joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42c374
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x513010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor dl, dl
mov ecx, str.KillProcessesUsingInstallation___n
call fcn.00461f14
call fcn.0042bcc7
mov esi, eax
mov dword [ebp - 0x254], esi
test esi, esi
je 0x42c57d
cmp byte [esi], 0
je 0x42c57d
push 0x4f8d1c
mov edx, esi
xor ecx, ecx
call fcn.0046297c
mov edx, esi
mov dword [ebp - 0x250], eax
xor ecx, ecx
mov dword [esp], str.npPdfViewer.dll
call fcn.0046297c
pop ecx
xor ebx, ebx
mov dword [ebp - 0x24c], eax
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x42c563
push 0x228
lea eax, [ebp - 0x234]
mov byte [ebp - 0x248], 1
push ebx
push eax
call fcn.004b8c50
add esp, 0xc
mov dword [ebp - 0x238], 0x22c
lea eax, [ebp - 0x238]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x42c552
mov esi, dword [ebp - 0x250]
mov eax, dword [ebp - 0x230]
mov edx, esi
push dword [ebp - 0x24c]
mov ecx, eax
mov dword [ebp - 0x240], eax
call fcn.0042be9b
pop ecx
test al, al
je 0x42c52c
or edx, 0xffffffff
lea ecx, [ebp - 0x214]
call fcn.00462810
push eax
push dword [ebp - 0x240]
push str.__attempting_to_kill_process__d__s_n
call fcn.004620b3
add esp, 0xc
push dword [ebp - 0x240]
push str.KillProcWithId_processId_d__n
call fcn.004620b3
pop ecx
pop ecx
push dword [ebp - 0x240]
push ebx
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x244], eax
test eax, eax
je 0x42c4f3
cmp eax, 0xffffffff
je 0x42c4f3
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x42c4d2
push dword [ebp - 0x244]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
mov byte [ebp - 0x239], al
jmp 0x42c4fb
push 0x2710
push dword [ebp - 0x244]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x244]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x42c4ca
mov al, bl
mov byte [ebp - 0x239], bl
movzx eax, al
push eax
push dword [ebp - 0x240]
push str.__KillProcWithId__d__returned__d_n
call fcn.004620b3
mov eax, dword [ebp - 0x248]
xor ecx, ecx
add esp, 0xc
movzx eax, al
cmp byte [ebp - 0x239], cl
cmove eax, ecx
mov dword [ebp - 0x248], eax
lea eax, [ebp - 0x238]
mov dword [ebp - 0x238], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x42c437
mov esi, dword [ebp - 0x254]
mov bl, byte [ebp - 0x248]
test edi, edi
je 0x42c563
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x24c]
call fcn.004c5e5a
pop ecx
push dword [ebp - 0x250]
call fcn.004c5e5a
pop ecx
jmp 0x42c57f
mov bl, 1
push esi
call fcn.004c5e5a
pop ecx
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b7879
leave
ret
Function at 0x42c597
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x513010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor dl, dl
mov ecx, str.ProcessesUsingInstallation___n
call fcn.00461f14
call fcn.0042bcc7
mov esi, eax
mov dword [ebp - 0x244], esi
test esi, esi
je 0x42c6c4
cmp byte [esi], 0
je 0x42c6c4
xor ebx, ebx
mov edx, 0x4f8d1c
push ebx
mov ecx, esi
call fcn.00462922
pop ecx
push ebx
mov edx, str.npPdfViewer.dll
mov dword [ebp - 0x23c], eax
mov ecx, esi
call fcn.00462922
pop ecx
push ebx
push 2
mov dword [ebp - 0x240], eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x42c6c4
push 0x228
lea eax, [ebp - 0x234]
push ebx
push eax
call fcn.004b8c50
add esp, 0xc
mov dword [ebp - 0x238], 0x22c
lea eax, [ebp - 0x238]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x42c6b9
mov esi, dword [ebp - 0x23c]
mov ebx, dword [ebp - 0x230]
mov edx, esi
push dword [ebp - 0x240]
mov ecx, ebx
call fcn.0042be9b
pop ecx
test al, al
je 0x42c697
or edx, 0xffffffff
lea ecx, [ebp - 0x214]
call fcn.00462810
push ebx
push eax
push str._s___d_
call fcn.0045f9ea
add esp, 8
mov ebx, eax
mov ecx, 0x519340
push ebx
call fcn.00461461
push ebx
call fcn.004c5e5a
pop ecx
lea eax, [ebp - 0x238]
mov dword [ebp - 0x238], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x42c64c
mov esi, dword [ebp - 0x244]
test edi, edi
je 0x42c6c4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.004c5e5a
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b7879
leave
ret
Function at 0x4372a3
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
push 0x100
xor ebx, ebx
push ebx
push 0x519588
call fcn.004b8c50
push 0x1c0
push ebx
push 0x5196a4
mov dword [0x519688], ebx
call fcn.004b8c50
add esp, 0x18
mov eax, 0x5196b8
mov edx, 0xffff
push 8
pop ecx
and dword [eax - 8], ebx
mov dword [eax - 0x14], ebx
mov dword [eax - 0x10], ebx
mov dword [eax - 0xc], ebx
mov dword [eax - 4], 0xffffffff
mov word [eax], dx
lea eax, [eax + 0x38]
and dword [eax - 0x34], ebx
and dword [eax - 0x30], ebx
and dword [eax - 0x2c], ebx
and dword [eax - 0x28], ebx
mov byte [eax - 0x24], bl
mov dword [eax - 0x20], ebx
mov dword [eax - 0x1c], ebx
mov dword [eax - 0x18], ebx
sub ecx, 1
jne 0x4372de
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push ebx
mov dword [0x519864], ebx
mov dword [0x519868], ebx
mov dword [0x519884], ebx
call edi
push 1
mov esi, eax
call edi
push 0x1000
mov dword [0x519888], esi
mov dword [0x51988c], eax
mov byte [0x519890], bl
mov dword [0x519894], ebx
mov dword [0x519898], ebx
mov dword [0x51989c], ebx
call edi
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
test eax, eax
push 0x51968c
setne byte [0x519890]
mov dword [0x519894], ebx
mov dword [0x519898], 0xffffff
call esi
push 0x51986c
call esi
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push ebx
push ebx
mov esi, 0x519588
mov dword [0x51989c], eax
push esi
push 0x43852f
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [0x519884], eax
sete cl
call fcn.00413f3a
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x439aed
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov byte [esp + 0xf], dl
xor dl, dl
push edi
mov edi, ecx
call fcn.00439aaf
mov eax, dword [ebp + 8]
test eax, eax
je 0x439ba9
cmp byte [eax], 0
je 0x439ba9
push 0x18
call fcn.004b7b0e
mov esi, eax
or edx, 0xffffffff
mov al, byte [esp + 0x17]
pop ecx
xor ecx, ecx
mov byte [esi + 9], cl
lea ebx, [esi + 0xc]
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [esi + 0x14], ecx
push ecx
mov ecx, dword [ebp + 8]
mov dword [esi], 0x4fbcc8
mov dword [esi + 4], edi
mov byte [esi + 8], al
call fcn.004692d1
pop ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], eax
cmp ebx, ecx
je 0x439b71
push dword [ebx]
call fcn.004c5e5a
mov eax, dword [esp + 0x18]
and dword [ebx + 4], 0
mov dword [ebx], eax
xor eax, eax
pop ecx
push eax
call fcn.004c5e5a
mov al, byte [ebp + 0xc]
pop ecx
push dword [ebp + 0x10]
mov ecx, esi
mov byte [esi + 9], al
call fcn.00439596
xor eax, eax
push eax
push eax
push esi
push 0x4398b1
push eax
push eax
mov dword [edi + 0x1cc], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x1cc], eax
mov dword [esi + 0x14], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43a7b3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
push edi
lea eax, [esp + 0xc]
mov dword [esp + 0x1c], edx
push eax
lea eax, [esp + 0x18]
xor ebx, ebx
push eax
push str._Search___s____s___
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x1c], ebx
call fcn.0045fe6c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x43a914
mov eax, dword [esp + 0xc]
test eax, eax
je 0x43a912
cmp byte [eax], bl
je 0x43a912
mov ecx, dword [esp + 0x14]
mov dl, 1
call fcn.00441cdc
mov edi, eax
test edi, edi
je 0x43a916
mov ecx, edi
call fcn.0042d50a
test al, al
jne 0x43a83b
xor dl, dl
mov ecx, edi
call fcn.004435e4
mov ecx, edi
call fcn.0042d50a
test al, al
je 0x43a916
mov eax, dword [esp + 0x1c]
mov ecx, 0x8000
xor dl, dl
or word [eax], cx
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x18], ecx
mov ecx, edi
call fcn.00439aaf
mov eax, dword [esp + 0x18]
test eax, eax
je 0x43a909
cmp byte [eax], bl
je 0x43a909
push 0x18
call fcn.004b7b0e
pop ecx
push ebx
or edx, 0xffffffff
mov dword [esp + 0x14], eax
lea ecx, [eax + 0xc]
mov dword [eax], 0x4fbcc8
mov dword [esp + 0x20], ecx
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov ecx, dword [esp + 0x1c]
mov word [eax + 8], 1
mov dword [eax + 0x14], ebx
mov dword [eax + 4], edi
call fcn.004692d1
pop ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x20]
mov dword [esp + 0x18], eax
cmp ecx, edx
je 0x43a8cb
push dword [ecx]
call fcn.004c5e5a
mov eax, dword [esp + 0x20]
pop ecx
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
mov dword [eax + 4], ebx
mov eax, ebx
push eax
call fcn.004c5e5a
mov eax, dword [esp + 0x14]
pop ecx
push 1
mov ecx, eax
mov byte [eax + 9], 1
call fcn.00439596
push ebx
push ebx
push dword [esp + 0x18]
mov dword [edi + 0x1cc], ebx
push 0x4398b1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 0x10]
mov dword [edi + 0x1cc], eax
mov dword [ecx + 0x14], eax
mov ecx, edi
call fcn.0042d86a
jmp 0x43a916
mov ebx, esi
mov esi, ebx
push dword [esp + 0xc]
call fcn.004c5e5a
pop ecx
push dword [esp + 0x14]
call fcn.004c5e5a
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43bb54
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
call fcn.0042d56a
mov edi, eax
mov edx, dword [edi + 0x84]
cmp dword [edx + 4], 0
jne 0x43bb7f
cmp dword [esi + 0xdc], 4
je 0x43bb7f
mov cl, 1
jmp 0x43bb81
xor cl, cl
call fcn.00413f3a
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x43bc56
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ecx, esi
call fcn.0042d649
mov ebx, eax
mov byte [ebp - 1], 0
lea eax, [ebp - 1]
mov edx, 0x4f6dbc
push eax
mov ecx, edi
call fcn.0043b9d5
mov esi, eax
pop ecx
test esi, esi
je 0x43bbcc
cmp byte [esi], 0
je 0x43bbcc
mov ecx, esi
call fcn.0046552e
push esi
call fcn.004c5e5a
cmp byte [ebp - 1], 0
pop ecx
jne 0x43bc50
test ebx, ebx
je 0x43bc50
mov esi, dword [edi + 0x84]
test esi, esi
je 0x43bc50
cmp dword [esi + 4], 0
je 0x43bc50
xor cl, cl
call fcn.00413f3a
cmp dword [esi + 4], 0
setle cl
call fcn.00413f3a
mov esi, dword [esi + 0x10]
mov ecx, ebx
push dword [esi]
call fcn.00420233
mov ecx, dword [ebx + 0x6c]
lea edx, [ebp - 0x1c]
mov eax, dword [esi]
and dword [ebp - 8], 0
mov dword [ebp - 0x1c], eax
lea eax, [esi + 4]
movss dword [ebp - 0x18], xmm0
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 2
mov ecx, dword [ebx + 0x1c]
push edx
mov eax, dword [ecx]
call dword [eax + 0x10]
mov esi, eax
test esi, esi
je 0x43bc50
mov ecx, dword [esi + 0xc]
call fcn.00465598
mov edx, dword [esi]
mov ecx, esi
push 1
call dword [edx + 8]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x43c260
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
lea eax, [ebp - 8]
push esi
push edi
push eax
mov esi, edx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [edi]
mov ecx, edi
push esi
mov eax, dword [eax + 0x48]
call eax
test al, al
jne 0x43c293
push esi
push str.Error:_failed_to_load_page__d_n
call fcn.004620b3
pop ecx
pop ecx
jmp 0x43c30a
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00414714
movsd qword [esp], xmm0
push esi
push str.pageload____3d:__.2f_ms_n
call fcn.004620b3
add esp, 0x10
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [edi]
lea ecx, [ebp - 0x20]
xorps xmm0, xmm0
mov dword [ebp - 0x20], esi
push ecx
mov ecx, edi
mov dword [ebp - 0x1c], 0x3f800000
movups xmmword [ebp - 0x18], xmm0
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x43c2e5
push esi
push str.Error:_failed_to_render_page__d_n
jmp 0x43c28a
mov eax, dword [ecx]
push 1
call dword [eax + 8]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00414714
movsd qword [esp], xmm0
push esi
push str.pagerender__3d:__.2f_ms_n
call fcn.004620b3
add esp, 0x10
pop edi
pop esi
leave
ret
Function at 0x43c30e
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push edi
push eax
mov edi, ecx
call esi
push edi
push str.Starting:__s_n
call fcn.004620b3
pop ecx
pop ecx
lea eax, [ebp - 8]
push eax
call esi
xor edx, edx
mov ecx, edi
call fcn.0041c84d
mov esi, eax
test esi, esi
jne 0x43c355
push edi
push str.Error:_failed_to_load__s_n
call fcn.004620b3
pop ecx
pop ecx
jmp 0x43c39c
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00414714
movsd qword [esp], xmm0
push str.load:__.2f_ms_n
call fcn.004620b3
mov eax, dword [esi]
add esp, 0xc
mov ecx, esi
push 1
call dword [eax]
push edi
push ecx
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.00414714
movsd qword [esp + 4], xmm0
mov dword [esp], str.Finished__in__.2f_ms_:__s_n
call fcn.004620b3
add esp, 0x10
pop edi
pop esi
leave
ret
Function at 0x43c3a0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
mov eax, dword [0x513010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xa4], edx
mov dword [ebp - 0xb4], edi
call fcn.0046330d
test al, al
je 0x43c5ca
mov ecx, edi
call fcn.0046fadd
test eax, eax
jne 0x43c3eb
mov ecx, edi
call fcn.0046fc40
test eax, eax
je 0x43c5ca
cmp eax, str.fileChm
jne 0x43c40c
mov eax, dword [0x518b80]
cmp byte [eax + 0x8c], 0
jne 0x43c40c
mov ecx, edi
call fcn.0043c30e
jmp 0x43c5ca
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [ebp - 0xc0]
push eax
call esi
push edi
push str.Starting:__s_n
call fcn.004620b3
pop ecx
pop ecx
lea eax, [ebp - 0xb0]
push eax
call esi
push 1
xor edx, edx
mov ecx, edi
call fcn.0047ac08
mov ebx, eax
mov dword [ebp - 0xa8], ebx
pop ecx
test ebx, ebx
jne 0x43c45b
push edi
push str.Error:_failed_to_load__s_n
call fcn.004620b3
pop ecx
pop ecx
jmp 0x43c5ca
push dword [ebp - 0xac]
push dword [ebp - 0xb0]
call fcn.00414714
movsd qword [esp], xmm0
push str.load:__.2f_ms_n
call fcn.004620b3
add esp, 0xc
mov ecx, ebx
call fcn.00479847
push eax
push str.page_count:__d_n
mov dword [ebp - 0xac], eax
call fcn.004620b3
mov esi, dword [ebp - 0xa4]
xor ebx, ebx
pop ecx
pop ecx
test esi, esi
jne 0x43c529
inc esi
cmp dword [ebp - 0xac], 1
jl 0x43c4d4
mov edi, dword [ebp - 0xa8]
mov ebx, dword [ebp - 0xac]
mov edx, esi
mov ecx, edi
call fcn.0043c260
inc esi
cmp esi, ebx
jle 0x43c4be
mov edi, dword [ebp - 0xb4]
xor ebx, ebx
mov esi, dword [ebp - 0xa4]
mov cl, bl
call fcn.00413f3a
push ecx
push ecx
lea ecx, [ebp - 0xa0]
call fcn.004290da
lea edx, [ebp - 0xa0]
mov ecx, esi
call fcn.00428104
test al, al
je 0x43c58b
mov eax, dword [ebp - 0x9c]
test eax, eax
je 0x43c58b
mov edi, dword [ebp - 0xa8]
cmp ebx, eax
sbb cl, cl
inc cl
call fcn.00413f3a
mov eax, dword [ebp - 0x90]
mov esi, dword [eax + ebx*8]
jmp 0x43c55f
mov edx, str.loadonly
mov ecx, esi
call fcn.0045f52b
test al, al
jne 0x43c4da
mov ecx, esi
call fcn.0042828e
test al, al
jne 0x43c4da
mov cl, 1
jmp 0x43c4dc
cmp esi, 1
jl 0x43c55e
cmp esi, dword [ebp - 0xac]
jg 0x43c55e
mov edx, esi
mov ecx, edi
call fcn.0043c260
inc esi
cmp ebx, dword [ebp - 0x9c]
sbb cl, cl
inc cl
call fcn.00413f3a
mov eax, dword [ebp - 0x90]
cmp esi, dword [eax + ebx*8 + 4]
jle 0x43c548
mov eax, dword [ebp - 0x9c]
inc ebx
cmp ebx, eax
jb 0x43c515
mov edi, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0xa8]
push 1
mov eax, dword [ecx]
call dword [eax]
push edi
push ecx
push dword [ebp - 0xbc]
push dword [ebp - 0xc0]
call fcn.00414714
movsd qword [esp + 4], xmm0
mov dword [esp], str.Finished__in__.2f_ms_:__s_n
call fcn.004620b3
add esp, 0x10
lea ecx, [ebp - 0xa0]
call fcn.00415382
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b7879
leave
ret
Function at 0x43ef2d
Capabilities:
Hide graphical window
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x513010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x51aaf0]
push ebx
mov ebx, ecx
push esi
push edi
test eax, eax
je 0x43ef5a
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
jmp 0x43f0ba
cmp word [0x519c8c], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
jne 0x43efb1
push 0x43edb4
mov edx, str.SUMATRA_PDF_ABOUT
lea ecx, [ebp - 0xa8]
call fcn.0046404b
pop ecx
push 0
call edi
push 1
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0xa8]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
mov word [0x519c8c], ax
sete cl
call fcn.00413f3a
mov ecx, str.About_SumatraPDF
call fcn.004539bd
push 0
mov esi, eax
call edi
xor edi, edi
push edi
push eax
push edi
push edi
mov eax, SysReAllocString
push eax
push eax
push eax
push eax
push 0xc80000
push esi
push str.SUMATRA_PDF_ABOUT
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ecx, eax
mov dword [0x51aaf0], ecx
test ecx, ecx
je 0x43f0ba
call fcn.00453a81
mov dl, al
call fcn.00465668
lea eax, [ebp - 0x48]
mov dword [ebp - 0x50], edi
push eax
push dword [0x51aaf0]
mov dword [ebp - 0x4c], edi
call dword [sym.imp.USER32.dll_BeginPaint]
mov esi, eax
push edi
push esi
call dword [sym.imp.GDI32.dll_SetLayout]
mov ecx, dword [0x51aaf0]
lea eax, [ebp - 0x58]
push eax
mov edx, esi
call fcn.0043e847
pop ecx
lea eax, [ebp - 0x48]
push eax
push dword [0x51aaf0]
call dword [sym.imp.USER32.dll_EndPaint]
mov ecx, dword [0x51aaf0]
call fcn.00469273
push 0x60
push eax
push 8
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov edx, dword [0x51aaf0]
lea ecx, [ebp - 0x68]
mov edi, eax
add edi, edi
call fcn.004640e8
mov edx, dword [0x51aaf0]
lea ecx, [ebp - 0x78]
call fcn.00464093
mov eax, dword [ebp - 0x5c]
mov ecx, edi
sub edi, dword [ebp - 0x6c]
sub ecx, dword [ebp - 0x70]
add edi, dword [ebp - 0x4c]
add ecx, dword [ebp - 0x50]
add eax, edi
mov esi, dword [ebp - 0x60]
push 0
push eax
add esi, ecx
push esi
push dword [ebp - 0x64]
push dword [ebp - 0x68]
push dword [0x51aaf0]
call dword [sym.imp.USER32.dll_MoveWindow]
mov edx, dword [ebx + 8]
call fcn.00466b26
push 5
push dword [0x51aaf0]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b7879
leave
ret
Function at 0x440c0e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
mov eax, ecx
push esi
push edi
push 0x410
push eax
mov dword [ebp - 8], eax
call ebx
mov edx, eax
lea ecx, [ebp - 0x20]
call fcn.004640e8
sub esp, 0x10
lea ecx, [ebp - 0x30]
mov esi, eax
mov edi, esp
xor edx, edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 8]
push esi
call fcn.0046413d
add esp, 0x14
push 0x404
push esi
call ebx
mov edx, eax
lea ecx, [ebp - 0x40]
call fcn.004640e8
sub esp, 0x10
lea ecx, [ebp - 0x20]
mov esi, eax
mov edi, esp
xor edx, edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 8]
push esi
call fcn.0046413d
mov eax, dword [ebp - 0x24]
add esp, 0x14
sub eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x2c]
push 5
mov dword [ebp - 0xc], eax
push esi
jmp 0x440d5b
mov edx, ebx
lea ecx, [ebp - 0x40]
call fcn.004640e8
sub esp, 0x10
lea ecx, [ebp - 0x20]
mov esi, eax
mov edi, esp
xor edx, edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 8]
push esi
call fcn.0046413d
mov ecx, dword [ebp - 0x24]
add esp, 0x14
mov eax, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x10], eax
cmp eax, ecx
jl 0x440ce3
sub eax, dword [ebp - 0xc]
push 1
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push eax
push dword [ebp - 0x20]
push ebx
call dword [sym.imp.USER32.dll_MoveWindow]
jmp 0x440d58
sub esp, 0x10
lea esi, [ebp - 0x30]
mov edi, esp
lea eax, [ebp - 0x50]
lea ecx, [ebp - 0x20]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00467127
lea ecx, [ebp - 0x20]
push ecx
mov ecx, eax
call fcn.0046723b
test al, al
je 0x440d15
push 0
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x440d55
sub esp, 0x10
lea esi, [ebp - 0x20]
mov edi, esp
lea eax, [ebp - 0x60]
lea ecx, [ebp - 0x30]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00467127
lea ecx, [ebp - 0x30]
push ecx
mov ecx, eax
call fcn.0046723b
test al, al
je 0x440d55
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
push 1
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x10]
push dword [ebp - 0x20]
push ebx
call dword [sym.imp.USER32.dll_MoveWindow]
mov esi, dword [ebp - 8]
push 2
push ebx
call dword [sym.imp.USER32.dll_GetWindow]
mov ebx, eax
test ebx, ebx
jne 0x440c95
mov edx, esi
lea ecx, [ebp - 0x30]
call fcn.004640e8
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0xc]
push 1
push eax
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push esi
call dword [sym.imp.USER32.dll_MoveWindow]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x444040
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, ecx
mov edi, edx
push 5
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
mov ecx, esi
call fcn.0042d7ec
push 0
push edi
call fcn.00427805
test al, al
je 0x44409e
cmp byte [ebp + 8], 0
jne 0x444075
call fcn.00414e76
cmp dword [0x514e44], 1
jne 0x44409e
push ecx
call fcn.004152a4
mov ecx, dword [eax]
call fcn.0042d4e6
test al, al
je 0x44409e
push ecx
call fcn.004152a4
push 1
mov ecx, dword [eax]
call fcn.0042d7ec
pop edi
pop esi
pop ecx
pop ebp
ret