joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a530
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov edi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
cmp byte [ebp + 0xc], 0
mov esi, dword [ebp + 8]
je 0x43a56b
mov ecx, dword [edi + 0x84]
cmp eax, ecx
je 0x43a56b
cmp esi, dword [edi + 0xe8]
je 0x43a56b
cmp byte [edi + 0xe0], 0
jne 0x43a56b
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [edi + 0xe8]
cmp esi, eax
je 0x43a662
test eax, eax
je 0x43a5d8
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0x14
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x10], xmm0
movlpd qword [ebp - 8], xmm0
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0xe8]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x11c]
push 1
push 0
push 0
push 0
push str.killfocus
push dword [edi + 0xe8]
mov ecx, edi
call sym.uninstaller.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool__bool_
mov dword [edi + 0xe8], 0
test esi, esi
je 0x43a662
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
cmp eax, edi
jne 0x43a662
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0xdc]
call eax
test al, al
je 0x43a662
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0xe8]
call eax
test al, al
je 0x43a662
xorps xmm0, xmm0
mov dword [edi + 0xe8], esi
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x10], xmm0
movlpd qword [ebp - 8], xmm0
mov dword [ebp - 0x20], 0x15
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0xe8]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x11c]
push 1
push 0
push 0
push 0
push str.setfocus
push dword [edi + 0xe8]
mov ecx, edi
call sym.uninstaller.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool__bool_
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x43d220
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
push 4
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindow]
push 1
push dword [esi + 4]
mov edi, eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push 0
push edi
call ebx
push dword [esi + 4]
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movups xmmword [ebp - 0x1c], xmm0
movq qword [ebp - 0xc], xmm0
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x43d2db
nop
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x43d2db
cmp dword [ebp - 0x18], 0x10
jne 0x43d2a4
mov eax, dword [ebp - 0x1c]
cmp eax, dword [esi + 4]
jne 0x43d2a4
mov eax, dword [ebp - 0x14]
push 1
push edi
mov dword [esi + 0x10], eax
call ebx
push edi
call dword [sym.imp.USER32.dll_SetFocus]
lea eax, [ebp - 0x1c]
push eax
call sym.uninstaller.exe_public:_static_bool___cdecl_DuiLib::CPaintManagerUI::TranslateMessage_struct_tagMSG__const_
add esp, 4
test al, al
jne 0x43d2c8
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp - 0x18], 0x12
je 0x43d2db
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x43d270
push 1
push edi
call ebx
push edi
call dword [sym.imp.USER32.dll_SetFocus]
cmp dword [ebp - 0x18], 0x12
jne 0x43d2f6
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [esi + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43d300
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov esi, ecx
push 4
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindow]
cmp byte [ebp + 8], 0
mov edi, eax
je 0x43d330
cmp byte [ebp + 0xc], 0
mov eax, 4
mov ecx, 1
cmovne eax, ecx
jmp 0x43d332
xor eax, eax
push ebx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push 0
push edi
call ebx
push dword [esi + 4]
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movups xmmword [ebp - 0x1c], xmm0
movq qword [ebp - 0xc], xmm0
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x43d3d3
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x43d3d3
cmp dword [ebp - 0x18], 0x10
jne 0x43d39c
mov eax, dword [ebp - 0x1c]
cmp eax, dword [esi + 4]
jne 0x43d39c
mov eax, dword [ebp - 0x14]
push 1
push edi
mov dword [esi + 0x10], eax
call ebx
push edi
call dword [sym.imp.USER32.dll_SetFocus]
lea eax, [ebp - 0x1c]
push eax
call sym.uninstaller.exe_public:_static_bool___cdecl_DuiLib::CPaintManagerUI::TranslateMessage_struct_tagMSG__const_
add esp, 4
test al, al
jne 0x43d3c0
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp - 0x18], 0x12
je 0x43d3d3
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x43d368
push 1
push edi
call ebx
push edi
call dword [sym.imp.USER32.dll_SetFocus]
cmp dword [ebp - 0x18], 0x12
pop ebx
jne 0x43d3ef
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [esi + 0x10]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x43d400
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x43d445
cmp byte [ebp + 8], 0
je 0x43d439
cmp byte [ebp + 0xc], 0
mov ecx, 1
mov eax, 4
cmovne eax, ecx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
xor eax, eax
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
Function at 0x463660
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53da8b
mov eax, dword fs:[0]
push eax
sub esp, 0x98
invalid
invalid

Function at 0x463960
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x59c388]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x1c], 0
je 0x4639eb
cmp dword [esi + 0x14], 0
je 0x4639eb
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.004f45f0
mov ebx, esp
test ebx, ebx
je 0x4639eb
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x14]
push ebx
add ecx, 0x1e4
call fcn.0042d3a0
mov ecx, dword [esi + 0x14]
push 1
push 0
push 0
mov eax, dword [ecx]
push 0
push str.textchanged
push ecx
call dword [eax + 0x24]
mov ecx, eax
call sym.uninstaller.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool__bool_
mov ecx, dword [esi + 0x14]
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, eax
call sym.uninstaller.exe_public:_bool___thiscall_DuiLib::CPaintManagerUI::IsLayered_void_
test al, al
je 0x4639eb
mov ecx, dword [esi + 0x14]
call sym.uninstaller.exe_public:_void___thiscall_DuiLib::CControlUI::Invalidate_void_
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f3d68
mov esp, ebp
pop ebp
ret 0x10

Function at 0x464820
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x59c388]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [ebp + 8]
push esi
push dword [ebp + 0x18]
mov esi, ecx
sub esp, 0x10
mov eax, esp
movups xmmword [eax], xmm0
call sym.uninstaller.exe_public_virtual:_void___thiscall_DuiLib::CControlUI::SetPos_struct_tagRECT__bool_
mov ecx, dword [esi + 0x6d0]
test ecx, ecx
je 0x4648b5
lea eax, [ebp - 0x14]
push eax
call fcn.00462ab0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
mov esi, dword [esi + 0x6d0]
test eax, eax
je 0x46488f
push 0
mov ecx, esi
call sym.uninstaller.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f3d68
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
sub eax, edx
mov ecx, dword [ebp - 0x14]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, ecx
push eax
push edx
push ecx
push 0
mov ecx, esi
call sym.uninstaller.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004f3d68
mov esp, ebp
pop ebp
ret 0x14
Function at 0x46dea0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x69c], 0
je 0x46df0f
cmp dword [ebp + 8], 0x100
jne 0x46deff
cmp word [ebp + 0xc], 0xd
jne 0x46deff
cmp byte [esi + 0x6a2], 0
je 0x46dede
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x46deff
cmp byte [esi + 0x6a3], 0
jne 0x46deff
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x46def8
push 1
push 0
push 0
push 0
push str.return
push esi
call sym.uninstaller.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___wchar_t_const___unsigned_int__long_int__bool__bool_
xor eax, eax
pop esi
pop ebp
ret 0x10
mov eax, dword [esi + 0x69c]
pop esi
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xc]
mov eax, 1
pop esi
pop ebp
ret 0x10
Function at 0x46e8f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53e2ab
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
mov eax, dword [0x59c388]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [edi + 0x14], eax
mov dword [eax + 0x6e0], 0
cmp dword [edi + 4], 0
jne 0x46e9a6
lea eax, [ebp - 0xa8]
push eax
call fcn.0046e3b0
mov ecx, dword [edi + 0x14]
movups xmm0, xmmword [ebp - 0xa8]
push 0
sub esp, 0x10
mov eax, esp
push 0
movups xmmword [eax], xmm0
mov eax, dword [ecx]
push 0x40000000
push 0
mov eax, dword [eax + 0x24]
call eax
mov ecx, eax
call sym.uninstaller.exe_public:_struct_HWND______thiscall_DuiLib::CPaintManagerUI::GetPaintWindow_void_const
push eax
mov ecx, edi
call sym.uninstaller.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::Create_struct_HWND_____wchar_t_const___unsigned_long_int__unsigned_long_int__struct_tagRECT__struct_HMENU____
mov esi, dword [edi + 0x14]
mov ecx, esi
call sym.uninstaller.exe_public:_int___thiscall_DuiLib::CLabelUI::GetFont_void_const
push eax
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0x24]
call eax
mov ecx, eax
call sym.uninstaller.exe_public:_struct_DuiLib::tagTFontInfo____thiscall_DuiLib::CPaintManagerUI::GetFontInfo_int_
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push dword [eax]
push 0x30
push dword [edi + 4]
call esi
mov ecx, dword [edi + 0x14]
lea edx, [ebp - 0x94]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 0x38]
call eax
mov dword [ebp - 4], 0
mov ecx, eax
call sym.uninstaller.exe_public:_bool___thiscall_DuiLib::CDuiString::IsEmpty_void_const
mov byte [ebp - 0x95], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call sym.uninstaller.exe_public:_void___thiscall_DuiLib::CDuiString::destructor_void_
cmp byte [ebp - 0x95], 0
je 0x46e9f5
mov eax, dword [edi + 0x14]
add eax, 0x6d0
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [edi + 0x14]
add eax, 0x6d0
push eax
push 0
push 0x1002
push dword [edi + 4]
call esi
push 4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [edi + 0x1c], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f3d68
mov esp, ebp
pop ebp
ret 4
Function at 0x46eb40
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x59c388]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [ebp + 8]
push esi
push dword [ebp + 0x18]
mov esi, ecx
sub esp, 0x10
mov eax, esp
movups xmmword [eax], xmm0
call sym.uninstaller.exe_public_virtual:_void___thiscall_DuiLib::CControlUI::SetPos_struct_tagRECT__bool_
mov ecx, dword [esi + 0x6e8]
test ecx, ecx
je 0x46ebd5
lea eax, [ebp - 0x14]
push eax
call fcn.0046e3b0
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
mov esi, dword [esi + 0x6e8]
test eax, eax
je 0x46ebaf
push 0
mov ecx, esi
call sym.uninstaller.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f3d68
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
sub eax, edx
mov ecx, dword [ebp - 0x14]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, ecx
push eax
push edx
push ecx
push 0
mov ecx, esi
call sym.uninstaller.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004f3d68
mov esp, ebp
pop ebp
ret 0x14
Function at 0x474730
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x59c388]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
test ebx, ebx
je 0x4747d2
push 0x104
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0051ce80
lea ecx, [ebp - 0x20c]
add esp, 0xc
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x474771
sub ecx, edx
sar ecx, 1
je 0x4747b1
movzx eax, word [ebp + ecx*2 - 0x20e]
cmp eax, 0x2f
je 0x474794
cmp eax, 0x5c
jne 0x4747b1
lea ecx, [ecx*2 - 2]
cmp ecx, 0x208
jae 0x4748da
xor eax, eax
mov word [ebp + ecx - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4747d2
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [edi]
test ax, ax
je 0x4748ca
push esi
mov esi, edi
mov ecx, edi
mov edx, eax
cmp dx, 0x2f
je 0x4747f1
cmp dx, 0x5c
jne 0x4747f3
mov esi, ecx
movzx eax, word [ecx + 2]
add ecx, 2
mov edx, eax
test ax, ax
jne 0x4747e5
cmp esi, edi
je 0x474841
sub esi, edi
lea eax, [ebp - 0x20c]
and esi, 0xfffffffe
push esi
push edi
push eax
call fcn.0050b2a0
add esp, 0xc
cmp esi, 0x208
jae 0x4748da
xor eax, eax
mov word [ebp + esi - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.00474730
add esp, 8
xor eax, eax
mov word [ebp - 0x414], ax
pop esi
test ebx, ebx
je 0x474864
push 0x104
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.0051ce80
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0x414]
mov word [ebp - 0x20e], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x474876
sub ecx, edx
mov eax, 0x104
sar ecx, 1
sub eax, ecx
push eax
lea eax, [ebp - 0x414]
lea eax, [eax + ecx*2]
push edi
push eax
call fcn.0051ce80
xor eax, eax
add esp, 0xc
mov word [ebp - 0x20e], ax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4748ca
push 0
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.004f3d68
mov esp, ebp
pop ebp
call fcn.004f418e
int3
Function at 0x475490
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
mov dword [ebp - 8], ebx
cmp dword [ebx], 0
jne 0x47562c
cmp dword [ebx + 4], 0xffffffff
jne 0x47562c
push esi
lea esi, [ebx + 0x244]
push esi
push 0x103
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4754c5
sub esi, ecx
sar esi, 1
movzx eax, word [ebx + esi*2 + 0x242]
cmp eax, 0x5c
je 0x4754f3
cmp eax, 0x2f
je 0x4754f3
mov dword [ebx + esi*2 + 0x244], 0x2f
xor eax, eax
push edi
mov edi, dword [ebp + 0x10]
cmp edi, 1
jne 0x47551e
mov esi, dword [ebp + 8]
push edi
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x475539
pop edi
pop esi
mov eax, 0x2000000
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp edi, 2
je 0x475536
cmp edi, 3
je 0x475536
pop edi
pop esi
mov eax, 0x10000
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov esi, dword [ebp + 8]
xor ebx, ebx
xor al, al
mov byte [ebp - 1], al
mov byte [ebp + 0x13], bl
cmp edi, 1
je 0x47557f
cmp edi, 2
jne 0x47559b
push ebx
push 0x80
push 3
push ebx
push 1
push accept
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x475579
pop edi
pop esi
mov eax, 0x200
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov byte [ebp + 0x13], 1
jmp 0x475585
mov ebx, esi
mov byte [ebp + 0x13], 0
push 1
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
setne al
mov byte [ebp - 1], al
push 0x20
call fcn.004f3aa4
add esp, 4
mov esi, eax
cmp edi, 1
je 0x4755d6
cmp edi, 2
je 0x4755d6
mov eax, dword [ebp + 8]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0xc]
mov word [esi], 0x100
mov byte [esi + 0x10], 0
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], 0
mov dword [esi + 0xc], 0
jmp 0x475607
mov al, byte [ebp + 0x13]
mov byte [esi + 0x10], al
mov al, byte [ebp - 1]
mov byte [esi], 1
mov byte [esi + 1], al
mov dword [esi + 4], ebx
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
test al, al
je 0x475607
push 1
push 0
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esi + 0xc], eax
push esi
call fcn.004785e0
mov ecx, dword [ebp - 8]
add esp, 4
mov edx, 0x200
mov dword [ecx], eax
xor ecx, ecx
test eax, eax
pop edi
cmove ecx, edx
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0x1000000
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x475ce0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movsx eax, byte [ebp + 0xc]
mov ecx, dword [edx]
xor eax, ecx
movzx eax, al
shr ecx, 8
mov eax, dword [eax*4 + 0x54ec10]
xor eax, ecx
mov ecx, dword [edx + 8]
mov dword [edx], eax
movzx eax, al
add eax, dword [edx + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x54ec10]
mov dword [edx + 8], ecx
pop ebp
ret
Function at 0x4781a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, esi
imul ebx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
cmp byte [edi], 0
je 0x4781de
push 0
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4781d2
mov byte [edi + 8], 1
mov eax, dword [ebp + 0xc]
xor edx, edx
pop edi
div esi
pop esi
pop ebx
pop ebp
ret
mov edx, dword [edi + 0x1c]
mov esi, dword [edi + 0x18]
mov ecx, dword [edi + 0x14]
sub esi, edx
lea eax, [edx + ebx]
cmp eax, dword [edi + 0x18]
cmovbe esi, ebx
add ecx, edx
push esi
push ecx
push dword [ebp + 8]
call fcn.0050b2a0
add dword [edi + 0x1c], esi
add esp, 0xc
mov eax, esi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x478210
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x47821e
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not eax
cmp esi, 8
jb 0x4782dd
push edi
mov edi, esi
shr edi, 3
movzx ecx, byte [edx]
sub esi, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x54ec10]
movzx ecx, byte [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x54ec10]
movzx ecx, byte [edx + 2]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x54ec10]
movzx ecx, byte [edx + 3]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x54ec10]
movzx ecx, byte [edx + 4]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x54ec10]
movzx ecx, byte [edx + 5]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x54ec10]
movzx ecx, byte [edx + 6]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x54ec10]
movzx ecx, byte [edx + 7]
add edx, 8
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x54ec10]
sub edi, 1
jne 0x478236
pop edi
test esi, esi
je 0x4782fb
movzx ecx, byte [edx]
lea edx, [edx + 1]
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x54ec10]
sub esi, 1
jne 0x4782e1
not eax
pop esi
pop ebp
ret
Function at 0x479110
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 1
cmp byte [esi], 0
je 0x479144
push 0
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xb]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x47913f
mov byte [esi + 8], 1
mov edi, dword [ebp - 4]
jmp 0x479170
mov ecx, dword [esi + 0x18]
push ebx
mov ebx, dword [esi + 0x1c]
lea eax, [ebx + 1]
cmp eax, ecx
jbe 0x479156
mov edi, ecx
sub edi, ebx
mov eax, dword [esi + 0x14]
add eax, ebx
push edi
push eax
lea eax, [ebp + 0xb]
push eax
call fcn.0050b2a0
add esp, 0xc
lea eax, [ebx + edi]
mov dword [esi + 0x1c], eax
pop ebx
cmp edi, 1
jne 0x479186
mov eax, dword [ebp + 0xc]
movzx ecx, byte [ebp + 0xb]
mov dword [eax], ecx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0
je 0x47917e
cmp byte [esi + 8], 0
je 0x47917e
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x497440
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x59c388]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x5a0880]
mov ecx, eax
inc eax
mov dword [0x5a0880], eax
test ecx, ecx
je 0x497474
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f3d68
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0xc], 0
je 0x4974ac
mov dword [fcn.00519125], 0x519125
mov dword [fcn.005107b2], 0x5107b2
mov dword [fcn.00519130], 0x519130
mov dword [0x59c2bc], 0x5269ec
mov dword [fcn.005107a7], 0x5107a7
push ebx
call fcn.004a5530
test eax, eax
je 0x4974ee
mov ebx, dword [ebp + 8]
test bl, 2
je 0x49751c
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4974ee
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x497502
shr eax, 8
cmp al, 2
jne 0x497502
call fcn.004a41e0
test eax, eax
je 0x49751c
mov eax, 2
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f3d68
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f3d68
mov esp, ebp
pop ebp
ret
call sym.uninstaller.exe_protected_virtual:_unsigned_int___thiscall_DuiLib::CWindowWnd::GetClassStyle_void_const
test eax, eax
jne 0x4974ee
call fcn.004a2200
mov eax, dword [0x5a0ab4]
test bl, 4
mov ecx, 1
mov dword [0x5a0884], ebx
cmovne eax, ecx
mov dword [0x5a0ab4], eax
call fcn.00497670
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop ebx
call fcn.004f3d68
mov esp, ebp
pop ebp
ret