joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5f182a
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x685fc6
call fcn.0062921c
sub esp, 0x48
push ebx
push esi
push edi
mov edi, ecx
mov esi, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 4], ecx
test esi, esi
je 0x5f1967
mov eax, 0x76c
cmp esi, 2
jbe 0x5f185e
cmp esi, eax
jne 0x5f1967
xor ebx, ebx
inc ebx
cmp esi, eax
jne 0x5f1910
mov dword [ebp - 0x10], 0xf
mov dword [ebp - 0x14], ecx
mov byte [ebp - 0x24], cl
mov eax, dword [edi + 0x7c]
mov byte [ebp - 4], bl
sub eax, ecx
je 0x5f1897
sub eax, ebx
jne 0x5f18b0
push str.lrecBadAd
call fcn.0040a79e
pop ecx
push eax
push str.lrecBadAd
jmp 0x5f18a8
push str.ftBadAd
call fcn.0040a79e
pop ecx
push eax
push str.ftBadAd
lea ecx, [ebp - 0x24]
call fcn.0040a517
push str.BAdSendBtn
lea ecx, [ebp - 0x3c]
call fcn.0040a58f
push 0
push ebx
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.0048ff08
push 0
push ebx
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 4
call fcn.0040abbf
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x54]
push eax
push 0x14
call fcn.004827b0
push 0
push ebx
lea ecx, [ebp - 0x54]
call fcn.0040abbf
push 0
push ebx
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0
call fcn.0040abbf
xor ecx, ecx
push ecx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push 0
push 0
call fcn.005f1d50
cmp dword [ebp + 0x24], 8
mov eax, dword [ebp + 0x10]
jae 0x5f1930
lea eax, [ebp + 0x10]
push eax
mov dword [ebp + 8], eax
call fcn.00423ad9
pop ecx
push eax
push dword [ebp + 8]
lea ecx, [edi + 0x80]
call fcn.004340c0
lea eax, [edi + 0x80]
cmp dword [eax + 0x14], 8
jb 0x5f1957
mov eax, dword [eax]
push eax
push esi
push dword [edi + 0x34]
push dword [edi + 0x78]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x5f1976
xor ebx, ebx
mov ecx, edi
inc ebx
push ebx
push dword [ebp + 0xc]
push esi
call fcn.005f1353
push 0
push ebx
lea ecx, [ebp + 0x10]
call fcn.0042386b
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x5f1f92
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x68603d
call fcn.0062921c
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0057d332
mov eax, dword [ebp + 0x1c]
xor ebx, ebx
mov edi, dword [ebp + 0xc]
mov dword [esi + 0x38], eax
lea eax, [esi + 0x40]
mov dword [esi], 0x6fc8d4
mov byte [esi + 0x30], bl
mov dword [esi + 0x34], edi
mov dword [esi + 0x3c], ebx
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ebx
cmp dword [eax + 0x14], 8
mov dword [ebp - 4], ebx
jb 0x5f1fde
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
push dword [ebp + 0x18]
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 1
call fcn.0040a58f
push dword [ebp + 0x10]
lea ecx, [esi + 0x70]
mov byte [ebp - 4], 2
call fcn.00424ff1
lea eax, [esi + 0xbc]
mov dword [esi + 0xb8], ebx
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], ebx
cmp dword [eax + 0x14], 8
jb 0x5f201f
mov eax, dword [eax]
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp + 0x14]
mov ecx, esi
or dword [esi + 0x10], 0x84
push edi
push dword [ebp + 8]
mov byte [ebp - 4], 4
mov dword [esi + 0xd4], eax
mov byte [esi + 0xd8], bl
call fcn.0057d4b4
push 0x200
push ebx
push dword [esi + 4]
call fcn.0057d46f
push dword [ebp + 0x18]
lea ecx, [ebp - 0x28]
call fcn.0040a58f
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 5
push eax
call fcn.00596a5c
push 0
push 1
lea ecx, [ebp - 0x28]
mov bl, al
call fcn.0040abbf
test bl, bl
je 0x5f2088
mov byte [esi + 0xd8], 1
cmp byte [ebp + 0x20], 0
je 0x5f209b
cmp byte [esi + 0xd8], 0
jne 0x5f209b
push 5
jmp 0x5f209d
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x5fecac
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x686c57
call fcn.0062921c
sub esp, 0x5c
push ebx
push esi
push edi
push 0x48
call fcn.006291e1
pop ecx
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
mov esi, dword [ebp + 0x14]
test eax, eax
je 0x5fece1
push esi
push dword [ebp + 8]
mov ecx, eax
call fcn.005fec55
mov edi, eax
jmp 0x5fece3
xor edi, edi
or dword [ebp - 4], 0xffffffff
mov ecx, edi
neg esi
push 0
sbb esi, esi
and esi, 0x22
add esi, 0x160
push esi
call fcn.0057ddf9
lea eax, [ebp - 0x20]
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x14]
xor ebx, ebx
sub eax, dword [ebp - 0x1c]
inc ebx
push ebx
push eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp + 0x10]
add eax, 0xa
push eax
push dword [ebp + 0xc]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_MoveWindow]
push 5
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
and dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
push str.action
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], ebx
call fcn.0040a58f
xor esi, esi
mov byte [ebp - 4], 2
push esi
push str.HotSpotShown
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.004652bb
push eax
lea ecx, [ebp - 0x38]
call fcn.0040a1e2
push esi
push ebx
lea ecx, [ebp - 0x68]
call fcn.0040abbf
push esi
push ebx
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], bl
call fcn.0040abbf
push str.ONBOARDING
lea ecx, [ebp - 0x50]
call fcn.0040a58f
xor eax, eax
mov byte [ebp - 4], 3
push eax
push eax
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x38]
push eax
push 0x2f
call fcn.004827b0
push esi
push ebx
lea ecx, [ebp - 0x50]
call fcn.0040abbf
push esi
push ebx
lea ecx, [ebp - 0x38]
call fcn.0040abbf
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x5ffe19
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, 0x7a67b8
push dword [ebp + 8]
mov dword [0x7a67b4], eax
call fcn.0059efe3
mov al, byte [ebp + 0x10]
mov byte [0x7a67c4], al
lea eax, [ebp + 0xc]
push eax
xor eax, eax
push eax
push 0x7a67b4
push 0x6004d0
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov dword [0x7a6798], eax
pop ebp
ret 0xc

Function at 0x601113
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 5
push dword [esi + 0x4c]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x60]
sub eax, dword [esi + 0x58]
push 0x254
push eax
mov eax, dword [esi + 0x5c]
sub eax, dword [esi + 0x54]
push eax
push dword [esi + 0x58]
push dword [esi + 0x54]
push 0
push dword [esi + 0x4c]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 1
push 0
push dword [esi + 0x4c]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop esi
ret
Function at 0x608449
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
push esi
push edi
push 0
mov esi, ecx
lea ecx, [ebp - 0x28]
push 0
call fcn.004c3ec7
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov edi, dword [ebp + 8]
mov dword [edi], eax
cmp eax, 0xffffffff
jne 0x608480
push 0xfffffffffffffffe
pop eax
jmp 0x608515
lea eax, [ebp - 0x28]
mov ecx, esi
push eax
push edi
call fcn.00608412
test eax, eax
je 0x6084a9
push 0xa
push 0x554
call fcn.0057b788
push eax
mov ecx, esi
call fcn.00608cb0
or eax, 0xffffffff
jmp 0x608515
lea ecx, [ebp - 0x14]
call fcn.004c3f2d
push dword [ebp + 0x10]
lea eax, [ebp - 0x14]
mov ecx, esi
push dword [ebp + 0xc]
push eax
call fcn.00608647
test eax, eax
jne 0x608515
lea ecx, [ebp - 0x14]
call fcn.004631cf
test al, al
je 0x6084db
push 0xa
push 0x56c
jmp 0x608497
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xb8]
push eax
lea ecx, [ebp - 0x14]
call fcn.00474a16
lea eax, [ebp - 0x14]
push eax
push 0x69fc74
lea eax, [ebp - 0x38]
push 0x10
push eax
call fcn.0045fc07
add esp, 0x10
lea eax, [ebp - 0x14]
mov ecx, esi
push dword [ebp + 0x14]
push eax
push dword [edi]
call fcn.0060851d
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x60851d
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov eax, 0x6875b6
call fcn.0062921c
sub esp, 0x8c
push ebx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push 0x8004667e
push dword [ebp + 8]
mov ebx, ecx
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x608555
or eax, eax
jmp 0x608636
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push esi
push eax
lea eax, [ebp - 0x98]
push eax
call fcn.00474a16
mov byte [ebp - 0xd], 1
call fcn.00472fb7
push dword [ebp - 0x18]
and dword [ebp - 4], 0
lea eax, [ebp - 0x98]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x6085ca
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
je 0x6085c2
cmp esi, 0x2734
je 0x6085c2
push esi
push 0x48e
call fcn.0057b788
push eax
mov ecx, ebx
call fcn.00608bdd
mov dword [ebp - 4], 1
jmp 0x60862e
push dword [ebp + 0xc]
call fcn.0047109f
mov dword [ebp - 4], 2
call fcn.00472ff8
push dword [ebp + 0x10]
or dword [ebp - 4], 0xffffffff
mov ecx, ebx
push dword [ebp + 8]
call fcn.00608a23
mov esi, eax
mov byte [ebp + 0x13], 1
call fcn.00472fb7
mov dword [ebp - 4], 3
test esi, esi
je 0x60861f
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push 0x564
call fcn.0057b788
push eax
mov ecx, ebx
call fcn.00608bdd
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_closesocket]
push dword [ebp + 0xc]
call fcn.00472bf7
mov dword [ebp - 4], 4
call fcn.00472ff8
mov eax, esi
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x608713
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, ecx
and dword [ebp + 0x10], 0
push edi
mov dword [ebp - 8], esi
xor edi, edi
mov dword [ebp - 4], eax
jmp 0x608774
push dword [ebp + 0x14]
mov ecx, ebx
push dword [ebp + 8]
call fcn.0060899f
test eax, eax
jne 0x608778
push eax
push eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp + 0xc]
push eax
push 1
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
jne 0x60878d
mov eax, dword [ebp + 0xc]
sub esi, eax
add dword [ebp - 4], eax
add edi, eax
mov dword [ebp - 8], esi
test esi, esi
je 0x608789
test eax, eax
je 0x608789
test esi, esi
jg 0x608731
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
neg eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, edi
jmp 0x608780
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push 0x48f
call fcn.0057b788
push eax
mov ecx, ebx
call fcn.00608bdd
neg esi
mov eax, esi
jmp 0x608780

Function at 0x608aa7
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, ecx
push edi
mov dword [ebp - 8], esi
xor edi, edi
mov dword [ebp - 4], eax
jmp 0x608afd
push dword [ebp + 0x14]
mov ecx, ebx
push dword [ebp + 8]
call fcn.00608a23
test eax, eax
jne 0x608b01
push eax
push eax
push eax
lea eax, [ebp + 0x10]
push eax
push 1
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_WSASend]
test eax, eax
jne 0x608b16
mov eax, dword [ebp + 0x10]
sub esi, eax
add dword [ebp - 4], eax
add edi, eax
mov dword [ebp - 8], esi
test esi, esi
je 0x608b12
test esi, esi
jg 0x608ac1
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
neg eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, edi
jmp 0x608b09
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
push esi
push 0x490
call fcn.0057b788
push eax
mov ecx, ebx
call fcn.00608bdd
neg esi
mov eax, esi
jmp 0x608b09
Function at 0x6095bb
Capabilities:
Get common file path

Disassembly:
sub esp, 0x22c
cmp dword [0x7a6a6c], 0
mov dword [esp], 0x6fe164
mov dword [esp + 4], 0x609136
mov dword [esp + 8], str.getnameinfo
mov dword [esp + 0xc], 0x6093df
mov dword [esp + 0x10], 0x6fe17c
mov dword [esp + 0x14], fcn.006090fb
jne 0x609712
push 0x104
lea eax, [esp + 0x128]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
test eax, eax
je 0x609708
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x134]
mov ebx, 0x10c
push eax
lea eax, [esp + 0x2c]
push ebx
push eax
call fcn.00645608
push str.ws2_32
lea eax, [esp + 0x38]
push ebx
push eax
call fcn.00645662
add esp, 0x18
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov esi, eax
mov ebp, dword [sym.imp.KERNEL32.DLL_FreeLibrary]
xor edi, edi
test esi, esi
je 0x60967b
push 0x6fe164
push esi
call ebx
test eax, eax
jne 0x609677
push esi
call ebp
mov esi, edi
test esi, esi
jne 0x6096cc
lea eax, [esp + 0x134]
mov esi, 0x10c
push eax
lea eax, [esp + 0x2c]
push esi
push eax
call fcn.00645608
push str.wship6
lea eax, [esp + 0x38]
push esi
push eax
call fcn.00645662
add esp, 0x18
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x609704
push 0x6fe164
push esi
call ebx
test eax, eax
jne 0x6096c8
push esi
call ebp
mov esi, edi
test esi, esi
je 0x609704
mov ebx, edi
push dword [esp + ebx*8 + 0x10]
push esi
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [esp + ebx*8 + 0x14], eax
test eax, eax
je 0x6096e9
inc ebx
cmp ebx, 3
jl 0x6096ce
jmp 0x6096ee
push esi
call ebp
mov esi, edi
test esi, esi
je 0x609704
mov eax, dword [esp + edi + 0x14]
mov dword [edi + 0x767984], eax
add edi, 8
cmp edi, 0x18
jl 0x6096f2
pop edi
pop esi
pop ebp
pop ebx
mov dword [0x7a6a6c], 1
movzx eax, word [esp + 0x230]
mov eax, dword [eax*8 + 0x767984]
add esp, 0x22c
ret 4

Function at 0x60990c
Capabilities:
Resolve dns

Disassembly:
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
push dword [esp + 0x14]
and dword [ebp], 0
mov byte [ebx], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
je 0x609988
cmp word [esi + 8], 2
jne 0x60996a
push 4
pop eax
cmp word [esi + 0xa], ax
jne 0x60996a
mov edi, dword [esi + 0xc]
jmp 0x609964
push dword [eax]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
call fcn.00609866
mov dword [ebp], eax
test eax, eax
je 0x609983
lea ebp, [eax + 0x1c]
add edi, 4
mov eax, dword [edi]
test eax, eax
jne 0x609944
push 0x400
push dword [esi]
push 0x401
push ebx
call fcn.0064577c
add esp, 0x10
xor eax, eax
jmp 0x6099a6
push 8
pop eax
jmp 0x6099a6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 0x2af9
sub eax, ecx
je 0x6099a4
sub eax, 1
je 0x6099b4
sub eax, 1
je 0x6099ad
sub eax, 1
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
mov eax, 0x2afb
jmp 0x6099a6
mov eax, 0x2afa
jmp 0x6099a6
Function at 0x60ab2c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 8]
push esi
push eax
mov esi, ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 8]
mov ecx, esi
push eax
mov eax, dword [esi]
call dword [eax + 0xc]
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x60ab7a
push dword [ebp - 4]
lea eax, [ebp - 0x18]
push dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x60ab7a
xor al, al
jmp 0x60aba5
mov eax, dword [esi + 4]
test eax, eax
je 0x60aba3
cmp dword [eax + 0xc], 1
je 0x60aba3
mov ecx, dword [esi + 0x4c]
push 0
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
and dword [esi + 0x9c], 0
mov byte [esi + 0xa6], 0
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x60ba82
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
call fcn.0060b56d
test al, al
je 0x60ba99
push 0
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret 4
Function at 0x60cfb4
Capabilities:
Check for unmoving mouse cursor
Hide graphical window

Disassembly:
sub esp, 0x18
push esi
mov esi, ecx
cmp byte [esi + 0x71], 0
je 0x60cfc9
cmp byte [esi + 0x70], 0
je 0x60cfc9
mov byte [esi + 0x70], 0
jmp 0x60cfd4
push 0
push dword [esi + 0x50]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.0060aafe
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x60d13a
mov eax, dword [0x7a6b4c]
inc eax
and eax, reloc.WS2_32.dll_accept
jns 0x60cff8
dec eax
or eax, 0xfffffffe
inc eax
mov dword [0x7a6b4c], eax
je 0x60d017
cmp byte [ecx + 9], 0
jne 0x60d017
call fcn.0060a48b
mov ecx, dword [esi + 0x4c]
push 0x6ac
call fcn.0060d62c
mov eax, dword [esi + 4]
cmp dword [eax + 0xc], 1
je 0x60d13a
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [esp + 0x14]
push edi
push eax
mov eax, dword [esi + 0x4c]
push dword [eax + 4]
call ebp
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esi + 0x4c]
lea ecx, [esp + 0x10]
mov ebx, dword [sym.imp.USER32.dll_ScreenToClient]
push ecx
push dword [eax + 4]
call ebx
mov edi, dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x60d079
push dword [esp + 0x14]
lea eax, [esp + 0x1c]
push dword [esp + 0x14]
push eax
call edi
test eax, eax
jne 0x60d137
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [esp + 0x18]
push eax
mov eax, dword [esi + 0x4c]
push dword [eax + 0x34]
call ebp
mov eax, dword [esi + 0x4c]
push dword [eax + 0x34]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x60d0c5
mov eax, dword [esi + 0x4c]
lea ecx, [esp + 0x10]
push ecx
push dword [eax + 0x34]
call ebx
test eax, eax
je 0x60d0c5
push dword [esp + 0x14]
lea eax, [esp + 0x1c]
push dword [esp + 0x14]
push eax
call edi
test eax, eax
jne 0x60d137
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [esp + 0x18]
push eax
push dword [esi + 0x14]
call ebp
lea eax, [esp + 0x10]
mov ecx, esi
push eax
mov eax, dword [esi]
call dword [eax + 0xc]
push eax
call ebx
test eax, eax
je 0x60d120
push dword [esp + 0x14]
lea eax, [esp + 0x1c]
push dword [esp + 0x14]
push eax
call edi
test eax, eax
je 0x60d120
mov eax, dword [esi + 0x9c]
test eax, eax
je 0x60d130
sub eax, 1
mov dword [esi + 0x9c], eax
jne 0x60d130
push 0
mov ecx, esi
call fcn.0060da90
jmp 0x60d130
push 0
mov ecx, esi
call fcn.0060da90
and dword [esi + 0x9c], 0
mov ecx, esi
call fcn.0060ae74
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x18
ret 4
Function at 0x60da90
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x60dafc
cmp dword [eax + 0xc], 1
je 0x60dafc
push ebx
mov bl, byte [ebp + 8]
cmp byte [esi + 0xa6], bl
je 0x60dafb
movzx eax, bl
neg eax
sbb eax, eax
and eax, 4
push eax
mov eax, dword [esi + 0x4c]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x10]
push eax
mov eax, dword [esi + 0x4c]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [esi + 0x4c]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov byte [esi + 0xa6], bl
mov ecx, dword [esi + 0x4c]
push 0
call fcn.0060d8af
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x60f28b
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
sub esp, 0x40
lea eax, [esp + 0xc]
push edi
mov edi, dword [esp + 0x48]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileInformationByHandle]
test eax, eax
jne 0x60f2ad
mov eax, 0x200
jmp 0x60f42e
mov ecx, dword [esp + 0x10]
mov edx, ecx
and edx, 1
push esi
mov esi, edx
test cl, 2
je 0x60f2c1
or esi, 2
test cl, 4
je 0x60f2c9
or esi, 4
mov eax, ecx
and eax, 0x10
je 0x60f2d3
or esi, 0x10
test cl, 0x20
je 0x60f2db
or esi, 0x20
neg eax
sbb eax, eax
and eax, 0xc0000000
add eax, 0x81000000
or esi, eax
test edx, edx
jne 0x60f2f5
or esi, 0x800000
push ebx
push ebp
xor ebp, ebp
push ebp
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov ebx, eax
cmp ebx, 0x28
jbe 0x60f3a5
push ebp
push ebp
push ebp
mov ebp, dword [sym.imp.KERNEL32.DLL_SetFilePointer]
push edi
call ebp
push 0
lea eax, [esp + 0x14]
push eax
push 2
lea eax, [esp + 0x60]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push 0
push 0
push 0x24
push edi
call ebp
push 0
lea eax, [esp + 0x14]
push eax
push 4
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov eax, 0x54ad
cmp word [esp + 0x54], ax
jne 0x60f3a5
mov ecx, dword [esp + 0x14]
lea eax, [ecx + 0x34]
cmp ebx, eax
jbe 0x60f3a5
push 0
push 0
push ecx
push edi
call ebp
push 0
lea eax, [esp + 0x14]
push eax
push 4
lea eax, [esp + 0x24]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov eax, dword [esp + 0x18]
cmp eax, 0x5a4d
je 0x60f39f
cmp eax, 0x454e
je 0x60f39f
cmp eax, 0x454c
je 0x60f39f
cmp eax, 0x4550
jne 0x60f3a5
or esi, 0x400000
mov eax, dword [esp + 0x58]
test eax, eax
je 0x60f3af
mov dword [eax], esi
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x60f3b9
mov dword [eax], ebx
mov esi, dword [esp + 0x60]
pop ebp
pop ebx
test esi, esi
je 0x60f3fb
push dword [esp + 0x24]
push dword [esp + 0x24]
call fcn.0061056c
push dword [esp + 0x2c]
mov dword [esi], eax
push dword [esp + 0x2c]
mov dword [esi + 4], edx
call fcn.0061056c
push dword [esp + 0x1c]
mov dword [esi + 8], eax
push dword [esp + 0x1c]
mov dword [esi + 0xc], edx
call fcn.0061056c
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov esi, dword [esp + 0x5c]
test esi, esi
je 0x60f42b
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x50]
push eax
push dword [esp + 0x34]
push dword [esp + 0x34]
call fcn.0061050f
movzx ecx, word [esp + 0x4c]
movzx eax, word [esp + 0x50]
shl ecx, 0x10
or ecx, eax
mov dword [esi], ecx
xor eax, eax
pop esi
pop edi
add esp, 0x40
ret 0x14
Function at 0x60fb31
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
jne 0x60fb40
xor eax, eax
jmp 0x60fc22
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
not ecx
cmp esi, 8
jb 0x60fc01
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6fe880]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6fe880]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6fe880]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6fe880]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6fe880]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6fe880]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6fe880]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6fe880]
sub edi, 1
jne 0x60fb5a
pop edi
test esi, esi
je 0x60fc1d
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6fe880]
inc edx
sub esi, 1
jne 0x60fc05
not ecx
mov eax, ecx
pop esi
ret 0xc