joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45b6b7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x5a4]
sub esp, 0x624
mov eax, dword [0x4d4028]
xor eax, ebp
mov dword [ebp + 0x5a0], eax
mov eax, dword [ebp + 0x5ac]
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x206
push esi
mov dword [ebp - 0x7c], eax
lea eax, [ebp + 0x192]
push ebx
mov dword [ebp - 0x80], ebx
push eax
mov word [ebp + 0x190], bx
call fcn.00491fe0
push esi
lea eax, [ebp + 0x39a]
push ebx
push eax
mov word [ebp + 0x398], bx
call fcn.00491fe0
add esp, 0x18
cmp dword [ebp + 0x5b0], ebx
je 0x45b73b
mov eax, dword [ebp + 0x5b0]
lea edx, [ebp + 0x398]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, bx
jne 0x45b72b
jmp 0x45b766
lea eax, [ebp - 0x80]
push eax
call fcn.0045b513
mov eax, dword [eax]
lea edx, [ebp + 0x398]
pop ecx
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, bx
jne 0x45b74f
lea ecx, [ebp - 0x80]
call dword [0x4a2ee8]
xor eax, eax
movzx ecx, word [ebp + eax + 0x398]
mov word [ebp + eax - 0x78], cx
inc eax
inc eax
cmp cx, bx
jne 0x45b768
lea edi, [ebp - 0x78]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
cmp ax, bx
jne 0x45b781
mov esi, str.Sector
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x78]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
cmp ax, bx
jne 0x45b79b
mov esi, 0x4ae5f8
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x78]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
cmp ax, bx
jne 0x45b7b2
mov esi, 0x4ae808
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
inc esi
push esi
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x190]
push eax
call fcn.0044f343
add esp, 0xc
lea eax, [ebp + 0x190]
push eax
inc esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x45b7c7
mov ecx, dword [ebp - 0x7c]
lea eax, [ebp + 0x190]
push eax
call dword [0x4a2ed8]
mov ecx, dword [ebp + 0x5a0]
mov eax, dword [ebp - 0x7c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00490f79
add ebp, 0x5a4
leave
ret
Function at 0x45b88b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4c
mov eax, dword [0x4d4028]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov eax, dword [esi]
cmp dword [eax - 0xc], 0
push edi
mov dword [ebp - 0xc4c], esi
jne 0x45b8bb
mov eax, 0x80070057
jmp 0x45ba77
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x45b8ce
xor eax, eax
jmp 0x45ba77
mov eax, 0x100
push eax
lea ecx, [ebp - 0xa38]
push ecx
push eax
lea ecx, [ebp - 0x228]
push ecx
push eax
lea eax, [ebp - 0x838]
push eax
push 3
lea eax, [ebp - 0xc]
push eax
push dword [esi]
call dword [0x4a3150]
lea eax, [ebp - 0x228]
add esp, 0x24
and dword [ebp - 0xc48], 0
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x45b90c
sub eax, ecx
sar eax, 1
lea ebx, [eax - 1]
cmp word [ebp + ebx*2 - 0x228], 0x29
jne 0x45b992
push 5
pop ecx
mov esi, str.0123456789
lea edi, [ebp - 0x24]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc44], 1
movsw word es:[edi], word [esi]
jmp 0x45b97b
movzx eax, word [esi]
push eax
call dword [0x4a315c]
test eax, eax
pop ecx
je 0x45b992
lea eax, [ebp - 0x24]
push esi
push eax
call dword [0x4a3160]
test eax, eax
pop ecx
pop ecx
jl 0x45b97b
mov ecx, dword [ebp - 0xc44]
imul eax, ecx
add dword [ebp - 0xc48], eax
imul ecx, ecx, 0xa
mov dword [ebp - 0xc44], ecx
dec ebx
lea esi, [ebp + ebx*2 - 0x228]
cmp word [esi], 0x28
jne 0x45b943
and word [ebp + ebx*2 - 0x228], 0
xor eax, eax
movzx ecx, word [ebp + eax - 0xc]
mov word [ebp + eax - 0x430], cx
inc eax
inc eax
test cx, cx
jne 0x45b994
lea eax, [ebp - 0x838]
mov edx, eax
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x45b9b0
sub eax, edx
lea edi, [ebp - 0x430]
dec edi
dec edi
mov cx, word [edi + 2]
inc edi
inc edi
test cx, cx
jne 0x45b9c4
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x228]
rep movsb byte es:[edi], byte [esi]
mov edx, eax
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x45b9e7
sub eax, edx
lea edi, [ebp - 0x430]
dec edi
dec edi
mov cx, word [edi + 2]
inc edi
inc edi
test cx, cx
jne 0x45b9fb
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xa38]
push eax
push str.__d_
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0xc40]
and ecx, 3
push str._s_s_s
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.0044f343
xor esi, esi
add esp, 0x14
inc esi
push esi
lea eax, [ebp - 0xc40]
push eax
lea eax, [ebp - 0x638]
push eax
call fcn.0044f343
add esp, 0xc
lea eax, [ebp - 0x638]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45ba86
inc esi
cmp esi, 0x3e8
jle 0x45ba40
mov eax, 0x80004005
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00490f79
leave
ret
mov ecx, dword [ebp - 0xc4c]
lea eax, [ebp - 0x638]
push eax
call dword [0x4a2d8c]
jmp 0x45b8c7
Function at 0x45c04d
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x4d4028]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
push 0x4b8
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
push 0x400
lea eax, [ebp - 0x804]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, ebx
lea eax, [ebp - 0x804]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x45c0b3
test dx, dx
je 0x45c0af
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x45c0b3
add eax, 4
add ecx, 4
test dx, dx
jne 0x45c08d
xor eax, eax
jmp 0x45c0b8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x45c0bf
inc eax
jmp 0x45c0e3
push esi
push edi
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push esi
push edi
call fcn.0047f042
pop ecx
pop ecx
push esi
push edi
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebx
push edi
call dword [sym.imp.USER32.dll_SetWindowTextW]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00490f79
leave
ret
Function at 0x461f61
Capabilities:
Terminate thread

Disassembly:
push 0x20
mov eax, 0x49ab61
call fcn.0049202e
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebx], vtable.RecDev::Devices.0
mov dword [ebx + 0x38], vtable.RecDev::Devices.1.0
mov dword [ebp - 4], 5
mov eax, dword [ebx + 0xa0]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x462022
and dword [ebp - 0x14], 0
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 0x14], 0x103
jne 0x46201a
push dword [ebx + 0xa4]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov byte [ebp - 0xd], 0
push 0x1388
push dword [ebx + 0xa0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x462001
cmp eax, 0x102
jne 0x462014
xor eax, eax
push 0x4af540
inc eax
mov ecx, 0x7f6050
call fcn.004012c0
pop ecx
push 0x2a
push dword [ebx + 0xa0]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x462014
push dword [ebx + 0xa0]
call esi
and dword [ebx + 0xa0], 0
mov byte [ebp - 0xd], 1
cmp byte [ebp - 0xd], 0
je 0x461fc2
push dword [ebx + 0xa0]
call esi
push dword [ebx + 0xa4]
call esi
push dword [ebx + 0xa8]
call esi
lea edi, [ebx + 0x6c]
lea esi, [ebp - 0x24]
call fcn.0045222e
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
jmp 0x462069
lea esi, [ebp - 0x18]
call fcn.0048023d
mov ecx, dword [eax]
test ecx, ecx
je 0x46205e
mov eax, dword [ecx]
push 1
call dword [eax]
lea edi, [ebp - 0x2c]
lea esi, [ebp - 0x18]
call fcn.00463b0a
lea esi, [ebp - 0x24]
lea edi, [ebx + 0x6c]
call fcn.0047ddab
mov edi, eax
lea esi, [ebp - 0x18]
call fcn.004523b7
test al, al
jne 0x46204a
mov edi, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea eax, [ebx + 0x88]
push eax
call edi
lea esi, [ebx + 0x7c]
call fcn.00463ad6
push dword [esi + 4]
call fcn.0048fec8
and dword [esi + 4], 0
mov eax, dword [ebx + 0x70]
test eax, eax
pop ecx
je 0x4620b4
push eax
call fcn.0048fec8
pop ecx
xor eax, eax
lea esi, [ebx + 0x54]
mov dword [ebx + 0x70], eax
mov dword [ebx + 0x74], eax
mov dword [ebx + 0x78], eax
call fcn.0040b8c0
lea eax, [ebx + 0x3c]
push eax
call edi
mov ecx, ebx
call fcn.0045c51b
call fcn.00492106
ret

Function at 0x464455
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x504]
mov eax, dword [edi]
test eax, eax
mov dword [esi], vtable.RecDev::BurnerGrabberEx.0
je 0x464474
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
and dword [edi], 0
mov ecx, esi
call fcn.0045cc5a
test byte [esp + 0xc], 1
je 0x46448c
push esi
call fcn.0048fec8
pop ecx
pop edi
mov eax, esi
pop esi
ret 4
Function at 0x467258
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x49aa60
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
mov eax, dword [0x4d4028]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.0048ffb2
mov dword [esp + 0xc], eax
lea eax, [esp + 0x1c]
push eax
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x1c]
push eax
call fcn.004901e6
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x34], ecx
sub ecx, eax
add ecx, edx
mov dword [esp + 0x2c], ecx
sub ecx, dword [esp + 0x1c]
push 0x52
mov dword [esp + 0x3c], eax
sub eax, edx
push eax
dec ecx
push ecx
xor ebx, ebx
push ebx
push ebx
push ebx
mov ecx, edi
mov dword [esp + 0x48], edx
call fcn.0049017a
lea ecx, [esp + 0x10]
call dword [0x4a2ef4]
push 0x75ad
lea ecx, [esp + 0x14]
mov dword [esp + 0x4c], ebx
call dword [0x4a2eb8]
push 0x6db5
push dword [esp + 0x10]
lea ecx, [esp + 0x34]
push ecx
push 0x50030000
push dword [esp + 0x20]
lea esi, [edi + 0x5c]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x13c]
push 0x53
push ebx
push ebx
push ebx
push ebx
push edi
mov ecx, esi
mov dword [esp + 0x30], eax
call fcn.0049017a
mov eax, dword [edi + 0x8b4]
cmp eax, ebx
mov dword [esp + 0x14], eax
mov dword [esi + 0x7c8], edi
jbe 0x467364
push 0x4a4090
mov ecx, esi
call fcn.0049016e
push 2
push dword [esp + 0x18]
jmp 0x467377
call fcn.004900d8
call dword [0x4a2084]
push 7
call fcn.00456193
push eax
push esi
call fcn.0045823a
mov eax, dword [esp + 0xc]
call fcn.00407140
push eax
call fcn.00456a45
lea ecx, [esp + 0x10]
call dword [0x4a2ee8]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x467d5e
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
mov edi, eax
lea eax, [ebp - 0x28]
push eax
push 0
push 0x419
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0x28]
and ecx, 1
je 0x467d8d
mov eax, dword [edi + 0x78]
jmp 0x467d90
mov eax, dword [edi + 0x74]
test eax, eax
jne 0x467da4
test ecx, ecx
je 0x467d9c
push 0x14
jmp 0x467d9e
push 0xf
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov esi, dword [ebp + 8]
mov ebx, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push dword [esi + 4]
mov dword [ebp - 8], eax
call ebx
cmp dword [edi + 0x8c], 0
mov dword [ebp - 4], eax
je 0x467e45
mov ecx, dword [esi + 4]
lea esi, [ebp - 0x18]
call fcn.00431100
fldz
lea esi, [edi + 0x60]
fst dword [ebp - 0xc]
lea edi, [ebp - 0x10]
fstp dword [ebp - 0x10]
call fcn.0046801a
fild dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x28]
sub esp, 0x10
fstp dword [ebp - 0x38]
mov dword [ebp + 0xc], eax
fild dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x24]
mov ecx, esi
fstp dword [ebp - 0x34]
lea esi, [ebp - 0x18]
fild dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x38]
fstp dword [ebp - 0x30]
fild dword [ebp + 0xc]
fstp dword [ebp - 0x2c]
fld dword [ebp - 0xc]
fstp dword [esp + 0xc]
fld dword [ebp - 0x10]
fstp dword [esp + 8]
fldz
fst dword [esp + 4]
fstp dword [esp]
call fcn.00467fb4
push dword [ebp - 0x18]
call sub.gdiplus.dll_GdipDeleteGraphics
mov esi, dword [ebp + 8]
jmp 0x467e5a
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [esi + 4]
call dword [sym.imp.GDI32.dll_Ellipse]
push dword [ebp - 4]
push dword [esi + 4]
call ebx
push dword [ebp - 8]
call dword [sym.imp.GDI32.dll_DeleteObject]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x467e83
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
call fcn.004900d8
mov ebx, dword [eax + 0xc]
test ebx, ebx
jne 0x467e9d
xor al, al
jmp 0x467fb1
push edi
mov eax, 0x4a9414
mov ecx, eax
test ecx, 0xffff0000
push 2
pop edi
jne 0x467eda
cmp ecx, edi
jne 0x467eda
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x133
push ebx
call sub.gdiplus.dll_GdipCreateBitmapFromResource
mov ecx, dword [ebp - 4]
test eax, eax
mov dword [esi + 0x68], eax
sete al
xor ebx, ebx
inc ebx
jmp 0x467fa3
push eax
push 0x133
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
mov dword [ebp - 0xc], eax
je 0x467f14
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x467f14
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x467f19
mov dword [esi + 0x68], edi
jmp 0x467f84
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
mov dword [ebp - 0xc], edi
jne 0x467f35
mov dword [esi + 0x68], 3
jmp 0x467f84
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x467f50
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 0x68], 1
jmp 0x467f84
push dword [ebp - 4]
push ebx
push eax
call fcn.004922d4
lea edi, [esi + 0x70]
mov eax, dword [edi]
add esp, 0xc
test eax, eax
je 0x467f6f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [edi], 0
push edi
xor ebx, ebx
inc ebx
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
je 0x467f88
mov dword [esi + 0x68], ebx
xor al, al
jmp 0x467fb0
mov edi, dword [edi]
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push edi
call sub.gdiplus.dll_GdipCreateBitmapFromStream
mov ecx, dword [ebp - 8]
test eax, eax
mov dword [esi + 0x68], eax
sete al
test al, al
mov dword [esi + 0x64], ecx
je 0x467fb0
mov dword [esi + 0x8c], ebx
pop edi
pop ebx
leave
ret
Function at 0x46a871
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4d4028]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
mov dword [ebp - 0x210], edi
cmp dword [0x7f5604], edi
jne 0x46a8a8
push edi
push 0x4b0bfc
mov eax, str.EngelmannMedia
call fcn.0046a79f
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp + 0xc]
neg eax
sbb eax, eax
push edi
and eax, 0x8000
or eax, dword [ebp + 8]
push edi
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
call fcn.004900d8
mov eax, dword [eax + 4]
lea esi, [ebp - 0x210]
mov ecx, eax
call fcn.00429b50
push dword [eax]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov ecx, esi
call dword [0x4a2ee8]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
cmp dword [ebp + 0xc], edi
pop edi
pop esi
je 0x46a915
lea eax, [ebp - 0x20c]
push eax
call fcn.0045b10d
pop ecx
lea eax, [ebp - 0x20c]
push eax
mov ecx, ebx
call dword [0x4a2ed8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, ebx
call fcn.00490f79
leave
ret
Function at 0x46aa49
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, eax
test edi, edi
jne 0x46aa67
call fcn.004900d8
mov edi, dword [eax + 0xc]
test edi, edi
jne 0x46aa67
xor al, al
jmp 0x46ab78
cmp dword [ebp + 8], 0
je 0x46aa60
test dword [ebp + 0xc], 0xffff0000
movzx eax, word [ebp + 8]
jne 0x46aaa6
cmp dword [ebp + 0xc], 2
jne 0x46aaa6
and dword [ebp + 0xc], 0
lea ecx, [ebp + 0xc]
push ecx
push eax
push edi
call sub.gdiplus.dll_GdipCreateBitmapFromResource
mov ecx, dword [ebp + 0xc]
mov dword [esi + 4], ecx
xor ecx, ecx
test eax, eax
sete cl
mov dword [esi + 8], eax
mov al, cl
jmp 0x46ab78
push ebx
push dword [ebp + 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x46aadc
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
mov dword [ebp + 0xc], eax
je 0x46aadc
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x46aae5
mov dword [esi + 8], 2
jmp 0x46ab51
push dword [ebp + 0xc]
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
mov dword [ebp + 8], edi
jne 0x46ab02
mov dword [esi + 8], 3
jmp 0x46ab51
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x46ab1d
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 8], 1
jmp 0x46ab51
push dword [ebp + 0xc]
push ebx
push eax
call fcn.004922d4
lea edi, [esi + 0x10]
mov eax, dword [edi]
add esp, 0xc
test eax, eax
je 0x46ab3c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [edi], 0
push edi
xor ebx, ebx
inc ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
je 0x46ab55
mov dword [esi + 8], ebx
xor al, al
jmp 0x46ab77
mov edi, dword [edi]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push edi
call sub.gdiplus.dll_GdipCreateBitmapFromStream
mov ecx, dword [ebp - 4]
mov dword [esi + 4], ecx
xor ecx, ecx
test eax, eax
sete cl
mov dword [esi + 8], eax
mov al, cl
pop ebx
pop edi
leave
ret 8
Function at 0x46bdcd
Capabilities:
Create directory

Disassembly:
push 8
mov eax, 0x497db2
call fcn.0049202e
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor ebx, ebx
push ebx
push dword [ebp + 8]
call esi
test eax, eax
je 0x46bdf4
xor eax, eax
inc eax
call fcn.00492106
ret
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0xb7
je 0x46bdeb
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call dword [0x4a2ed8]
push 0x5c
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call dword [0x4a2644]
cmp eax, 0xffffffff
lea ecx, [ebp - 0x10]
jne 0x46be2f
call dword [0x4a2ee8]
xor eax, eax
jmp 0x46bdee
push eax
lea eax, [ebp - 0x14]
push eax
call dword [0x4a2d94]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call dword [0x4a2ea0]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call dword [0x4a2ee8]
push dword [ebp - 0x10]
call fcn.0046bdcd
test eax, eax
pop ecx
jne 0x46be6e
lea ecx, [ebp - 0x10]
call dword [0x4a2ee8]
mov eax, ebx
jmp 0x46bdee
push ebx
push dword [ebp + 8]
call esi
test eax, eax
je 0x46be7d
xor ebx, ebx
inc ebx
jmp 0x46be61
call edi
cmp eax, 0xb7
je 0x46be78
push 6
pop ebx
jmp 0x46be61
Function at 0x46c744
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4d4028]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
cmp ecx, 0xffffffff
mov eax, dword [eax + 4]
push esi
push edi
mov esi, ebx
jne 0x46c788
cmp eax, 0x7fffffff
jne 0x46c788
mov eax, 0x4a4090
mov edx, ebx
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x46c775
jmp 0x46c83e
test eax, eax
jg 0x46c7a1
jl 0x46c792
test ecx, ecx
jae 0x46c7a1
neg ecx
adc eax, 0
neg eax
mov word [ebx], 0x2d
lea esi, [ebx + 2]
push 0
push 0x989680
push eax
push ecx
call fcn.004921f0
push 0
push 0xe10
mov edi, edx
push edi
push eax
mov dword [ebp - 0x20], eax
call fcn.004921f0
push 0
push 0x3c
push edi
push dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
call fcn.004921f0
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x10], 0x3a
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
push 5
stosw word es:[edi], ax
lea eax, [ebp - 0x10]
push eax
push 0x1e
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov eax, dword [ebp - 0x20]
push 0x3c
cdq
pop ecx
idiv ecx
lea eax, [ebp - 0x10]
push edx
push eax
mov eax, dword [ebp - 0x18]
cdq
idiv ecx
lea eax, [ebp - 0x10]
push edx
push eax
mov eax, dword [ebp - 0x14]
push 0x18
pop ecx
cdq
idiv ecx
push edx
push str._02d_s_02d_s_02d
push esi
call fcn.0044f343
lea eax, [esi + eax*2]
add esp, 0x1c
cmp eax, ebx
jbe 0x46c83a
lea ecx, [eax - 2]
cmp word [ecx], 0x20
jne 0x46c83a
mov eax, ecx
and word [eax], 0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, ebx
pop esi
call fcn.00490f79
leave
ret 4
Function at 0x470e89
Capabilities:
Get common file path
Get file system object information

Disassembly:
push 0x52c
mov eax, 0x49c592
call fcn.00492097
push 0x21
xor esi, esi
push esi
mov ebx, ecx
push 0x1036
push dword [ebx + 0x394]
mov dword [ebp - 0x4e0], ebx
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
push 0x40
add ebx, 0x374
push esi
mov ecx, ebx
call fcn.004900ae
push 1
mov ecx, ebx
call fcn.00490954
push 0x104
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x4710a5
push 0x4001
push 0x2b4
lea eax, [ebp - 0x4dc]
push eax
push esi
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push eax
call fcn.00490930
push ebx
call fcn.004721ac
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x31
call esi
mov edi, eax
inc edi
push 0
inc edi
push ebx
mov dword [ebp - 0x4f4], edi
call fcn.0047a16f
push 4
push ebx
mov dword [ebp - 0x4f0], eax
call fcn.0047a16f
push 1
push ebx
mov dword [ebp - 0x4ec], eax
call fcn.0047a16f
push 3
push ebx
mov dword [ebp - 0x4e8], eax
call fcn.0047a16f
add esp, 0x20
push 2
mov dword [ebp - 0x4e4], eax
call esi
mov esi, eax
add esi, dword [ebp - 0x4e4]
lea eax, [ebp - 0x518]
add esi, dword [ebp - 0x4e8]
push eax
add esi, dword [ebp - 0x4ec]
mov eax, dword [ebp - 0x4e0]
add esi, dword [ebp - 0x4f0]
push dword [eax + 0x394]
add esi, edi
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x510]
sub eax, dword [ebp - 0x518]
cmp esi, eax
jge 0x470fc0
sub eax, esi
cdq
sub eax, edx
sar eax, 1
add dword [ebp - 0x4f0], eax
add dword [ebp - 0x4ec], eax
push dword [0x4a2ee8]
lea eax, [ebp - 0x508]
push dword [0x4a2ef4]
push 5
push 4
push eax
call fcn.00490f94
xor esi, esi
push 0x7656
lea ecx, [ebp - 0x504]
mov dword [ebp - 4], esi
call dword [0x4a2eb8]
push 0x765a
lea ecx, [ebp - 0x500]
call dword [0x4a2eb8]
push 0x7657
lea ecx, [ebp - 0x4fc]
call dword [0x4a2eb8]
push 0x7659
lea ecx, [ebp - 0x4f8]
call dword [0x4a2eb8]
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x538]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + esi*4 - 0x508]
and dword [ebp - 0x534], 0
mov dword [ebp - 0x52c], eax
lea eax, [ebp - 0x538]
push eax
mov eax, dword [ebp - 0x4e0]
push esi
push 0x1061
push dword [eax + 0x394]
mov dword [ebp - 0x538], 0xf
mov dword [ebp - 0x524], esi
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp + esi*4 - 0x4f4]
mov ecx, esi
mov edx, ebx
call fcn.004178f0
inc esi
cmp esi, 5
jl 0x471032
or dword [ebp - 4], 0xffffffff
push dword [0x4a2ee8]
lea eax, [ebp - 0x508]
push 5
push 4
push eax
call fcn.00491057
call fcn.0049211a
ret