joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47bc70
Capabilities:
Create process on windows
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x1c]
call fcn.004524b0
mov ecx, dword [ebp - 0x48]
call fcn.0047bda0
mov dword [0x5c2714], eax
push 0
push 0
push 0x470
mov eax, dword [0x5c2714]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x47bd71
call fcn.00451f00
test eax, eax
je 0x47bd04
push 0
push 0
push 0x582b94
push ecx
mov ecx, esp
push 0x58a970
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x5c272c
call fcn.0041c880
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00452750
mov ecx, eax
call fcn.0041cb20
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x34]
call fcn.0040f740
jmp 0x47bd71
mov dword [ebp - 0x20], 0
push 0x582b94
push 0x58a954
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x28], eax
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push ecx
mov ecx, esp
push 0x58a93c
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x5c272c
call fcn.0041c880
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00452750
mov ecx, eax
call fcn.0041cb20
push eax
mov edx, dword [ebp - 0x20]
push edx
call fcn.0041eaa0
add esp, 8
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x40]
call fcn.0040f740
cmp dword [ebp - 4], 1
jne 0x47bd88
mov byte [ebp - 0x41], 1
lea ecx, [ebp - 0x1c]
call fcn.004524d0
mov al, byte [ebp - 0x41]
jmp 0x47bd97
mov byte [ebp - 0x42], 0
lea ecx, [ebp - 0x1c]
call fcn.004524d0
mov al, byte [ebp - 0x42]
mov esp, ebp
pop ebp
ret

Function at 0x47bda0
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 0
push 0x58a954
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x47bdf3
push 0x582b94
push 0x58a9b0
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x47bdf3
push 0
push 0x58a990
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_FindWindowExW]
jmp 0x47bdf5
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x47cd10
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x5c0c70]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
movzx ecx, byte [eax + 0x4ae]
test ecx, ecx
je 0x47cd52
push 0x1f5
mov edx, dword [ebp - 0x4c]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, dword [ebp - 0x4c]
mov byte [ecx + 0x4a8], 0
jmp 0x47cec5
push 0x1f5
mov edx, dword [ebp - 0x4c]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
lea ecx, [ebp - 8]
call fcn.00465260
lea ecx, [ebp - 0x2c]
call fcn.0040efc0
lea ecx, [ebp - 0x1c]
call fcn.0040efc0
lea ecx, [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, 0x5c2740
call fcn.004513a0
push eax
mov edx, dword [0x5c2720]
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0x2c]
call fcn.004513a0
push eax
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [ebp - 0x4c]
cmp dword [edx + 0x480], 0
je 0x47cddc
lea ecx, [ebp - 0x1c]
call fcn.004513a0
push eax
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax + 0x480]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x34]
push edx
mov eax, dword [ebp - 0x38]
push eax
mov ecx, 0x5c2740
call fcn.00454060
test eax, eax
jne 0x47ce3e
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00454060
test eax, eax
jne 0x47ce3e
mov edx, dword [ebp - 8]
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0x48]
push edx
lea ecx, [ebp - 0x1c]
call fcn.00454060
test eax, eax
je 0x47ce43
jmp 0x47cec5
mov eax, dword [ebp - 0x4c]
movzx ecx, byte [eax + 0x4a9]
test ecx, ecx
jne 0x47cec5
push 0
push 0
mov ecx, dword [ebp - 0x4c]
call fcn.004fa2b2
mov edx, dword [ebp - 0x4c]
cmp dword [edx + 0x480], 0
je 0x47ce7e
push 0
mov eax, dword [ebp - 0x4c]
mov ecx, dword [eax + 0x480]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push str.calendar_UICalendar
mov ecx, dword [ebp - 0x4c]
add ecx, 0x20
call fcn.00509af5
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x47ce9f
mov ecx, dword [ebp - 0x30]
call fcn.0047cee0
mov byte [0x5c269c], 0
mov byte [0x5c269d], 0
mov byte [0x5c249f], 0
mov byte [0x5c269f], 0
mov eax, dword [ebp - 0x4c]
mov byte [eax + 0x4a8], 0
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0053ea90
mov esp, ebp
pop ebp
ret
Function at 0x480ca0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 4]
or edx, 0xf003f
push edx
push 0
mov ecx, dword [ebp - 0x18]
add ecx, 0x10
call fcn.0041cb20
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x480ced
mov dword [ebp - 0xc], 0
lea ecx, [ebp + 8]
call fcn.0040f740
mov eax, dword [ebp - 0xc]
jmp 0x480d41
push 0
push 0
push 0
push 0
lea ecx, [ebp + 8]
call fcn.0041cb20
push eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
jne 0x480d2f
mov dword [ebp - 0x10], 1
lea ecx, [ebp + 8]
call fcn.0040f740
mov eax, dword [ebp - 0x10]
jmp 0x480d41
mov dword [ebp - 0x14], 0
lea ecx, [ebp + 8]
call fcn.0040f740
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 4

Function at 0x480d50
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], 1
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 4]
or edx, 0x20006
push edx
push 0
mov ecx, dword [ebp - 0x18]
add ecx, 0x10
call fcn.0041cb20
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x480da4
mov dword [ebp - 0x10], 0
lea ecx, [ebp + 8]
call fcn.0040f740
mov eax, dword [ebp - 0x10]
jmp 0x480e00
mov edx, dword [ebp + 0xc]
mov dword [ebp - 4], edx
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
lea ecx, [ebp + 8]
call fcn.0041cb20
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x480dd2
mov dword [ebp - 0xc], 0
mov edx, dword [ebp - 0x18]
cmp dword [edx + 0xc], 0
jne 0x480de5
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edx
lea ecx, [ebp + 8]
call fcn.0040f740
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 8
Function at 0x482000
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
push 0x582b94
push 0x58a954
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0xc], eax
push 0x582b94
push 0x58a9b0
push 0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebp - 8], eax
push 0
push 0x58a990
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x482061
push 0
push 0
push 5
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 0x14]
call fcn.0047bda0
mov dword [0x5c2720], eax
push 0
push 0
push 0x46d
mov eax, dword [0x5c2720]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
push str._PCMaster6
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4820ac
push 0
push 2
push 0x709
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
push str._Pcmaster_LunarCalendar_MytimeWeb
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4820d2
push 0
push 0
push 0x10
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x483220
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 0x4ae]
test ecx, ecx
je 0x48323e
mov eax, 1
jmp 0x4832b4
push 0
push 0
mov ecx, dword [ebp - 8]
call fcn.004fa2b2
mov edx, dword [ebp - 8]
cmp dword [edx + 0x480], 0
je 0x48326b
push 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x480]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push str.calendar_UICalendar
mov ecx, dword [ebp - 8]
add ecx, 0x20
call fcn.00509af5
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x48328c
mov ecx, dword [ebp - 4]
call fcn.0047cee0
mov byte [0x5c269c], 0
mov byte [0x5c269d], 0
mov byte [0x5c249f], 0
mov byte [0x5c269f], 0
mov eax, dword [ebp - 8]
mov byte [eax + 0x4a8], 0
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4832c0
Capabilities:
Extract resource via kernel32 functions
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x24], ecx
cmp dword [0x5c2478], 0
jne 0x4833e5
push 0x58
call fcn.0053e4e7
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4832f6
mov ecx, dword [ebp - 0x18]
call fcn.0040f2e0
mov dword [ebp - 0x28], eax
jmp 0x4832fd
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x28]
mov dword [0x5c2478], eax
push 0x5873c0
push 0xd2
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x4833e5
mov eax, dword [ebp - 8]
add eax, 1
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004f4318
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 8]
lea edx, [ecx + ecx + 2]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call fcn.0053ef70
add esp, 0xc
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.0053e160
add esp, 0xc
push 0
mov ecx, dword [ebp - 0x14]
add ecx, 2
push ecx
mov ecx, dword [0x5c2478]
call fcn.004665a0
push str.CityList
mov ecx, dword [0x5c2478]
add ecx, 4
call fcn.0041cec0
mov ecx, dword [0x5c2478]
call fcn.0046adf0
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
push eax
call fcn.0053e96b
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret 0x10
Function at 0x48d900
Capabilities:
Check if file exists
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x360], ecx
lea ecx, [ebp - 0x18]
call fcn.004524b0
push ecx
mov ecx, esp
push str.rmup.exe
call fcn.0041c8a0
push ecx
push esp
lea ecx, [ebp - 0x18]
call fcn.004524f0
lea edx, [ebp - 0x1c]
push edx
lea ecx, [ebp - 0x18]
call fcn.00452750
lea ecx, [ebp - 0x1c]
call fcn.0041cb20
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x48d99a
mov eax, dword [ebp - 0x2c]
movzx ecx, byte [eax + 0x35c]
test ecx, ecx
jne 0x48d975
push 0x48da90
push 0
push 0x44cd40
call fcn.00547a7d
add esp, 0xc
mov edx, dword [ebp - 0x2c]
mov byte [edx + 0x35c], 1
mov byte [ebp - 0x25], 0
lea ecx, [ebp - 0x1c]
call fcn.0040f740
lea ecx, [ebp - 0x18]
call fcn.004524d0
mov al, byte [ebp - 0x25]
jmp 0x48d9c3
mov byte [ebp - 0x26], 1
lea ecx, [ebp - 0x1c]
call fcn.0040f740
lea ecx, [ebp - 0x18]
call fcn.004524d0
mov al, byte [ebp - 0x26]
jmp 0x48d9c3
mov esp, ebp
pop ebp
ret 4
Function at 0x48dd00
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
movzx ecx, byte [0x5c2474]
test ecx, ecx
je 0x48dd27
mov eax, 1
jmp 0x48dea1
mov edx, dword [ebp + 0x10]
push edx
lea ecx, [ebp - 8]
call fcn.0048dcc0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x44]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x44]
add ecx, 0x328
call fcn.00454060
test eax, eax
jne 0x48de5a
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x44]
add ecx, 0x338
call fcn.00454060
test eax, eax
jne 0x48de5a
mov edx, dword [ebp - 8]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov ecx, dword [ebp - 0x44]
add ecx, 0x2d8
call fcn.00454060
test eax, eax
jne 0x48de5a
mov eax, dword [ebp - 8]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x44]
add ecx, 0x2e8
call fcn.00454060
test eax, eax
jne 0x48de5a
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
mov ecx, dword [ebp - 0x44]
add ecx, 0x2f8
call fcn.00454060
test eax, eax
jne 0x48de5a
mov edx, dword [ebp - 8]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x38]
push edx
mov ecx, dword [ebp - 0x44]
add ecx, 0x308
call fcn.00454060
test eax, eax
jne 0x48de5a
mov eax, dword [ebp - 8]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x3c]
push edx
mov eax, dword [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x44]
add ecx, 0x318
call fcn.00454060
test eax, eax
je 0x48de61
mov eax, 1
jmp 0x48dea1
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x44]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_DefWindowProcW]
cmp eax, 1
jne 0x48de9c
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x48de9c
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 1
mov eax, 2
jmp 0x48dea1
mov eax, 1
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4942c0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov dword [ebp - 0x38], ecx
mov dword [ebp - 4], 0
jmp 0x4942db
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0x2d8]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x2d8]
mov edx, dword [edx]
mov eax, dword [edx + 0xc]
call eax
cmp dword [ebp - 4], eax
jge 0x4944e4
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0x2d8]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ecx + 0x2d8]
mov edx, dword [eax]
mov eax, dword [edx]
call eax
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [edx + 0x16c]
call eax
push eax
lea ecx, [ebp - 8]
call fcn.0041c880
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x40]
mov eax, dword [edx + 0x16c]
call eax
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.004a6090
add esp, 8
movzx edx, al
test edx, edx
je 0x4944d7
push 0x582b94
push 0x589a0c
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
call fcn.0041ca60
add esp, 0xc
mov ecx, eax
call fcn.0041cb20
push eax
mov ecx, 0x5c2864
call fcn.004a5780
lea ecx, [ebp - 0xc]
call fcn.0040f740
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x2d8]
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0x2d8]
mov edx, dword [ecx]
mov ecx, eax
mov eax, dword [edx + 0x1c]
call eax
push ecx
mov ecx, esp
push str.IDB_SkinSet_CustomBg
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x582b94
call fcn.0041c8a0
mov ecx, dword [ebp - 0x38]
call fcn.0048fde0
push ecx
mov ecx, esp
push 0x5c2864
call fcn.0041c880
push ecx
mov ecx, esp
push str.Customimage
call fcn.0041c8a0
push ecx
mov ecx, esp
push str.DeskCalendar
call fcn.0041c8a0
mov ecx, 0x5c2870
call fcn.00480e10
lea ecx, [ebp - 8]
push ecx
push str.plugimage_
push 0x5c272c
lea edx, [ebp - 0x24]
push edx
call fcn.0041ca60
add esp, 0xc
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0041ca00
add esp, 0xc
mov ecx, eax
call fcn.0041cb20
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x28]
call fcn.0040f740
lea ecx, [ebp - 0x24]
call fcn.0040f740
lea ecx, [ebp - 8]
push ecx
push 0x5c2860
call fcn.004a6090
add esp, 8
movzx edx, al
test edx, edx
je 0x4944cd
push str.IDB_SkinSet_Desk_0
mov ecx, 0x5c2860
call fcn.0041cec0
push ecx
mov ecx, esp
push 0x5c2860
call fcn.0041c880
push ecx
mov ecx, esp
push str.SkinName
call fcn.0041c8a0
push ecx
mov ecx, esp
push str.DeskCalendar
call fcn.0041c8a0
mov ecx, 0x5c2870
call fcn.00480e10
push 0
push 1
push 0x545
mov eax, dword [0x5c271c]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 0x38]
call fcn.004900e0
lea ecx, [ebp - 8]
call fcn.0040f740
jmp 0x4944e4
lea ecx, [ebp - 8]
call fcn.0040f740
jmp 0x4942d2
mov esp, ebp
pop ebp
ret 0xc
Function at 0x494830
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov dword [ebp - 0x38], ecx
mov dword [ebp - 4], 0
jmp 0x49484b
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0x2dc]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x2dc]
mov edx, dword [edx]
mov eax, dword [edx + 0xc]
call eax
cmp dword [ebp - 4], eax
jge 0x494a54
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0x2dc]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ecx + 0x2dc]
mov edx, dword [eax]
mov eax, dword [edx]
call eax
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [edx + 0x16c]
call eax
push eax
lea ecx, [ebp - 8]
call fcn.0041c880
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x40]
mov eax, dword [edx + 0x16c]
call eax
push eax
lea ecx, [ebp - 8]
push ecx
call fcn.004a6090
add esp, 8
movzx edx, al
test edx, edx
je 0x494a47
push 0x582b94
push 0x589a0c
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
push ecx
call fcn.0041ca60
add esp, 0xc
mov ecx, eax
call fcn.0041cb20
push eax
mov ecx, 0x5c286c
call fcn.004a5780
lea ecx, [ebp - 0xc]
call fcn.0040f740
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x2dc]
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0x2dc]
mov edx, dword [ecx]
mov ecx, eax
mov eax, dword [edx + 0x1c]
call eax
push ecx
mov ecx, esp
push str.IDB_SkinSet_CustomBg
call fcn.0041c8a0
push ecx
mov ecx, esp
push 0x582b94
call fcn.0041c8a0
mov ecx, dword [ebp - 0x38]
call fcn.004902c0
push ecx
mov ecx, esp
push 0x5c286c
call fcn.0041c880
push ecx
mov ecx, esp
push str.Customimage
call fcn.0041c8a0
push ecx
mov ecx, esp
push str.Skinset
call fcn.0041c8a0
mov ecx, 0x5c2870
call fcn.00480e10
lea ecx, [ebp - 8]
push ecx
push str.plugimage_
push 0x5c272c
lea edx, [ebp - 0x24]
push edx
call fcn.0041ca60
add esp, 0xc
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0041ca00
add esp, 0xc
mov ecx, eax
call fcn.0041cb20
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x28]
call fcn.0040f740
lea ecx, [ebp - 0x24]
call fcn.0040f740
lea ecx, [ebp - 8]
push ecx
push 0x5c2868
call fcn.004a6090
add esp, 8
movzx edx, al
test edx, edx
je 0x494a3d
push str.IDB_SkinSet_FlowWindow_0
mov ecx, 0x5c2868
call fcn.0041cec0
push ecx
mov ecx, esp
push 0x5c2868
call fcn.0041c880
push ecx
mov ecx, esp
push str.SkinName
call fcn.0041c8a0
push ecx
mov ecx, esp
push str.Skin
call fcn.0041c8a0
mov ecx, 0x5c2870
call fcn.00480e10
push 0
push 4
push 0x558
mov eax, dword [0x5c2718]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 0x38]
call fcn.00490490
lea ecx, [ebp - 8]
call fcn.0040f740
jmp 0x494a54
lea ecx, [ebp - 8]
call fcn.0040f740
jmp 0x494842
mov esp, ebp
pop ebp
ret 0xc
Function at 0x495570
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov byte [eax + 0x4ad], 0
mov byte [0x5c269c], 0
mov byte [0x5c269d], 0
mov byte [0x5c249f], 0
push 0
push 0
mov ecx, dword [ebp - 8]
call fcn.004fa2b2
mov byte [0x5c269f], 0
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x480], 0
je 0x4955cc
push 0
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x480]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push str.calendar_UICalendar
mov ecx, dword [ebp - 8]
add ecx, 0x20
call fcn.00509af5
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4955ed
mov ecx, dword [ebp - 4]
call fcn.0047cee0
mov eax, 1
mov esp, ebp
pop ebp
ret 0x10