30
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0
jl 0x41703f
mov eax, dword [ebp + 0x10]
push eax
mov ecx, 0x4e8ef4
call fcn.0041cd10
mov ecx, 0x4e8ef4
call fcn.0041ccf0
call dword [sym.imp.WS2_32.dll_WSACleanup]
call dword [sym.imp.ole32.dll_OleUninitialize]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048b588
mov esp, ebp
pop ebp
ret 0x10
Function at 0x417060
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push eax
call fcn.00430910
add esp, 4
push 0x4d2e98
movzx ecx, word [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4170ee
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
push eax
call fcn.0042b630
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4170e4
mov ecx, dword [ebp - 4]
push ecx
call fcn.0042b630
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x4170e4
push 0x4d2ea8
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
call fcn.00430c90
add esp, 0xc
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov esp, ebp
pop ebp
ret

Function at 0x417330
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x417386
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x417366
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x41738b
cmp dword [ebp + 0xc], 0
je 0x417378
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x417386
cmp dword [ebp + 0x10], 0
je 0x417386
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x419500
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x28], ecx
xor eax, eax
jne 0x419509
cmp dword [ebp + 0xc], 0
je 0x41951c
mov dword [ebp - 0x18], 1
jmp 0x419523
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 0
jne 0x419539
mov eax, 0xd
jmp 0x4195bc
xor edx, edx
jne 0x41950d
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
add edx, 2
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 8]
mov cx, word [eax]
mov word [ebp - 2], cx
add dword [ebp - 8], 2
cmp word [ebp - 2], 0
jne 0x419559
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x20]
sar edx, 1
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
lea eax, [edx + ecx*2]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
lea eax, [edx + ecx*2]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x10], 1
jne 0x41954a
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 7
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 8
Function at 0x419f60
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4e5114]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20c], ecx
push 0
lea ecx, [ebp - 0x21c]
call fcn.00415660
mov eax, dword [ebp - 0x20c]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x20c]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x21c]
call fcn.00415fe0
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
je 0x419fdf
mov edx, dword [ebp - 0x208]
mov dword [ebp - 0x220], edx
lea ecx, [ebp - 0x21c]
call fcn.00416570
mov eax, dword [ebp - 0x220]
jmp 0x41a094
mov dword [ebp - 0x210], 0x100
lea eax, [ebp - 0x230]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x204]
push edx
push 0
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x41a063
lea ecx, [ebp - 0x204]
push ecx
lea ecx, [ebp - 0x21c]
call fcn.00419f60
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
je 0x41a057
mov edx, dword [ebp - 0x208]
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x21c]
call fcn.00416570
mov eax, dword [ebp - 0x224]
jmp 0x41a094
mov dword [ebp - 0x210], 0x100
jmp 0x419fe9
lea ecx, [ebp - 0x21c]
call fcn.00416590
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x20c]
call fcn.0041a1d0
mov dword [ebp - 0x228], eax
lea ecx, [ebp - 0x21c]
call fcn.00416570
mov eax, dword [ebp - 0x228]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048b588
mov esp, ebp
pop ebp
ret 4

Function at 0x41a140
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x41a19f
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x41a16c
mov eax, 1
jmp 0x41a1bd
push str.RegDeleteKeyTransactedW
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x41a19d
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0xc]
jmp 0x41a1bd
jmp 0x41a1b8
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x41a1b8
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x41a1bd
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x423200
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b0bc8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x4e5114]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x14]
call fcn.004126a0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00407ab0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42325f
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00411830
jmp 0x42330b
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x10]
push ecx
push 0x5c
lea ecx, [ebp - 0x14]
call fcn.00423030
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x4232fc
lea ecx, [ebp - 0x18]
call fcn.00411850
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00423180
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x18]
call fcn.00415cb0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.00411830
lea ecx, [ebp - 0x18]
call fcn.00407ab0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4232eb
lea ecx, [ebp - 0x18]
call fcn.00407ab0
push eax
call fcn.0049a31e
add esp, 4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.00411830
jmp 0x423266
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00411830
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x423320
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b0118
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x4e5114]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x10]
call fcn.00411850
mov dword [ebp - 4], 0
push 0
push 0x1a
push 0x200
lea ecx, [ebp - 0x10]
call fcn.00412a50
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.00415610
lea ecx, [ebp - 0x10]
call fcn.00412720
movzx eax, al
test eax, eax
je 0x4233b8
push 0x4d51f0
mov ecx, dword [ebp + 8]
call fcn.004126a0
mov ecx, dword [ebp - 0x14]
or ecx, 1
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00411830
mov eax, dword [ebp + 8]
jmp 0x42342c
lea ecx, [ebp - 0x10]
call fcn.00411920
sub eax, 1
push eax
lea ecx, [ebp - 0x10]
call fcn.004237f0
movzx edx, ax
cmp edx, 0x5c
je 0x4233e1
push 0x4d51f4
lea ecx, [ebp - 0x10]
call fcn.004237d0
push 0x4d51f8
lea ecx, [ebp - 0x10]
call fcn.004237d0
cmp dword [ebp + 0xc], 0
je 0x423405
lea ecx, [ebp - 0x10]
call fcn.00407ab0
push eax
call fcn.00423200
add esp, 4
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
call fcn.00411fd0
mov ecx, dword [ebp - 0x14]
or ecx, 1
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00411830
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x423540
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b0c40
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x4e5114]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x10]
call fcn.00411850
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.00423440
add esp, 8
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x18]
push edx
lea ecx, [ebp - 0x10]
call fcn.00422ef0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00411830
push 0x4d520c
lea ecx, [ebp - 0x10]
call fcn.00412160
push 0x4d5210
lea ecx, [ebp - 0x10]
call fcn.00412160
push 0x4d5214
lea ecx, [ebp - 0x10]
call fcn.00412160
push 0x4d5218
lea ecx, [ebp - 0x10]
call fcn.00412160
push 0x4d521c
lea ecx, [ebp - 0x10]
call fcn.00412160
push 0x4d5220
lea ecx, [ebp - 0x10]
call fcn.00412160
push 0x4d5224
lea ecx, [ebp - 0x10]
call fcn.00412160
push 0x4d5228
lea ecx, [ebp - 0x10]
call fcn.00412160
push 0x4d5230
lea ecx, [ebp - 0x10]
call fcn.00412160
lea ecx, [ebp - 0x10]
call fcn.00407ab0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00411830
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x426b14
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov byte [ecx + 0x68], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x42b9a0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
test ax, ax
mov ecx, 8
push 1
cmovs esi, ecx
call edi
test ax, ax
jns 0x42b9c5
or esi, 1
push 2
call edi
test ax, ax
jns 0x42b9d1
or esi, 2
push 0x10
call edi
test ax, ax
jns 0x42b9dd
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x42b9e9
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x42f290
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4e5114]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
lea ecx, [edi + 0x4a8]
call fcn.00428090
mov ebx, dword [ebp + 8]
test eax, eax
jle 0x42f2fb
nop dword [eax]
push esi
lea ecx, [edi + 0x4a8]
mov byte [ebp - 5], 0
call fcn.00427910
lea ecx, [ebp - 5]
push ecx
push dword [ebp + 0x10]
mov edx, dword [eax]
mov ecx, eax
push dword [ebp + 0xc]
push ebx
call dword [edx]
cmp byte [ebp - 5], 0
jne 0x42f4ac
lea ecx, [edi + 0x4a8]
inc esi
call fcn.00428090
cmp esi, eax
jl 0x42f2c0
sub ebx, 0x100
je 0x42f3e8
sub ebx, 4
je 0x42f373
sub ebx, 2
jne 0x42f3d3
push dword [ebp + 0xc]
mov dword [ebp - 0xc], ebx
call fcn.004965b0
mov ecx, dword [edi + 0x104]
lea edx, [ebp - 0xc]
add esp, 4
mov word [ebp - 0xc], ax
mov eax, dword [ecx]
push 0x80000012
push edx
push 0x430ff0
call dword [eax + 0x134]
mov esi, eax
test esi, esi
je 0x42f3d3
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x128]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x18]
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048b588
mov esp, ebp
pop ebp
ret 0x10
cmp dword [edi + 0x108], 0
je 0x42f3d3
xor eax, eax
mov dword [ebp - 0x2c], 6
mov word [ebp - 0xe], ax
xorps xmm0, xmm0
mov eax, dword [ebp + 0xc]
mov word [ebp - 0x18], ax
mov eax, dword [edi + 0x11c]
mov dword [ebp - 0x20], eax
mov eax, dword [edi + 0x120]
movlpd qword [ebp - 0x28], xmm0
movlpd qword [ebp - 0x16], xmm0
mov dword [ebp - 0x1c], eax
call fcn.0042b9a0
mov word [ebp - 0x16], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x108]
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x24], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x140]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048b588
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x42f3d3
mov ecx, dword [edi + 0x108]
test ecx, ecx
je 0x42f446
mov eax, dword [ecx]
mov eax, dword [eax + 0x100]
call eax
test al, al
je 0x42f446
mov ecx, dword [edi + 0x108]
mov eax, dword [ecx]
mov eax, dword [eax + 0x10c]
call eax
test al, al
je 0x42f446
mov ecx, dword [edi + 0x108]
push str.RichEditUI
mov eax, dword [ecx]
call dword [eax + 0xc]
push eax
call fcn.0048d314
add esp, 8
test eax, eax
je 0x42f446
mov ecx, dword [edi + 0x108]
call fcn.0045cb70
test al, al
jne 0x42f3d3
mov ecx, dword [edi + 0x108]
test ecx, ecx
je 0x42f493
mov eax, dword [ecx]
mov eax, dword [eax + 0x100]
call eax
test al, al
je 0x42f493
mov ecx, dword [edi + 0x108]
mov eax, dword [ecx]
mov eax, dword [eax + 0x10c]
call eax
test al, al
je 0x42f493
mov ecx, dword [edi + 0x108]
push str.WkeWebkitUI
mov eax, dword [ecx]
call dword [eax + 0xc]
push eax
call fcn.0048d314
add esp, 8
test eax, eax
jne 0x42f3d3
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ecx, edi
setns al
movzx eax, al
push eax
call fcn.00430af0
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048b588
mov esp, ebp
pop ebp
ret 0x10
Function at 0x430670
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4e5114]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [edi + 0xa8]
cmp eax, ecx
je 0x4306a6
cmp esi, dword [edi + 0x108]
je 0x4306a6
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [edi + 0x108]
cmp esi, eax
je 0x430799
test eax, eax
je 0x430711
xorps xmm0, xmm0
mov dword [ebp - 0x24], 0x17
movlpd qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0x14], xmm0
movlpd qword [ebp - 0xc], xmm0
mov dword [ebp - 0x20], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x108]
lea edx, [ebp - 0x24]
mov dword [ebp - 0x1c], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x140]
push 0
push 0
push 0
push str.killfocus
push dword [edi + 0x108]
mov ecx, edi
call fcn.00430050
mov dword [edi + 0x108], 0
test esi, esi
je 0x430799
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
cmp eax, edi
jne 0x430799
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0x100]
call eax
test al, al
je 0x430799
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0x10c]
call eax
test al, al
je 0x430799
xorps xmm0, xmm0
mov dword [edi + 0x108], esi
movlpd qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0x14], xmm0
movlpd qword [ebp - 0xc], xmm0
mov dword [ebp - 0x24], 0x18
mov dword [ebp - 0x20], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x108]
lea edx, [ebp - 0x24]
mov dword [ebp - 0x1c], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x140]
push 0
push 0
push 0
push str.setfocus
push dword [edi + 0x108]
mov ecx, edi
call fcn.00430050
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0048b588
mov esp, ebp
pop ebp
ret 4
Function at 0x432320
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b1430
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4e5114]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov edx, eax
shr edx, 0x10
test edx, edx
je 0x4323db
cmp word [eax], 0x3c
je 0x4323db
mov ecx, dword [0x4e7ed0]
test cl, 1
jne 0x4323c2
or ecx, 1
mov dword [0x4e7ed0], ecx
push 0x1f8
mov dword [ebp - 4], 0
call fcn.0048b5a7
mov edi, eax
add esp, 4
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 1
test edi, edi
je 0x4323ae
push 0x1f8
push 0
push edi
call fcn.0048e340
add esp, 0xc
mov ecx, edi
call fcn.004412d0
mov ecx, eax
jmp 0x4323b0
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [0x4e7ecc], ecx
mov dword [ebp - 4], 0xffffffff
jmp 0x4323c8
mov ecx, dword [0x4e7ecc]
push eax
call fcn.00441480
mov ecx, eax
mov eax, dword [ebp + 8]
test ecx, ecx
cmovne eax, ecx
mov dword [ebp + 8], eax
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x432436
cmp word [eax], 0x3c
mov ecx, esi
jne 0x432410
push eax
call fcn.00432ee0
test al, al
jne 0x4324c5
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push 0
push eax
call fcn.00432ff0
test al, al
jne 0x4324c5
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov edi, dword [esi + 0x148]
test edi, edi
jne 0x43244a
call fcn.0042b630
mov edi, eax
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x4323fa
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x432487
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp + 0x10]
push 0
push ebx
push edi
mov dword [esi + 0x140], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, dword [ebp - 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
mov ecx, esi
call fcn.00433410
test al, al
je 0x4323fa
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x144], eax
push dword [ebp + 0x18]
mov ecx, esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.004311b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4390b0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4e5114]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x4390e4
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4390e4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [ebx]
test ax, ax
je 0x4391dc
push edi
mov edi, ebx
mov ecx, ebx
mov edx, eax
cmp dx, 0x2f
je 0x439103
cmp dx, 0x5c
jne 0x439105
mov edi, ecx
movzx eax, word [ecx + 2]
add ecx, 2
mov edx, eax
test ax, ax
jne 0x4390f7
cmp edi, ebx
je 0x439153
sub edi, ebx
lea eax, [ebp - 0x414]
and edi, 0xfffffffe
push edi
push ebx
push eax
call fcn.0048d840
add esp, 0xc
cmp edi, 0x208
jae 0x4391ec
xor eax, eax
mov word [ebp + edi - 0x414], ax
lea eax, [ebp - 0x414]
push eax
push esi
call fcn.004390b0
add esp, 8
xor eax, eax
mov word [ebp - 0x20c], ax
test esi, esi
je 0x439180
lea ecx, [ebp - 0x20c]
sub ecx, esi
nop dword [eax + eax]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x439170
mov esi, ebx
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x439182
lea edi, [ebp - 0x20c]
sub ebx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4391a0
mov ecx, ebx
lea eax, [ebp - 0x20c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop edi
cmp eax, 0xffffffff
jne 0x4391dc
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0048b588
mov esp, ebp
pop ebp
ret
call fcn.0048b729
int3