joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a6560
Capabilities:
Check if file exists
Get disk size

Disassembly:
push 0x2c
mov eax, 0x5bb74f
call fcn.00598f2b
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
cmp esi, ebx
je 0x4a6717
cmp word [esi], bx
je 0x4a6717
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x4a658a
sub eax, edx
sar eax, 1
push 0x3a
push esi
mov dword [ebp - 0x10], eax
call fcn.0059289e
cmp dword [ebp - 0x10], 2
pop ecx
pop ecx
jl 0x4a670d
cmp eax, ebx
je 0x4a670d
inc eax
inc eax
mov edi, eax
sub edi, esi
push esi
sar edi, 1
mov ecx, 0x63696c
lea esi, [ebp - 0x18]
mov dword [ebp - 0x1c], eax
call fcn.00408d0c
mov dword [ebp - 4], ebx
mov esi, dword [ebp - 0x18]
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRootW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x4a6611
push esi
call edi
test eax, eax
jne 0x4a6611
push ebx
push ebx
push ebx
push str.b_rN0R
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
call fcn.00485e3a
add esp, 0x10
lea eax, [esi - 0x10]
call fcn.00407b6b
jmp 0x4a672d
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4a6631
push dword [ebp + 0xc]
call edi
test eax, eax
jne 0x4a6631
push ebx
push ebx
push ebx
push str.__rNcknx
jmp 0x4a65f6
mov eax, dword [ebp + 0xc]
cmp word [eax], 0x5c
jne 0x4a664b
cmp word [eax + 2], 0x5c
jne 0x4a664b
push ebx
push ebx
push ebx
push str.__rN
jmp 0x4a65f6
push str._:_____r_n
push dword [ebp - 0x1c]
call fcn.0059017c
pop ecx
pop ecx
test eax, eax
je 0x4a6668
push ebx
push ebx
push ebx
push 0x5f0660
jmp 0x4a65f6
cmp dword [ebp - 0x10], 0x64
jle 0x4a667b
push ebx
push ebx
push ebx
push 0x5f068c
jmp 0x4a65f6
xor eax, eax
mov dword [ebp - 0x38], ebx
lea edi, [ebp - 0x34]
stosd dword es:[edi], eax
mov dword [ebp - 0x30], ebx
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
mov dword [ebp - 0x28], ebx
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x38]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x4a66d4
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0x24]
add ecx, 0x1000000
adc eax, ebx
cmp edx, eax
ja 0x4a66d4
jb 0x4a66c7
mov eax, dword [ebp - 0x28]
cmp eax, ecx
jae 0x4a66d4
push ebx
push ebx
push ebx
push 0x5f06b0
jmp 0x4a65f6
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push 1
push edi
push ebx
push dword [eax + 4]
call dword [sym.imp.SHELL32.dll_SHPathPrepareForWriteW]
test eax, eax
jne 0x4a6700
call fcn.004a1a7f
test eax, eax
je 0x4a6700
mov dword [ebp - 0x14], 1
jmp 0x4a6604
push ebx
push ebx
push ebx
push 0x5f06d8
jmp 0x4a65f6
push ebx
push ebx
push ebx
push str.__rNcknx
jmp 0x4a671f
push ebx
push ebx
push ebx
push 0x5f05c8
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
call fcn.00485e3a
add esp, 0x10
mov eax, dword [ebp - 0x14]
call fcn.00599003
ret 0x10
Function at 0x4a71a5
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1c]
push eax
mov edi, 0x5db9c8
push edi
mov dword [ebp - 4], ebx
call fcn.0042cf87
add esp, 0xc
test eax, eax
jne 0x4a71df
xor eax, eax
jmp 0x4a7345
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.004a734c
test eax, eax
je 0x4a71d8
lea eax, [esi + 0x24]
push eax
call fcn.004a6fed
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x4a71d8
mov ecx, dword [esi + 0x4b0]
push ebx
push 1
lea eax, [esi + 0x48]
mov ebx, ecx
call fcn.00519317
push edi
mov ebx, 0x5db9e0
push ebx
mov edi, 0x103
lea eax, [esi + 0x8c]
push edi
push eax
call fcn.0058f42f
push dword [ebp + 0xc]
lea eax, [esi + 0x294]
push ebx
push edi
push eax
call fcn.0058f42f
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x4c8]
and dword [ebp - 0x2c], 0
lea edi, [esi + 0x49c]
lea esi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x7c], eax
mov eax, dword [ebx + 0x4cc]
mov dword [ebx + 0x80], eax
mov eax, dword [ebx + 0x4d0]
movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x84], eax
mov eax, dword [ebx + 0x4d4]
movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x88], eax
xor eax, eax
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0x20
stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetClientRect]
and dword [ebp - 0x3c], 0
push dword [ebx + 0x4b8]
xor eax, eax
lea edi, [ebp - 0x38]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebx + 0x4c4]
mov ecx, dword [ebx + 0x4c0]
mov ebx, dword [ebx + 0x4bc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x3c]
call fcn.004a7860
push ecx
mov eax, esp
push ecx
xor esi, esi
mov dword [eax], esi
mov eax, esp
push dword [ebp - 8]
lea ecx, [ebp - 0x3c]
mov dword [eax], ecx
mov edi, dword [ebp + 8]
mov eax, edi
call fcn.004a7c97
push 0x53
push esi
push esi
push esi
push esi
mov ebx, eax
push 1
push ebx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [edi + 0x4b4]
push 4
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 4
push str.dsktolver
push str.Softwarehao123JuziBrowser
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
call fcn.0045f8eb
push 1
push 0x21
pop ecx
mov edx, str.siteurl
call fcn.0045f9b4
xor eax, eax
cmp ebx, esi
setne al
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4a7a0b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10b0
call fcn.005a41d0
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
movzx ecx, ax
push edi
shr eax, 0x10
push eax
push ecx
lea eax, [esi + 0x7c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4a7a4d
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x4a7b1c
xor eax, eax
push 0x1046
mov word [ebp - 0x1054], ax
xor ebx, ebx
lea eax, [ebp - 0x1052]
push ebx
push eax
call fcn.00596530
push dword [esi + 0x4ac]
add esi, 0x294
push esi
push str.__s____s_
lea eax, [ebp - 0x1054]
push 0x823
push eax
call fcn.0058f42f
push 0x40
lea eax, [ebp - 0x10a8]
push ebx
push eax
call fcn.00596530
xor eax, eax
mov dword [ebp - 0x1064], ebx
lea edi, [ebp - 0x1060]
stosd dword es:[edi], eax
add esp, 0x2c
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x1064]
push eax
lea eax, [ebp - 0x10ac]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
lea eax, [ebp - 0x1054]
push eax
push ebx
mov dword [ebp - 0x10ac], 0x44
mov dword [ebp - 0x1080], 0x80
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4a7b01
push dword [ebp - 0x1060]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1064]
call esi
push ebx
call dword [sym.imp.USER32.dll_PostQuitMessage]
call fcn.0045f8eb
push 1
push 0x22
pop ecx
mov edx, str.siteurl
call fcn.0045f9b4
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0058f3cf
leave
ret 4

Function at 0x4a7f52
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x4a7fa7
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4a7ff5
lea ebx, [esi + 8]
cmp dword [0x634578], edi
jne 0x4a7f81
mov dword [0x634578], edi
lea eax, [ebx + 0x20]
push eax
push 0x634548
call fcn.00414d6c
movzx eax, ax
push eax
push edi
push edi
push 0x80000000
push edi
xor eax, eax
push eax
push 0xfffffffffffffffd
call fcn.00487fbb
jmp 0x4a7ff5
lea ebx, [esi + 0x2c]
cmp dword [ebx], edi
jne 0x4a7ff5
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push edi
push esi
push 0x4a7ffc
push edi
push edi
mov dword [esi + 0x30], eax
call fcn.005905f0
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x18
mov dword [ebp + 8], eax
cmp eax, edi
je 0x4a7fed
push 0x12c
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 8]
call ebx
push dword [esi + 0x30]
call ebx
mov dword [esi + 0x30], edi
pop edi
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x4a93d1
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x294
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp - 4], eax
or dword [ebp - 0x294], 0xffffffff
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x290], ax
lea eax, [ebp - 0x28e]
push eax
mov esi, ecx
call fcn.00596530
add esp, 0xc
lea eax, [ebp - 0x290]
push eax
call fcn.004a9668
test eax, eax
jne 0x4a9426
or eax, 0xffffffff
jmp 0x4a9659
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4a9653
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov edi, eax
push str.iexplore.exe
push edi
call fcn.0058f69a
pop ecx
pop ecx
test eax, eax
jne 0x4a946a
mov dword [ebp - 0x294], 1
jmp 0x4a9653
push 0x5f0a24
push edi
call fcn.0058f69a
pop ecx
pop ecx
test eax, eax
jne 0x4a9547
push 2
mov eax, esi
call fcn.004a9369
mov edi, eax
push 3
mov eax, esi
call fcn.004a9369
mov ebx, eax
push 4
mov eax, esi
call fcn.004a9369
test edi, edi
je 0x4a951d
test ebx, ebx
jne 0x4a94aa
test eax, eax
je 0x4a950e
xor eax, eax
push 0x7e
push eax
mov word [ebp - 0x88], ax
lea eax, [ebp - 0x86]
push eax
call fcn.00596530
add esp, 0xc
push 0x3f
pop ebx
lea esi, [ebp - 0x88]
lea edi, [ebp - 0x290]
call fcn.00475e02
test eax, eax
je 0x4a9653
mov ax, word [ebp - 0x88]
push 0x36
pop ecx
cmp cx, ax
je 0x4a950e
push 0x37
pop ecx
cmp cx, ax
je 0x4a950e
push 0x35
pop ecx
cmp cx, ax
je 0x4a9521
push 0x34
pop ecx
cmp cx, ax
jne 0x4a9653
jmp 0x4a9538
mov dword [ebp - 0x294], 2
jmp 0x4a9653
test ebx, ebx
je 0x4a9530
mov dword [ebp - 0x294], 3
jmp 0x4a9653
test eax, eax
je 0x4a9653
mov dword [ebp - 0x294], 4
jmp 0x4a9653
push str.SogouExplorer.exe
push edi
call fcn.0058f69a
pop ecx
pop ecx
test eax, eax
jne 0x4a9567
mov dword [ebp - 0x294], 6
jmp 0x4a9653
push str.360chrome.exe
push edi
call fcn.0058f69a
pop ecx
pop ecx
test eax, eax
jne 0x4a9587
mov dword [ebp - 0x294], 5
jmp 0x4a9653
push str.chrome.exe
push edi
call fcn.0058f69a
pop ecx
pop ecx
test eax, eax
jne 0x4a95a7
mov dword [ebp - 0x294], 0xa
jmp 0x4a9653
push str.firefox.exe
push edi
call fcn.0058f69a
pop ecx
pop ecx
test eax, eax
jne 0x4a95c7
mov dword [ebp - 0x294], 0xb
jmp 0x4a9653
push str.liebao.exe
push edi
call fcn.0058f69a
pop ecx
pop ecx
test eax, eax
jne 0x4a95e4
mov dword [ebp - 0x294], 7
jmp 0x4a9653
push str.QQBrowser.exe
push edi
call fcn.0058f69a
pop ecx
pop ecx
test eax, eax
jne 0x4a961b
push 0xc
pop edi
push edi
mov eax, esi
call fcn.004a9369
test eax, eax
jne 0x4a9613
push 0xd
pop edi
push edi
mov eax, esi
call fcn.004a9369
test eax, eax
je 0x4a9653
mov dword [ebp - 0x294], edi
jmp 0x4a9653
push str.baidubrowser.exe
push edi
call fcn.0058f69a
pop ecx
pop ecx
test eax, eax
jne 0x4a9638
mov dword [ebp - 0x294], 8
jmp 0x4a9653
push str.hao123browser.exe
push edi
call fcn.0058f69a
pop ecx
pop ecx
test eax, eax
jne 0x4a9653
mov dword [ebp - 0x294], 9
mov eax, dword [ebp - 0x294]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0058f3cf
leave
ret
Function at 0x4a9668
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x634]
sub esp, 0x6b4
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp + 0x630], eax
mov eax, dword [ebp + 0x63c]
push ebx
push esi
push edi
mov dword [ebp - 0x80], eax
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp + 0x3a8], ax
lea eax, [ebp + 0x3aa]
push ebx
push eax
mov dword [ebp - 0x70], ebx
call fcn.00596530
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
add esp, 0xc
cmp dword [0x63a5a8], ebx
je 0x4a972d
push 0x7e
pop edi
xor eax, eax
push edi
mov word [ebp + 0x5b0], ax
lea eax, [ebp + 0x5b2]
push ebx
push eax
call fcn.00596530
add esp, 0xc
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x5b0]
push eax
lea eax, [ebp - 0x78]
push eax
push str.Progid
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
push 0x80000001
mov dword [ebp - 0x78], 1
mov dword [ebp - 0x6c], edi
call esi
test eax, eax
jne 0x4a9746
lea eax, [ebp + 0x5b0]
push eax
push str._s_shellopencommand
lea eax, [ebp + 0x3a8]
push 0x103
push eax
call fcn.0058f42f
add esp, 0x10
jmp 0x4a9746
push str.http_shellopencommand
lea eax, [ebp + 0x3a8]
push 0x103
push eax
call fcn.0058f42f
add esp, 0xc
xor eax, eax
mov edi, 0x40e
push edi
mov word [ebp - 0x68], ax
lea eax, [ebp - 0x66]
push ebx
push eax
call fcn.00596530
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x74]
push eax
push ebx
lea eax, [ebp + 0x3a8]
push eax
push 0x80000000
mov dword [ebp - 0x74], 1
mov dword [ebp - 0x7c], edi
call esi
test eax, eax
jne 0x4a97c9
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x68]
push eax
mov dword [ebp - 0x6c], ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
cmp esi, ebx
je 0x4a97c9
cmp dword [ebp - 0x6c], ebx
je 0x4a97c2
push dword [esi]
push 0x5db9e0
push 0x103
push dword [ebp - 0x80]
call fcn.0058f42f
add esp, 0x10
mov dword [ebp - 0x70], 1
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp + 0x630]
mov eax, dword [ebp - 0x70]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0058f3cf
add ebp, 0x634
leave
ret 4
Function at 0x4a9a4a
Capabilities:
Check if file exists
Copy file
Delete file

Disassembly:
push 0x66c
mov eax, 0x5b9aed
call fcn.00598f94
xor eax, eax
mov ebx, ecx
mov edi, edx
mov dword [ebp - 0x630], edi
mov dword [ebp - 0x62c], eax
cmp word [ebx], ax
je 0x4a9c1a
push 0x206
push eax
lea eax, [ebp - 0x216]
xor ecx, ecx
push eax
mov word [ebp - 0x218], cx
call fcn.00596530
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0042574a
pop ecx
pop ecx
test eax, eax
je 0x4a9c12
xor eax, eax
cmp ax, word [ebp - 0x218]
je 0x4a9c12
lea eax, [ebp - 0x218]
push eax
lea esi, [ebp - 0x65c]
call fcn.0040863b
and dword [ebp - 4], 0
mov eax, dword [edi + 0x18]
mov dword [ebp - 0x634], eax
mov eax, dword [edi]
mov dword [ebp - 0x638], eax
mov eax, esi
push eax
lea eax, [ebp - 0x640]
push eax
push edi
call fcn.004a9f92
lea edi, [ebp - 0x638]
mov esi, eax
call fcn.004acc17
mov bl, al
neg bl
sbb bl, bl
or dword [ebp - 4], 0xffffffff
xor edi, edi
push 0
inc edi
push edi
lea esi, [ebp - 0x65c]
inc bl
call fcn.00404eaf
test bl, bl
jne 0x4a9c12
xor eax, eax
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push eax
call fcn.00596530
lea eax, [ebp - 0x420]
add esp, 0xc
push eax
lea ebx, [ebp - 0x218]
call fcn.004258be
pop ecx
test eax, eax
je 0x4a9c12
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4a9c12
push esi
mov word [ebp - 0x628], ax
xor ebx, ebx
lea eax, [ebp - 0x626]
push ebx
push eax
call fcn.00596530
add esp, 0xc
lea eax, [ebp - 0x628]
push eax
push ebx
push ebx
push 0x7d0
push edi
push ebx
push ebx
push ebx
xor edx, edx
lea ecx, [ebp - 0x218]
call fcn.0047b304
add esp, 0x20
test eax, eax
jne 0x4a9be2
lea eax, [ebp - 0x218]
push eax
lea esi, [ebp - 0x678]
call fcn.0040863b
mov eax, esi
push eax
push dword [ebp - 0x630]
mov dword [ebp - 4], edi
call fcn.004a9eef
push ebx
push edi
mov dword [eax], edi
call fcn.00404eaf
jmp 0x4a9c12
lea ebx, [ebp - 0x420]
call fcn.0047601e
push 0
mov eax, ebx
push eax
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [ebp - 0x62c], eax
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x62c]
jmp 0x4a9c1c
xor eax, eax
call fcn.00599017
ret

Function at 0x4aaec8
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 0x1e0]
test eax, eax
je 0x4aaee1
push str.PROP_CHILD_FIND
push eax
call dword [sym.imp.USER32.dll_RemovePropW]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4aaf34
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4aaf34
push 0xfffe
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push 0x10000
call fcn.004ab4ec
cmp byte [esp + 8], 0
jne 0x4aaf27
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4aaf34
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
and dword [esi + 4], 0
pop esi
ret 4
Function at 0x4ab718
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
shr eax, 0x10
push esi
mov esi, ecx
cmp eax, 0x200
je 0x4ab814
cmp eax, 0x300
je 0x4ab76e
cmp eax, 0x700
je 0x4ab767
cmp eax, 0x800
jne 0x4ab826
push 1
mov eax, edi
call fcn.004aaec8
jmp 0x4ab826
push 1
jmp 0x4ab80b
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4ab826
xor eax, eax
push 0x208
mov word [ebp - 0x210], ax
xor ebx, ebx
lea eax, [ebp - 0x20e]
push ebx
push eax
call fcn.00596530
add esp, 0xc
push 0x104
lea eax, [ebp - 0x210]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x210]
push eax
push 0x63d1b0
call fcn.00407af8
lea esi, [edi + 0x1e4]
cmp word [ebp - 0x210], bx
je 0x4ab7f1
lea eax, [ebp - 0x210]
push eax
push esi
call fcn.0042e684
test eax, eax
je 0x4ab826
lea eax, [ebp - 0x210]
push eax
push esi
call fcn.00407af8
push ebx
jmp 0x4ab80b
call fcn.004078db
push ebx
push ebx
push 0x6405
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
push 0x10000
mov esi, edi
call fcn.004ab4ec
jmp 0x4ab826
push 0x13
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
or eax, 0xffffffff
pop ebx
call fcn.0058f3cf
leave
ret 4

Function at 0x4b08fc
Capabilities:
Hide graphical window

Disassembly:
push edi
mov edi, eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4b0924
push dword [edi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4b0924
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.004b0b3b
pop edi
ret
Function at 0x4b3f55
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push edi
mov esi, ecx
mov dword [ebp - 0x184], eax
jg 0x4b3f84
xor eax, eax
jmp 0x4b4108
call fcn.004b3f28
mov edx, dword [ebp + 0x14]
xor eax, eax
mov ecx, dword [ebp + 0x10]
lea edi, [ebp - 0x190]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0x1c]
add eax, edx
cdq
sub eax, edx
sar eax, 1
sub eax, 0x13
mov dword [ebp - 0x190], eax
add eax, 0x52
add ecx, 0xffffff35
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x194], ecx
lea eax, [ebp - 0x180]
add ecx, 0xd6
push eax
mov dword [ebp - 0x18c], ecx
mov dword [esi + 0x28], 5
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], 0x1a
mov dword [esi + 0x34], 0x16
mov dword [esi + 0x38], 0x7d
mov dword [esi + 0x3c], 0x35
mov dword [esi + 0x40], 0xc3
mov dword [esi + 0x44], 0x4b
mov dword [esi + 0x48], 0x46
mov dword [esi + 0x4c], 0x17
mov dword [esi + 0x50], 0x5c
mov dword [esi + 0x54], 0x24
mov dword [ebp - 0x180], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x58
lea eax, [ebp - 0x64]
push ebx
push eax
mov dword [ebp - 0x68], ebx
call fcn.00596530
add esp, 0xc
cmp dword [ebp - 0x170], 2
jne 0x4b4084
cmp dword [ebp - 0x17c], 6
jb 0x4b4084
push 0xf
pop eax
call fcn.005138c4
neg eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x58], 0x2bc
xor eax, eax
movzx ecx, word [eax + str.Tahoma]
mov word [ebp + eax - 0x4c], cx
inc eax
inc eax
cmp cx, bx
jne 0x4b406f
jmp 0x4b40ab
push 0x12
pop eax
call fcn.005138c4
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x58], 0x2bc
xor eax, eax
movzx ecx, word [eax + str.Tahoma]
mov word [ebp + eax - 0x4c], cx
inc eax
inc eax
cmp cx, bx
jne 0x4b4098
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push str.movietip_new
mov dword [esi + 0x5c], eax
call fcn.00515477
mov dword [esi + 0x24], eax
mov eax, dword [ebp + 0xc]
cmp eax, 0x63
pop ecx
jle 0x4b40d1
push 0x63
pop eax
lea ecx, [esi + 0x64]
mov dword [esi + 0x58], eax
mov eax, dword [ebp - 0x184]
push ecx
push eax
mov dword [esi + 0x60], eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push ecx
mov eax, esp
mov dword [eax], ebx
push ecx
mov eax, esp
lea ecx, [ebp - 0x194]
mov dword [eax], ecx
mov eax, esi
call fcn.004b43f8
xor ecx, ecx
cmp eax, ebx
setne cl
mov eax, ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0058f3cf
leave
ret 0x18
Function at 0x4b4781
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x1d0
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp + 0x74], eax
push ebx
push esi
push edi
push 0x6adda8
call fcn.004882c9
mov edi, 0x63696c
mov ecx, edi
mov esi, 0x6adec4
mov dword [0x6adda8], 0x5f37e8
mov dword [0x6addcc], 0x5f3800
call fcn.0040c2a6
mov ecx, edi
mov esi, 0x6adec8
call fcn.0040c2a6
mov ecx, edi
mov esi, 0x6adecc
call fcn.0040c2a6
mov ecx, edi
mov esi, 0x6aded0
call fcn.0040c2a6
mov ecx, edi
mov esi, 0x6aded4
call fcn.0040c2a6
mov ecx, edi
mov esi, 0x6aded8
call fcn.0040c2a6
mov ecx, edi
mov esi, 0x6adedc
call fcn.0040c2a6
mov ecx, edi
mov esi, 0x6adee0
call fcn.0040c2a6
mov ecx, edi
mov esi, 0x6adeec
call fcn.0040c2a6
or dword [0x6adee8], 0xffffffff
xor esi, esi
lea eax, [ebp - 0x158]
push eax
mov dword [0x6adebc], esi
mov dword [0x6adec0], esi
mov dword [0x6adee4], esi
mov dword [0x6adef0], esi
mov dword [0x6adef4], esi
mov dword [0x6adef8], esi
mov dword [0x6adefc], esi
mov dword [0x6adf00], esi
mov dword [0x6adf04], esi
mov dword [0x6adf08], esi
mov dword [ebp - 0x158], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x58
lea eax, [ebp + 0x1c]
push esi
push eax
mov dword [ebp + 0x18], esi
call fcn.00596530
add esp, 0xc
push 2
pop edi
cmp dword [ebp - 0x148], edi
jne 0x4b48d1
cmp dword [ebp - 0x154], 6
jb 0x4b48d1
push 0x18
pop eax
call fcn.005138c4
neg eax
mov dword [ebp + 0x18], eax
mov dword [ebp + 0x28], esi
xor eax, eax
movzx ecx, word [eax + str.Microsoft_Yahei]
mov word [ebp + eax + 0x34], cx
add eax, edi
cmp cx, si
jne 0x4b48bc
jmp 0x4b48f8
push 0x1e
pop eax
call fcn.005138c4
mov dword [ebp + 0x18], eax
mov dword [ebp + 0x28], 0x2bc
xor eax, eax
movzx ecx, word [eax + str.Tahoma]
mov word [ebp + eax + 0x34], cx
add eax, edi
cmp cx, si
jne 0x4b48e5
mov ebx, dword [sym.imp.GDI32.dll_CreateFontIndirectW]
lea eax, [ebp + 0x18]
push eax
call ebx
push 0x58
mov dword [0x6adeb4], eax
lea eax, [ebp - 0x40]
push esi
push eax
mov dword [ebp - 0x44], esi
call fcn.00596530
add esp, 0xc
cmp dword [ebp - 0x148], edi
jne 0x4b4950
cmp dword [ebp - 0x154], 6
jb 0x4b4950
push 0x10
pop eax
call fcn.005138c4
neg eax
mov dword [ebp - 0x44], eax
xor eax, eax
movzx ecx, word [eax + str.Microsoft_Yahei]
mov word [ebp + eax - 0x28], cx
add eax, edi
cmp cx, si
jne 0x4b493b
jmp 0x4b4970
push 0x12
pop eax
call fcn.005138c4
mov dword [ebp - 0x44], eax
xor eax, eax
movzx ecx, word [eax + str.Tahoma]
mov word [ebp + eax - 0x28], cx
add eax, edi
cmp cx, si
jne 0x4b495d
lea eax, [ebp - 0x44]
push eax
call ebx
mov ecx, dword [ebp + 0x74]
pop edi
pop esi
mov dword [0x6adeb8], eax
xor ecx, ebp
mov eax, 0x6adda8
pop ebx
call fcn.0058f3cf
add ebp, 0x78
leave
ret