joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42fbf2
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x49a010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push eax
mov dword [ebp - 0x218], edi
call fcn.00449bc0
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [ebp - 0x214]
push eax
call fcn.0044aa75
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
pop ecx
mov ebx, 0x465
test eax, eax
jne 0x42fc64
push 0
push 0
push ebx
push edi
call esi
lea eax, [ebp - 0x214]
push eax
call fcn.0044aa75
pop ecx
cmp eax, 2
jb 0x42fcbd
cmp word [ebp - 0x212], 0x3a
jne 0x42fcbd
xor eax, eax
lea edi, [ebp - 0xa]
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ax, word [ebp - 0x214]
push 0x3a
mov word [ebp - 0xc], ax
pop eax
push 0x5c
mov word [ebp - 0xa], ax
pop eax
mov word [ebp - 8], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x42fcbd
push 0
push 0
push ebx
push dword [ebp - 0x218]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00449c3a
leave
ret

Function at 0x4304bf
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x49a010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov eax, dword [eax - 8]
test eax, eax
jne 0x4304e3
xor eax, eax
jmp 0x430551
cmp eax, 0x104
jg 0x4304df
push 0x410
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.00449bc0
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
push 0x2710
push 0x4802c0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
cmp word [ebp - 0x414], 0
je 0x4304df
lea eax, [ebp - 0x414]
push 0x4802bc
push eax
call fcn.0044d6ee
pop ecx
pop ecx
test eax, eax
je 0x4304df
push eax
call fcn.0044d5ac
pop ecx
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00449c3a
leave
ret 4

Function at 0x430a53
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
test ecx, ecx
je 0x430a63
lea esi, [ecx - 0x84]
jmp 0x430a65
xor esi, esi
cmp byte [ecx + 0x1c], 0
je 0x430a99
push 0xe801
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp dword [ebp + 0xc], 2
jne 0x430a8a
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x430a9f
cmp dword [ebp + 0xc], 0
jne 0x430a99
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 0xc], 1
je 0x430ab7
mov eax, dword [ebp + 0x10]
shr eax, 0x10
cwde
push eax
movsx eax, word [ebp + 0x10]
push eax
lea ecx, [esi + 0x84]
call fcn.004305af
xor eax, eax
pop esi
pop ebp
ret 0x10
Function at 0x430d73
Capabilities:
Create process on windows

Disassembly:
push 4
mov eax, 0x47c3a8
call fcn.0044b114
mov eax, dword [0x49501c]
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
push 0xa8
lea ecx, [ebp - 0x10]
call fcn.0040ec64
push 1
push 0
push 0
push dword [ebp - 0x10]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x10]
call fcn.0040bf88
call fcn.0044b1ec
ret

Function at 0x430e74
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x49a010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x480200]
mov dword [ebp - 0xc], eax
mov eax, dword [0x480204]
mov dword [ebp - 8], eax
mov ax, word [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
mov word [ebp - 0xc], ax
push esi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor esi, esi
cmp eax, 3
je 0x430ebc
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], esi
jmp 0x430efd
push 8
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.00449bc0
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push esi
push esi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x430ee9
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], eax
jmp 0x430eef
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
cmp eax, esi
ja 0x430f11
jb 0x430efd
cmp ecx, 0x400
jae 0x430f11
push ecx
push str._d_Bytes
push ebx
call fcn.00417af3
add esp, 0xc
jmp 0x430fe5
push edi
cmp eax, esi
ja 0x430f9e
jb 0x430f24
cmp ecx, 0x100000
jae 0x430f5a
push esi
mov edi, ecx
push 0x64
shrd edi, eax, 0xa
and ecx, 0x3ff
push esi
shr eax, 0xa
push ecx
mov dword [ebp - 0x18], eax
call fcn.0044d290
mov ecx, eax
or ecx, edx
jne 0x430f4e
push edi
push str._d_KB
jmp 0x430fc9
push eax
push edi
push str._d._d_KB
jmp 0x430fdb
cmp eax, esi
ja 0x430f9e
jb 0x430f68
cmp ecx, 0x40000000
jae 0x430f9e
push esi
mov edi, ecx
push 0x19000
shrd edi, eax, 0x14
and ecx, 0xfffff
push esi
shr eax, 0x14
push ecx
mov dword [ebp - 0x18], eax
call fcn.0044d290
mov ecx, eax
or ecx, edx
jne 0x430f95
push edi
push str._d_MB
jmp 0x430fc9
push eax
push edi
push str._d._d_MB
jmp 0x430fdb
push esi
mov edi, ecx
push 0x6400000
shrd edi, eax, 0x1e
and ecx, 0x3fffffff
push esi
shr eax, 0x1e
push ecx
mov dword [ebp - 0x18], eax
call fcn.0044d290
mov ecx, eax
or ecx, edx
jne 0x430fd4
push edi
push str._d_GB
push ebx
call fcn.00417af3
add esp, 0xc
jmp 0x430fe4
push eax
push edi
push str._d._d_GB
push ebx
call fcn.00417af3
add esp, 0x10
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00449c3a
leave
ret 8
Function at 0x4312fb
Capabilities:
Check if file exists
Get disk information

Disassembly:
push 0x2c
mov eax, 0x47c459
call fcn.0044b17d
mov dword [ebp - 0x1c], ecx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
mov edx, dword [eax - 8]
test edx, edx
jne 0x431321
push 2
pop eax
call fcn.0044b200
ret 4
cmp edx, 0x80
jle 0x43132d
push 8
jmp 0x431318
cmp edx, 3
jge 0x431337
xor eax, eax
inc eax
jmp 0x431319
movzx ecx, word [eax + 2]
cmp cx, 0x3a
jne 0x43134b
movzx ecx, word [eax + 4]
cmp cx, 0x5c
jne 0x431332
xor esi, esi
test edx, edx
jle 0x43139e
mov edi, eax
movzx ecx, word [edi]
cmp cx, 0x3a
jne 0x431365
cmp esi, 1
jne 0x4313f9
cmp cx, 0x2a
je 0x4313f9
cmp cx, 0x3f
je 0x4313f9
cmp cx, 0x22
je 0x4313f9
cmp cx, 0x3c
je 0x4313f9
cmp cx, 0x3e
je 0x4313f9
cmp cx, 0x7c
je 0x4313f9
cmp cx, 0x2f
je 0x4313f9
inc esi
inc edi
inc edi
cmp esi, edx
jl 0x431353
cmp edx, 4
jge 0x4313b2
cmp edx, 1
jle 0x431332
movzx ecx, word [eax + 2]
cmp cx, 0x3a
jne 0x431332
cmp edx, 2
jl 0x4313c5
movzx ecx, word [eax + 2]
cmp cx, 0x3a
jne 0x431332
cmp edx, 1
jle 0x431400
mov ecx, dword [0x480380]
mov dword [ebp - 0x18], ecx
mov ecx, dword [0x480384]
mov dword [ebp - 0x14], ecx
mov ax, word [eax]
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x431400
push 9
jmp 0x431318
push 7
jmp 0x431318
lea ecx, [ebp - 0x38]
call fcn.00417ba5
push dword [ebx]
xor esi, esi
mov dword [ebp - 4], esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x431458
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push ebx
call fcn.0040f623
lea ecx, [ebp - 0x38]
call fcn.00418368
cmp eax, esi
je 0x43146a
cmp eax, 0x50
je 0x431458
cmp eax, 0xb7
je 0x431458
push 5
pop esi
cmp eax, esi
jne 0x431453
lea ecx, [ebp - 0x38]
call fcn.0041813c
mov eax, esi
jmp 0x431319
xor esi, esi
inc esi
jmp 0x431444
mov ecx, dword [ebp - 0x1c]
push ebx
call fcn.004304bf
test eax, eax
jne 0x43146a
push 5
pop esi
jmp 0x431444
mov eax, dword [0x49c290]
mov ecx, dword [ebx]
shl eax, 0x14
cdq
push edx
push eax
push ecx
call fcn.0043bfe9
add esp, 0xc
test eax, eax
jne 0x431444
push 3
jmp 0x431467
Function at 0x431503
Capabilities:
Get graphical window text

Disassembly:
push ebp
sub esp, 0x800
lea ebp, [esp - 4]
mov eax, dword [0x49a010]
xor eax, ebp
mov dword [ebp + 0x800], eax
push 0xc
mov eax, 0x47c4b1
call fcn.0044b114
mov esi, ecx
push 0x3ee
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
xor ebx, ebx
mov dword [ebp - 0x18], edi
cmp edi, ebx
jne 0x431567
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.00449c3a
add ebp, 0x804
leave
ret
push 0x400
lea eax, [ebp]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [0x49501c]
mov dword [ebp - 0x10], eax
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.0040e910
lea ecx, [ebp - 0x10]
call fcn.00428ba6
lea ecx, [ebp - 0x10]
call fcn.00428bfb
mov eax, dword [0x49501c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax - 8]
lea ecx, [ebp - 0x14]
push ecx
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0040d426
push eax
mov ecx, esi
call fcn.00431488
test eax, eax
jne 0x43160e
mov eax, dword [ebp - 0x14]
cmp dword [eax - 8], ebx
je 0x4315e4
push 0x40
push 0x96
push eax
push dword [esi + 4]
call fcn.0042bf8a
add esp, 0x10
push ebx
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x18]
call fcn.0042fcf5
push edi
call dword [sym.imp.USER32.dll_SetFocus]
lea ecx, [ebp - 0x14]
call fcn.0040bf88
lea ecx, [ebp - 0x10]
call fcn.0040bf88
mov eax, ebx
jmp 0x431544
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.0040e5e6
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x49c220
call fcn.0040e8c0
xor ebx, ebx
inc ebx
jmp 0x4315f7
Function at 0x431786
Capabilities:
Get graphical window text

Disassembly:
push ebp
sub esp, 0x800
lea ebp, [esp - 4]
mov eax, dword [0x49a010]
xor eax, ebp
mov dword [ebp + 0x800], eax
push 0xc
mov eax, 0x47c537
call fcn.0044b114
cmp dword [ebp + 0x80c], 0x300
mov esi, ecx
jne 0x431943
push 0x3ee
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
xor ebx, ebx
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x431943
xor eax, eax
push 0x7fe
mov word [ebp], ax
lea eax, [ebp + 2]
push ebx
push eax
call fcn.00449bc0
add esp, 0xc
push 0x3ff
lea eax, [ebp]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [0x49501c]
mov dword [ebp - 0x18], eax
lea edi, [esi + 0x694]
push dword [edi]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], 1
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x43183b
push ebx
push ebx
push 0xf0
push dword [edi]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x43183b
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.004316ba
test eax, eax
je 0x431867
cmp dword [ebp - 0x14], ebx
je 0x431867
push 1
lea ecx, [esi + 0x3fc]
call fcn.0042cb2f
push 0xffffff
jmp 0x4318a0
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, dword [ebp - 0x10]
je 0x431887
push ebx
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x10]
call fcn.0042fcf5
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_SetFocus]
cmp dword [0x49c23c], ebx
jne 0x4318ab
push ebx
lea ecx, [esi + 0x3fc]
call fcn.0042cb2f
push 0x3af2ff
lea ecx, [esi + 0xac]
call fcn.00428d50
mov eax, dword [ebp - 0x18]
cmp dword [eax - 8], ebx
jne 0x431925
mov eax, dword [0x49501c]
mov dword [ebp - 0x14], eax
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0041077d
mov edi, 0x480388
push edi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00417359
push edi
lea ecx, [ebp - 0x10]
call fcn.004172da
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
lea ecx, [ebp - 0x14]
push ecx
push eax
mov ecx, esi
call fcn.00430e74
push dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push dword [esi + 0xc90]
push 0x8b
push eax
call fcn.0040f709
add esp, 0x10
lea ecx, [ebp - 0x10]
call fcn.0040bf88
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.0040bf88
cmp dword [0x49c23c], ebx
jne 0x43193b
push dword [ebp - 0x18]
lea ecx, [esi + 0xac]
call fcn.0042e63c
lea ecx, [ebp - 0x18]
call fcn.0040bf88
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.00449c3a
add ebp, 0x804
leave
ret 0xc
Function at 0x431e8c
Capabilities:
Get graphical window text

Disassembly:
push ebp
sub esp, 0x800
lea ebp, [esp - 4]
mov eax, dword [0x49a010]
xor eax, ebp
mov dword [ebp + 0x800], eax
push 8
mov eax, 0x47c5b2
call fcn.0044b114
xor ebx, ebx
push ebx
push ebx
mov esi, ecx
push 0xf0
push dword [esi + 0x694]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x431f7b
mov eax, dword [0x49501c]
mov dword [ebp - 0x10], eax
push 0x3ee
push dword [esi + 4]
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
cmp edi, ebx
jne 0x431ef6
lea ecx, [ebp - 0x10]
jmp 0x431fb8
xor eax, eax
push 0x7fe
mov word [ebp], ax
lea eax, [ebp + 2]
push ebx
push eax
call fcn.00449bc0
add esp, 0xc
push 0x3ff
lea eax, [ebp]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp dword [0x49c23c], ebx
jne 0x431f4e
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.004316ba
lea edi, [esi + 0xac]
mov ecx, edi
test eax, eax
jne 0x431f56
push 0x3af2ff
call fcn.00428d50
push ebx
jmp 0x431f62
lea edi, [esi + 0xac]
mov ecx, edi
push 0xffffff
call fcn.00428d50
push 1
lea ecx, [esi + 0x3fc]
call fcn.0042cb2f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0040bf88
jmp 0x431f99
lea edi, [esi + 0xac]
push 0x3af2ff
mov ecx, edi
call fcn.00428d50
push ebx
lea ecx, [esi + 0x3fc]
call fcn.0042cb2f
lea eax, [ebp - 0x14]
push eax
mov ecx, edi
call fcn.0042e65c
push dword [ebp - 0x14]
mov ecx, edi
mov dword [ebp - 4], 1
call fcn.0042e63c
lea ecx, [ebp - 0x14]
call fcn.0040bf88
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.00449c3a
add ebp, 0x804
leave
ret

Function at 0x431fe0
Capabilities:
Get graphical window text

Disassembly:
push 8
mov eax, 0x47c5ea
call fcn.0044b114
mov edi, ecx
push 0xd
call fcn.0040fa32
mov ecx, eax
call fcn.00442e80
push 0x3ee
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ebx, [edi + 0x71c]
mov esi, 0x104
push esi
mov ecx, ebx
mov dword [ebp - 0x14], eax
call fcn.0040d426
push esi
push eax
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, ebx
call fcn.0040e5e6
push ebx
lea ecx, [ebp - 0x14]
call fcn.0040f623
mov eax, dword [0x49501c]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax - 8]
add ecx, ecx
push ecx
push eax
push 0x208
mov esi, 0x49bcb8
push esi
mov byte [ebp - 4], 1
call fcn.004303cc
lea eax, [ebp - 0x10]
push eax
push esi
mov ecx, edi
call fcn.004316ba
test eax, eax
je 0x4320a5
mov eax, dword [0x49bcb8]
add eax, 0xffffff9f
cmp ax, 0x19
ja 0x432092
mov eax, 0xffe0
add word [0x49bcb8], ax
push ebx
push esi
push 0x3921
push dword [0x49becc]
call dword [sym.imp.USER32.dll_PostMessageW]
mov edi, dword [edi + 0x7c]
mov eax, dword [edi]
push ebx
push edi
call dword [eax + 0x1c]
lea ecx, [ebp - 0x10]
call fcn.0040bf88
lea ecx, [ebp - 0x14]
call fcn.0040bf88
call fcn.0044b1ec
ret
Function at 0x432164
Capabilities:
Get graphical window text

Disassembly:
push ebp
lea ebp, [esp - 0x4004]
mov eax, 0x4004
call fcn.0044b510
push 0xffffffffffffffff
push 0x47c630
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x49a010]
xor eax, ebp
mov dword [ebp + 0x4000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x3ee
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, 0x2000
push edi
mov dword [ebp - 0x14], eax
xor ebx, ebx
lea eax, [ebp]
push ebx
push eax
call fcn.00449bc0
add esp, 0xc
push 0x1000
lea eax, [ebp]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 9
call fcn.0040fa32
mov ecx, eax
call fcn.00442e80
mov eax, dword [esi + 4]
mov dword [ebp - 0x34], eax
lea eax, [ebp]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x28], 0x4816a8
mov dword [ebp - 0x24], 0x59
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], 0x42fccc
mov dword [ebp - 0x30], ebx
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderW]
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x4322e2
push edi
lea eax, [ebp + 0x2000]
push ebx
push eax
call fcn.00449bc0
add esp, 0xc
lea eax, [ebp + 0x2000]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x4322e2
mov eax, dword [0x49501c]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 0x2000]
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.004316ba
test eax, eax
lea eax, [ebp + 0x2000]
push eax
push dword [ebp - 0x14]
je 0x4322ba
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea edi, [esi + 0x3fc]
push 1
mov ecx, edi
call fcn.0042cb2f
add esi, 0x694
push dword [esi]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4322da
push ebx
push ebx
push 0xf0
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x4322da
mov ecx, edi
jmp 0x4322d4
call dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [ebp - 0x10]
lea ecx, [esi + 0xac]
call fcn.0042e63c
lea ecx, [esi + 0x3fc]
push ebx
call fcn.0042cb2f
lea ecx, [ebp - 0x10]
call fcn.0040bf88
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x4000]
xor ecx, ebp
call fcn.00449c3a
add ebp, 0x4004
leave
ret
Function at 0x432305
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 4]
mov eax, dword [ebx]
push 0xffffff
mov dword [0x49bcb0], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov ecx, esi
mov dword [esi + 0xd14], eax
call fcn.004319c7
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetClientRect]
mov edi, dword [sym.imp.USER32.dll_MoveWindow]
push 1
push 0x14
push 0x32
push 0x13e
push 0x212
push dword [esi + 0x374]
call edi
push 1
push 0x1e
push 0x90
push 8
push 0x27
push dword [esi + 0x1cc]
call edi
push 0x480478
push 0x131
push 8
push 0x27
lea eax, [esi + 0xc94]
push eax
lea ecx, [esi + 0x20]
call fcn.00436607
push 1
push 0x14
push 0x46
push 0x3f
push 0x3c
push dword [esi + 0x15c]
call edi
lea eax, [ebp - 0x44]
push eax
push dword [esi + 0x15c]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x44]
push eax
mov ecx, ebx
call fcn.0041e7f7
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x24]
push 1
lea eax, [eax + ecx - 0xbd]
push 0x43
cdq
push 0xbd
sub eax, edx
push 0xa7
sar eax, 1
push eax
push dword [esi + 0x43c]
call edi
push 0x3ee
push dword [ebx]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 4], eax
call fcn.0040bc02
mov eax, dword [eax + 4]
push 1
push eax
push 0x30
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x3c]
lea ecx, [eax + 0x15c]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0x139
push 0x3ee
push dword [ebx]
mov dword [ebp - 0xc], ecx
lea ecx, [esi + 0x720]
mov dword [ebp - 0x10], 0x3c
mov dword [ebp - 8], 0x58
call fcn.0042afca
mov eax, dword [ebp - 0xc]
push 1
push 0x1c
push 0x3c
push 0x3c
add eax, 8
push eax
push dword [esi + 0x504]
call edi
mov eax, dword [ebp - 8]
push 1
push 0x14
push 0x109
add eax, 8
push eax
push dword [ebp - 0x14]
push dword [esi + 0xec]
call edi
mov eax, dword [ebp - 8]
push 1
push 0x14
push 0x50
add eax, 8
push eax
push 0x18e
push dword [esi + 0x2ac]
call edi
lea eax, [esi + 0x2ac]
push eax
mov ecx, esi
call fcn.0042fff4
push 1
push 0x14
push 0x46
push 0x87
push 0x3c
push dword [esi + 0x23c]
call edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 0x23c]
call edi
lea eax, [ebp - 0x54]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x14]
push dword [esi + 0x7c]
lea ecx, [eax + 0x64]
mov dword [ebp - 0x2c], ecx
lea ecx, [esi + 0x780]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0x82
mov dword [ebp - 0x28], 0xe6
call fcn.00428d24
push 0
push ecx
mov eax, esp
push 0
push 0x50000000
push str.CustomContrlList
push ecx
mov dword [eax], 0x66
mov eax, esp
lea ecx, [ebp - 0x34]
mov dword [eax], ecx
push dword [ebx]
add esi, 0x75c
mov ecx, esi
call fcn.0043129c
push 0
push eax
call edi
mov ecx, esi
call fcn.004265d1
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 8
Function at 0x4329d4
Capabilities:
Create process on windows

Disassembly:
push 1
xor eax, eax
push eax
push eax
push str.www.360.cn
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret

Function at 0x432d46
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x432d53
xor eax, eax
pop esi
ret
push 1
push 1
push dword [esi + 0x10]
call fcn.00429683
test eax, eax
je 0x432d4f
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop esi
ret

Function at 0x432e6c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x460]
push 0
mov ecx, ebx
call fcn.0042c90f
push dword [esi + 0x7c]
mov ecx, ebx
call fcn.00428d24
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3f9
push dword [esi + 4]
call edi
push eax
lea ecx, [esi + 0x49c]
call fcn.0041f395
cmp dword [esi + 0x11c], 0x5001
push 4
mov ecx, ebx
push 0x480478
jne 0x432ec1
push 0x13a
jmp 0x432ec6
push 0x138
call fcn.0042c874
push dword [esi + 0x4a0]
lea ebx, [esi + 0x20]
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
push 0x3fa
push dword [esi + 4]
call edi
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call ebp
lea ecx, [esi + 0xac]
push 0xffffff
call fcn.00428d50
push dword [esi + 0x7c]
lea ecx, [esi + 0xac]
call fcn.00428d24
push 0x3fb
push dword [esi + 4]
call edi
push eax
lea ecx, [esi + 0xe8]
call fcn.0042b641
push dword [esi + 0xec]
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
lea ebx, [esi + 0x2d0]
push 1
mov ecx, ebx
call fcn.0042c90f
push dword [esi + 0x7c]
mov ecx, ebx
call fcn.00428d24
push 0x3fe
push dword [esi + 4]
call edi
push eax
lea ecx, [esi + 0x30c]
call fcn.0041f395
push 0xc
push 0x480478
push 0xf7
mov ecx, ebx
call fcn.0042c8da
lea ebx, [esi + 0x398]
push 1
mov ecx, ebx
call fcn.0042c90f
push dword [esi + 0x7c]
mov ecx, ebx
call fcn.00428d24
push 0x3ff
push dword [esi + 4]
call edi
push eax
lea ecx, [esi + 0x3d4]
call fcn.0041f395
push 0xc
push 0x480478
push 0xf7
mov ecx, ebx
call fcn.0042c8da
xor edi, edi
push edi
push dword [esi + 0xec]
call ebp
push edi
push dword [esi + 0x310]
call ebp
push edi
push dword [esi + 0x3d8]
call ebp
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4333df
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
test ecx, ecx
je 0x4333ef
lea esi, [ecx - 0x84]
jmp 0x4333f1
xor esi, esi
cmp byte [ecx + 0x1c], 0
je 0x433425
push 0xe801
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp dword [ebp + 0xc], 2
jne 0x433416
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x43342b
cmp dword [ebp + 0xc], 0
jne 0x433425
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 0xc], 1
je 0x433443
mov eax, dword [ebp + 0x10]
shr eax, 0x10
cwde
push eax
movsx eax, word [ebp + 0x10]
push eax
lea ecx, [esi + 0x84]
call fcn.00432ff3
xor eax, eax
pop esi
pop ebp
ret 0x10

Function at 0x433616
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0x91
lea ecx, [esi + 0x120]
call fcn.0040ec64
push 0
push dword [esi + 0xec]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret