joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410ba0
Capabilities:
Hide graphical window

Disassembly:
push 0x1c
mov eax, 0x569372
call fcn.005106a0
mov esi, edx
mov ebx, ecx
mov ecx, dword [0x5cc1ec]
xor edi, edi
test ecx, ecx
je 0x410bc9
mov eax, dword [ecx]
push 1
call dword [eax + 0xc]
mov dword [0x5cc1ec], edi
push 0x130
call fcn.0050f802
pop ecx
mov dword [ebp - 0x28], eax
mov ecx, eax
mov dword [ebp - 4], edi
call fcn.0041099e
or dword [ebp - 4], 0xffffffff
push ecx
mov ecx, eax
mov dword [0x5cc1ec], eax
call fcn.00435390
mov eax, dword [0x5cc1ec]
mov dword [eax + 0x128], esi
push dword [eax + 0x38]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x410c56
push ecx
push ecx
mov ecx, dword [0x5cc1ec]
lea edx, [ebp - 0x24]
mov eax, esp
push 0
push SysReAllocString
lea esi, [ecx + 0x7c]
mov dword [eax], edi
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
push ecx
push ecx
mov eax, esp
movsd dword es:[edi], dword [esi]
push ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [eax], edx
call fcn.00433d50
mov ecx, dword [0x5cc1ec]
push 0xb4
mov eax, dword [ecx]
call dword [eax + 0x40]
mov eax, dword [0x5cc1ec]
push 1
push dword [eax + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
call fcn.0051064a
ret

Function at 0x410d63
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x5cc1ec]
test eax, eax
je 0x410d77
push 0
push dword [eax + 0x38]
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x4121b6
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x5b3074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov ebx, ecx
push 0x20a
push eax
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x218]
push eax
call fcn.00516940
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push dword [ebx + 4]
xorps xmm0, xmm0
movups xmmword [ebp - 0x228], xmm0
call dword [sym.imp.USER32.dll_GetDC]
push dword [ebx + 0x58]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
mov esi, eax
push esi
mov dword [ebp - 0x244], esi
call edi
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x240], eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x23c]
jne 0x412236
push 0x400
sub ecx, edx
lea eax, [ebp - 0x228]
push eax
sar ecx, 1
lea eax, [ebp - 0x218]
push ecx
push eax
push esi
call dword [sym.imp.USER32.dll_DrawTextW]
push dword [ebp - 0x240]
push esi
call edi
lea esi, [ebx + 0x38]
lea edi, [ebp - 0x238]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x238]
mov esi, dword [ebp - 0x220]
sub esi, dword [ebp - 0x228]
lea ecx, [eax + 0x1e]
add ecx, esi
cmp ecx, dword [ebx + 0x50]
cmovg ecx, dword [ebx + 0x50]
xor edx, edx
mov dword [ebp - 0x230], ecx
inc edx
sub ecx, eax
lea eax, [ecx - 0x1e]
test eax, eax
jg 0x4122b1
mov eax, ecx
test eax, eax
cmovle eax, edx
cmp esi, eax
jle 0x4122be
mov ecx, eax
add ecx, eax
inc edx
cmp esi, ecx
jg 0x4122b7
mov ecx, dword [ebp - 0x21c]
sub ecx, dword [ebp - 0x224]
mov eax, dword [ebp - 0x234]
push dword [ebp - 0x244]
imul ecx, edx
add eax, 0x1e
push dword [ebx + 4]
add eax, ecx
cmp eax, dword [ebx + 0x54]
cmovg eax, dword [ebx + 0x54]
mov dword [ebp - 0x22c], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
lea eax, [ebp - 0x238]
mov ecx, ebx
push eax
call fcn.00412170
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0050f7b9
mov esp, ebp
pop ebp
ret

Function at 0x4126ff
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0x100
jne 0x412728
cmp dword [eax + 8], 0x1b
jne 0x412728
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
inc eax
jmp 0x412737
push eax
add ecx, 0xffffffcc
call fcn.0041739e
neg eax
sbb eax, eax
neg eax
pop ebp
ret 4
Function at 0x414582
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x5b3074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
push 3
pop eax
mov edx, eax
mov ecx, dword [ebx + 4]
call fcn.00410ba0
lea ecx, [ebp - 0x28]
call fcn.00410d8b
call fcn.00410d63
call fcn.0041a251
mov ecx, dword [ebx + 0x18c]
lea esi, [ebp - 0x28]
lea edi, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp ecx, 0x50f
jne 0x4145d7
mov dword [ebp - 8], 1
jmp 0x4145fa
cmp ecx, 0x510
jne 0x4145e8
mov dword [ebp - 8], 2
jmp 0x4145fa
mov eax, dword [ebp - 8]
cmp ecx, 0x50e
push 3
pop ecx
cmove eax, ecx
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x34], 0x14
mov dword [ebp - 0x30], eax
xor esi, esi
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x38], 0x3ec
push eax
push 0xbb8
push esi
lea eax, [ebp - 0x38]
mov dword [ebp - 0x2c], esi
push eax
push dword [ebx + 4]
push 0x4a
call fcn.0041290c
push eax
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
jne 0x414644
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0050f7b9
mov esp, ebp
pop ebp
ret
Function at 0x414665
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x5b3074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
xor esi, esi
push edi
cmp dword [ebx + 0x17c], esi
je 0x4146ae
lea eax, [ebx + 0x50]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_CopyRect]
lea eax, [ebp - 0x24]
mov dword [ebp - 0xc], 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0x3ec
mov dword [ebp - 0x4c], esi
jmp 0x4147a9
mov eax, dword [ebx + 0x180]
test eax, eax
jne 0x4146ce
mov eax, dword [ebx + 0xc8]
push 5
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4147da
cmp eax, 3
je 0x41472c
cmp eax, 2
je 0x41472c
cmp eax, 4
je 0x41472c
lea eax, [ebx + 0x50]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_CopyRect]
mov eax, dword [ebx + 0x180]
sub esp, 0x28
mov ecx, ebx
push esp
cmp eax, 1
jne 0x414705
call fcn.00413d88
push 1
jmp 0x414719
cmp eax, 6
jne 0x414713
call fcn.00413d88
push 2
jmp 0x414719
call fcn.00413d88
push esi
mov ecx, dword [ebx + 4]
lea edx, [ebp - 0x14]
call fcn.0041a268
add esp, 0x2c
jmp 0x4147da
lea eax, [ebx + 0x50]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_CopyRect]
lea ecx, [ebp - 0x48]
call fcn.00410d8b
mov esi, eax
mov ecx, dword [ebx + 0x180]
lea edi, [ebp - 0x24]
push 3
pop eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x24]
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp ecx, eax
jne 0x41476b
mov dword [ebp - 0x28], 2
jmp 0x41477f
cmp ecx, 4
je 0x41477c
mov eax, dword [ebp - 0x28]
xor edx, edx
inc edx
cmp ecx, 2
cmove eax, edx
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], 0x14
xor esi, esi
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0x3ec
mov dword [ebp - 0x4c], esi
call fcn.00410d63
push 0x510
mov ecx, ebx
call fcn.00413a6b
lea eax, [ebp - 0x4c]
push eax
push 0xbb8
push esi
lea eax, [ebp - 0x10]
push eax
push dword [ebx + 4]
push 0x4a
call fcn.0041290c
push eax
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
test eax, eax
jne 0x4147da
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0050f7b9
mov esp, ebp
pop ebp
ret
Function at 0x4147eb
Capabilities:
Hide graphical window
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
push edi
mov dword [esi + 0x174], eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea ebx, [esi + 0x50]
push ebx
call fcn.004045ec
mov eax, dword [esi + 0xc8]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x41482d
push 0
push dword [eax + 4]
call edi
cmp byte [esi + 0x9d], 0
je 0x414918
mov word [esi + 0x9c], 0
call dword [sym.imp.USER32.dll_ReleaseCapture]
and dword [esi + 0xac], 0
push 0
push dword [esi + 0xd0]
call edi
mov eax, dword [esi + 0xc4]
test eax, eax
je 0x41486b
push 0
push dword [eax + 4]
call edi
mov eax, dword [esi + 0xb4]
xor edi, edi
sub eax, dword [esi + 0xb0]
sar eax, 2
test eax, eax
je 0x4148a7
mov eax, dword [esi + 0xb0]
mov ecx, dword [eax + edi*4]
test ecx, ecx
je 0x414893
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [esi + 0xb4]
inc edi
sub eax, dword [esi + 0xb0]
sar eax, 2
cmp edi, eax
jb 0x414880
mov eax, dword [esi + 0xb0]
mov dword [esi + 0xb4], eax
mov ecx, dword [esi + 0xbc]
test ecx, ecx
je 0x4148c3
mov eax, dword [ecx]
push 1
call dword [eax]
and dword [esi + 0xbc], 0
mov ecx, dword [esi + 0xc8]
test ecx, ecx
je 0x4148dc
add ecx, 0x28
call fcn.0041c8a1
call fcn.0041a251
or eax, 0xffffffff
push eax
push eax
push eax
push eax
push ebx
call dword [sym.imp.USER32.dll_SetRect]
push 1
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0x6b
push dword [0x5cbbf0]
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
push 0xfffffffffffffff4
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetClassLongW]
jmp 0x414927
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x414c2b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x5b3074]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x24c], 0
push ebx
push edi
mov ebx, ecx
mov dword [ebp - 0x248], edx
mov dword [ebp - 0x240], ebx
lea edi, [ebp - 0x24]
mov eax, dword [0x58c3ec]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x58c3f0]
push 8
pop ecx
mov dword [ebp - 0x28], eax
xor eax, eax
push 0x20a
push eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x238]
mov dword [ebp - 0x23c], 2
push eax
call fcn.00516940
push str.Option
push str.SoftwareCatchScreen
push 0x58c430
lea eax, [ebp - 0x238]
push 0x104
push eax
call fcn.00408e72
add esp, 0x20
lea eax, [ebp - 0x244]
mov edi, SysReAllocString
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x240]
push eax
push str.SaveDefExtend
lea eax, [ebp - 0x238]
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x240]
push eax
push str.SaveAsIndexEx
lea eax, [ebp - 0x238]
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [ebp - 0x248]
test eax, eax
je 0x414d12
mov ecx, dword [ebp - 0x23c]
mov dword [eax], ecx
lea eax, [ebp - 0x2c]
mov ecx, ebx
push eax
call fcn.0040941c
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
xor ecx, ebp
pop ebx
call fcn.0050f7b9
mov esp, ebp
pop ebp
ret
Function at 0x414d2f
Capabilities:
Get common file path

Disassembly:
push 0x2e4
mov eax, 0x56951c
call fcn.005106a0
mov ebx, ecx
mov dword [ebp - 0x2ec], ebx
mov dword [ebp - 0x2d4], ebx
xor esi, esi
lea eax, [ebp - 0x21c]
push 0x208
mov dword [ebp - 4], esi
push esi
push eax
mov dword [ebp - 0x2f0], ebx
mov dword [ebp - 0x2e8], esi
call fcn.00516940
add esp, 0xc
lea eax, [ebp - 0x21c]
push esi
push esi
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
xor edx, edx
lea ecx, [ebp - 0x2d4]
call fcn.00414c2b
xor edi, edi
inc edi
push esi
mov dword [ebp - 4], edi
call fcn.005400dc
pop ecx
mov dword [ebp - 0x2dc], eax
mov dword [ebp - 0x2d8], edx
call fcn.00409c54
push eax
mov ecx, ebx
call fcn.0040999a
lea eax, [ebp - 0x240]
mov dword [ebp - 0x2e8], edi
push eax
lea ecx, [ebp - 0x2dc]
call fcn.0041999f
or edi, 0xffffffff
test eax, eax
je 0x414deb
mov ebx, dword [eax]
mov dword [ebp - 0x2e0], ebx
jmp 0x414df1
mov dword [ebp - 0x2e0], edi
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x2dc]
call fcn.0041999f
test eax, eax
je 0x414e12
mov ebx, dword [eax + 4]
mov dword [ebp - 0x2e4], ebx
jmp 0x414e18
mov dword [ebp - 0x2e4], edi
lea eax, [ebp - 0x288]
push eax
lea ecx, [ebp - 0x2dc]
call fcn.0041999f
test eax, eax
je 0x414e31
mov edi, dword [eax + 8]
lea eax, [ebp - 0x2ac]
push eax
lea ecx, [ebp - 0x2dc]
call fcn.0041999f
test eax, eax
je 0x414e4c
mov ebx, dword [eax + 0xc]
jmp 0x414e4e
mov ebx, esi
lea eax, [ebp - 0x2d0]
push eax
lea ecx, [ebp - 0x2dc]
call fcn.0041999f
test eax, eax
je 0x414e68
mov esi, dword [eax + 0x10]
inc esi
push dword [ebp - 0x2d4]
lea ecx, [ebp - 0x2dc]
push dword [ebp - 0x2e0]
push dword [ebp - 0x2e4]
push edi
push ebx
push esi
call fcn.0041989d
mov esi, dword [ebp - 0x2ec]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0x58c478
push esi
call fcn.00418437
mov ecx, dword [ebp - 0x2d4]
add esp, 0x28
add ecx, 0xfffffff0
call fcn.00409cc2
mov eax, esi
call fcn.0051064a
ret
Function at 0x41582e
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, ecx
mov dword [ebp - 0x1c], edx
push esi
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x41584c
xor eax, eax
jmp 0x415985
mov eax, dword [esi]
push ebx
mov ebx, dword [esi + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 4]
push edi
mov dword [ebp - 8], eax
mov eax, dword [esi + 0xc]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x4e
mov dword [ebp - 4], eax
call esi
push 0x4f
mov edi, eax
call esi
mov ecx, dword [ebp - 0xc]
xor edx, edx
test ecx, ecx
cmovs ecx, edx
mov edx, dword [ebp - 8]
xor esi, esi
mov dword [ebp - 0xc], ecx
test edx, edx
cmovs edx, esi
mov esi, dword [ebp - 4]
cmp ebx, edi
mov dword [ebp - 8], edx
cmovg ebx, edi
cmp esi, eax
cmovg esi, eax
xor eax, eax
push eax
push eax
push eax
sub ebx, ecx
sub esi, edx
push 0x58c7b0
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], esi
call dword [sym.imp.GDI32.dll_CreateDCW]
mov ebx, eax
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, eax
test edi, edi
je 0x415977
push esi
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov esi, eax
push esi
push edi
mov dword [ebp - 0x20], esi
call dword [sym.imp.GDI32.dll_SelectObject]
push 0x40cc0020
push dword [ebp - 8]
mov dword [ebp - 0x18], eax
push dword [ebp - 0xc]
push ebx
push dword [ebp - 4]
push dword [ebp - 0x10]
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_BitBlt]
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x415964
push dword [ebp - 4]
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov esi, eax
push esi
push dword [ebp - 0x14]
call dword [sym.imp.GDI32.dll_SelectObject]
push 0x40cc0020
push dword [ebp - 8]
mov dword [ebp - 0x18], eax
push dword [ebp - 0xc]
push edi
push dword [ebp - 4]
push dword [ebp - 0x10]
push 0
push 0
push dword [ebp - 0x14]
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [ebp - 0x18]
push dword [ebp - 0x14]
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 0x14]
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [ebp - 0x1c]
mov dword [eax], esi
mov esi, dword [ebp - 0x20]
push dword [ebp - 0x18]
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
jmp 0x41597a
mov esi, dword [ebp - 0x20]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
pop edi
mov eax, esi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x415a5b
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x415a8c
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ecx, esi
call fcn.004159ab
push eax
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
inc eax
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x4165e2
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x5b3074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
push edi
push dword [ebx + 0xd0]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x416705
xor esi, esi
push esi
push dword [ebx + 0xd0]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x20a
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.00516940
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [ebx + 0xd0]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x416653
sub ecx, edx
sar ecx, 1
mov ecx, dword [ebx + 0xbc]
je 0x4166f5
test ecx, ecx
je 0x416705
mov eax, dword [ecx]
lea edx, [ebp - 0x218]
push edx
call dword [eax + 0x20]
lea esi, [ebx + 0x104]
lea edi, [ebp - 0x228]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push dword [ebp - 0x21c]
lea edi, [ebx + 0xbc]
mov ecx, dword [edi]
push dword [ebp - 0x220]
mov eax, dword [ecx]
call dword [eax + 0x24]
mov edx, dword [ebx + 0xc4]
test edx, edx
je 0x4166d7
mov ecx, dword [edi]
push dword [edx + 0x210]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov eax, dword [edi]
mov ecx, dword [ebx + 0xc4]
mov esi, dword [eax]
call fcn.0040fb66
mov ecx, dword [edi]
push eax
call dword [esi + 0x2c]
push edi
lea ecx, [ebx + 0xb0]
call fcn.0041711a
and dword [edi], 0
push 1
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x416705
test ecx, ecx
je 0x4166ff
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [ebx + 0xbc], esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0050f7b9
mov esp, ebp
pop ebp
ret
Function at 0x41671b
Capabilities:
Check if file exists
Create directory
Delete file
Get common file path

Disassembly:
push 0x224
mov eax, 0x569603
call fcn.005106a0
mov ebx, ecx
mov eax, dword [ebx + 4]
push eax
mov dword [ebp - 0x22c], eax
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x230], eax
push ecx
mov ecx, esp
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ecx], eax
mov ecx, ebx
call fcn.00413384
push 0x208
lea eax, [ebp - 0x21c]
push esi
push eax
call fcn.00516940
add esp, 0xc
lea eax, [ebp - 0x21c]
push 1
push 0x1a
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.computerzocr_cachecomputerz.jpg
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x220]
call fcn.0040941c
mov byte [ebp - 4], 1
push dword [ebp - 0x220]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x4167c0
push dword [ebp - 0x220]
call edi
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0x10]
call fcn.00408e8d
lea esi, [eax + 0x10]
mov dword [ebp - 0x224], esi
mov byte [ebp - 4], 2
cmp dword [esi - 4], 1
jle 0x4167f5
push dword [esi - 0xc]
lea ecx, [ebp - 0x224]
call fcn.00409175
mov esi, dword [ebp - 0x224]
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x224]
call fcn.00419a76
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x416822
push esi
call edi
push 0
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetDC]
mov edi, dword [ebp - 0x220]
mov dword [ebp - 0x228], eax
cmp dword [edi - 4], 1
jle 0x416857
push dword [edi - 0xc]
lea ecx, [ebp - 0x220]
call fcn.00409175
mov edi, dword [ebp - 0x220]
mov eax, dword [ebp - 0x228]
push eax
mov ecx, ebx
call fcn.004159ab
mov edx, eax
mov ecx, edi
call fcn.0040d58f
pop ecx
push 0xffffffffffffffff
lea ecx, [ebp - 0x220]
call fcn.00419a76
push dword [ebp - 0x228]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ReleaseDC]
push dword [ebp - 0x220]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push 0
test eax, eax
je 0x41689b
push 1
jmp 0x41689d
push 0
push 0x2421
call fcn.0041290c
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [esi - 0x10]
call fcn.00409cc2
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0x10]
call fcn.00409cc2
lea ecx, [ebp - 0x230]
call fcn.0040e394
xor eax, eax
call fcn.0051064a
ret 0x10
Function at 0x4168d9
Capabilities:
Check if file exists
Create directory
Delete file
Get common file path

Disassembly:
push 0x228
mov eax, 0x56964c
call fcn.005106a0
mov ebx, ecx
mov dword [ebp - 0x228], ebx
mov eax, dword [ebx + 4]
push eax
mov dword [ebp - 0x230], eax
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x234], eax
push ecx
mov ecx, esp
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ecx], eax
mov ecx, ebx
call fcn.00413384
push 0x208
lea eax, [ebp - 0x21c]
push esi
push eax
call fcn.00516940
add esp, 0xc
lea eax, [ebp - 0x21c]
push 1
push 0x1a
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.computerzocr_cachecomputerz.jpg
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x220]
call fcn.0040941c
mov byte [ebp - 4], 1
push dword [ebp - 0x220]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x416984
push dword [ebp - 0x220]
call edi
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0x10]
call fcn.00408e8d
lea esi, [eax + 0x10]
mov dword [ebp - 0x224], esi
push 2
pop ebx
mov byte [ebp - 4], bl
cmp dword [esi - 4], 1
jle 0x4169bb
push dword [esi - 0xc]
lea ecx, [ebp - 0x224]
call fcn.00409175
mov esi, dword [ebp - 0x224]
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x224]
call fcn.00419a76
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x4169e8
push esi
call edi
push 0
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov eax, dword [ebp - 0x228]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetDC]
mov edi, dword [ebp - 0x220]
mov dword [ebp - 0x22c], eax
cmp dword [edi - 4], 1
jle 0x416a23
push dword [edi - 0xc]
lea ecx, [ebp - 0x220]
call fcn.00409175
mov edi, dword [ebp - 0x220]
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x228]
push eax
call fcn.004159ab
mov edx, eax
mov ecx, edi
call fcn.0040d58f
pop ecx
push 0xffffffffffffffff
lea ecx, [ebp - 0x220]
call fcn.00419a76
mov eax, dword [ebp - 0x228]
push dword [ebp - 0x22c]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ReleaseDC]
push dword [ebp - 0x220]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x416a93
cmp dword [ebp + 8], 0x50e
jne 0x416a79
push 3
pop ebx
jmp 0x416a8e
cmp dword [ebp + 8], 0x510
je 0x416a8e
xor ebx, ebx
cmp dword [ebp + 8], 0x50f
sete bl
push ebx
push 1
jmp 0x416a97
push 0
push 0
push 0x2421
call fcn.0041290c
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [esi - 0x10]
call fcn.00409cc2
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0x10]
call fcn.00409cc2
lea ecx, [ebp - 0x234]
call fcn.0040e394
call fcn.0051064a
ret 4