joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420204
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0x4f9a98
push dword [ebp + 8]
xor esi, esi
call fcn.004bfca0
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x420285
push 2
push esi
push edi
call fcn.004c053c
add esp, 0xc
test eax, eax
jne 0x42027e
push ebx
push edi
call fcn.004c0b72
mov ebx, eax
pop ecx
test ebx, ebx
js 0x42027d
push esi
push esi
push edi
call fcn.004c053c
add esp, 0xc
test eax, eax
jne 0x42027d
lea eax, [ebx + 1]
push eax
call fcn.004bfa2b
mov esi, eax
pop ecx
test esi, esi
je 0x42027d
push edi
push ebx
push 1
push esi
call fcn.004c00a1
add esp, 0x10
cmp eax, ebx
je 0x420279
push esi
call fcn.004a45f7
pop ecx
xor esi, esi
jmp 0x42027d
mov byte [eax + esi], 0
pop ebx
push edi
call fcn.004bfde9
pop ecx
pop edi
mov eax, esi
pop esi
pop ebp
ret

Function at 0x420406
Capabilities:
Create thread

Disassembly:
push 0x114
mov eax, 0x4eb46f
call fcn.00495bb6
mov esi, ecx
push str._BeginUpdate_CForceUpdateWnd__QAEXXZ
xor ebx, ebx
push 0x4f24b4
mov dword [ebp - 0x120], ebx
call fcn.0042e448
pop ecx
pop ecx
mov ecx, dword [esi + 0xba8]
call fcn.0048d3a1
test al, al
je 0x4205cc
mov ecx, dword [esi + 0xba8]
call fcn.0048afaa
mov byte [esi + 0x770], bl
cmp dword [esi + 0x774], ebx
jne 0x42048a
mov ecx, dword [esi + 0x77c]
lea edx, [ebp - 0x94]
push edx
mov eax, dword [ecx]
call dword [eax + 0x28]
and dword [ebp - 4], ebx
mov ecx, eax
inc ebx
mov dword [ebp - 0x120], ebx
call fcn.0042fcb7
mov byte [ebp - 0x119], 1
cmp al, 1
jne 0x420491
mov byte [ebp - 0x119], 0
or dword [ebp - 4], 0xffffffff
test bl, 1
je 0x4204a8
lea ecx, [ebp - 0x94]
and ebx, 0xfffffffe
call fcn.0042f32e
cmp byte [ebp - 0x119], 0
je 0x420504
mov ecx, dword [esi + 0x790]
xor ebx, ebx
push ebx
mov dword [esi + 0x774], 1
call fcn.0043cf57
mov ecx, dword [esi + 0x794]
push ebx
call fcn.0043cf57
mov ecx, dword [esi + 0x784]
push ebx
mov eax, dword [ecx]
call dword [eax + 0x104]
mov ecx, dword [esi + 0x788]
push ebx
mov eax, dword [ecx]
call dword [eax + 0x104]
mov ecx, dword [esi + 0x76c]
push ebx
mov eax, dword [ecx]
call dword [eax + 0x104]
jmp 0x420571
cmp dword [esi + 0x774], 1
jne 0x420541
mov ecx, dword [esi + 0x780]
lea edx, [ebp - 0x118]
push edx
mov eax, dword [ecx]
call dword [eax + 0x28]
or ebx, 2
mov dword [ebp - 4], 1
mov ecx, eax
mov dword [ebp - 0x120], ebx
call fcn.0042fcb7
mov byte [ebp - 0x119], 1
cmp al, 1
jne 0x420548
mov byte [ebp - 0x119], 0
or dword [ebp - 4], 0xffffffff
test bl, 2
je 0x42055c
lea ecx, [ebp - 0x118]
call fcn.0042f32e
cmp byte [ebp - 0x119], 0
je 0x4205a2
mov dword [esi + 0x774], 2
xor ebx, ebx
cmp dword [esi + 0x774], 1
mov ecx, dword [esi + 0x78c]
mov eax, dword [ecx]
jne 0x420589
push str._update_check_mcu
jmp 0x42058e
push str._update_check_flash
call dword [eax + 0x2c]
push esi
push ebx
push 0x4207c5
call fcn.004b7a2e
add esp, 0xc
jmp 0x4205cc
mov ecx, dword [esi + 0x78c]
push str._update_no_file
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x790]
push 0
call fcn.0043cf57
mov ecx, dword [esi + 0x794]
push 0
call fcn.0043cf57
call fcn.00495b60
ret
Function at 0x420ce1
Capabilities:
Create thread

Disassembly:
push esi
push str.CForceUpdateWnd::ResetMcuFactoryDefault
push 0x4f24b4
mov esi, ecx
call fcn.0042e448
push esi
push 0
push 0x420773
mov dword [esi + 0x774], 3
call fcn.004b7a2e
add esp, 0x14
pop esi
ret

Function at 0x42731a
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push str.DeleteSence_n
mov edi, ecx
call fcn.0042e448
pop ecx
xor ebx, ebx
mov ecx, edi
push ebx
push ebx
push 0x4fa
call fcn.00439fd5
mov eax, dword [edi + 0x790]
mov ecx, edi
mov esi, dword [ebp + 8]
mov dword [eax + 8], esi
call fcn.00439e99
mov ecx, dword [edi + 0x790]
shl esi, 4
push 0x10
add esi, 0xdb458
mov dword [ecx + 0xdc188], eax
mov eax, dword [edi + 0x790]
add eax, esi
push ebx
push eax
call fcn.00497890
add esp, 0xc
mov ecx, edi
call fcn.004280ba
push dword [edi + 0x790]
push ebx
push 0x40e82a
call fcn.004b7a2e
add esp, 0xc
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x427683
Capabilities:
Create thread

Disassembly:
push 0x910
mov eax, 0x4ec3d9
call fcn.00495bb6
mov esi, ecx
mov edi, dword [ebp + 8]
push str.LoadSence_n
call fcn.0042e448
mov dword [esp], 0x800
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.00497890
add esp, 0xc
lea ecx, [ebp - 0x894]
call fcn.0042f203
mov eax, dword [esi + 0x790]
mov ecx, edi
and dword [ebp - 4], 0
shl ecx, 4
mov dword [ebp - 0x91c], ecx
add ecx, 0xdb458
add eax, ecx
lea ecx, [ebp - 0x918]
push 0xffffffffffffffff
push eax
call fcn.0042f1df
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0042fcb7
cmp al, 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x918]
setne bl
call fcn.0042f32e
lea eax, [ebp - 0x918]
test bl, bl
je 0x42777e
xor ebx, ebx
push ebx
push str._load_scene_tips1
push eax
call fcn.00403cdb
mov ecx, eax
call fcn.0043045b
push eax
lea ecx, [ebp - 0x894]
mov byte [ebp - 4], 2
call fcn.0042f3c8
lea ecx, [ebp - 0x918]
mov byte [ebp - 4], bl
call fcn.0042f32e
mov ecx, dword [ebp - 0x91c]
mov eax, dword [esi + 0x790]
add ecx, 0xdb458
add eax, ecx
lea ecx, [ebp - 0x894]
push eax
push edi
call fcn.0042fad9
push eax
lea eax, [ebp - 0x810]
push eax
call fcn.00405c58
add esp, 0x10
jmp 0x4277cd
xor ebx, ebx
push ebx
push str._load_scene_tips2
push eax
call fcn.00403cdb
mov ecx, eax
call fcn.0043045b
push eax
lea ecx, [ebp - 0x894]
mov byte [ebp - 4], 3
call fcn.0042f3c8
lea ecx, [ebp - 0x918]
mov byte [ebp - 4], bl
call fcn.0042f32e
push edi
lea ecx, [ebp - 0x894]
call fcn.0042fad9
push eax
lea eax, [ebp - 0x810]
push eax
call fcn.00405c58
add esp, 0xc
lea eax, [ebp - 0x810]
mov ecx, esi
push eax
push str._tips
call fcn.00439e99
push eax
call fcn.00405323
add esp, 0xc
cmp eax, 1
jne 0x42782c
push ebx
push ebx
push 0x4fa
mov ecx, esi
call fcn.00439fd5
mov eax, dword [esi + 0x790]
mov ecx, esi
mov dword [eax + 8], edi
call fcn.00439e99
mov ecx, dword [esi + 0x790]
mov dword [ecx + 0xdc188], eax
push dword [esi + 0x790]
push ebx
push 0x410480
call fcn.004b7a2e
add esp, 0xc
lea ecx, [ebp - 0x894]
call fcn.0042f32e
call fcn.00495b60
ret 4
Function at 0x42941d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x8c
mov eax, 0x4ec67b
call fcn.00495bb6
push 4
call fcn.00438f0e
lea eax, [ebp - 0x94]
push eax
call fcn.00433677
pop ecx
pop ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.00433922
sub eax, 1
je 0x42957a
sub eax, 1
je 0x429541
sub eax, 1
je 0x42950e
sub eax, 1
jne 0x4295b2
push str.skinGsound4to8_feelart_
lea ecx, [ebp - 0x94]
call fcn.0042f666
lea ecx, [ebp - 0x94]
call fcn.0042fad9
push eax
call fcn.00438ec5
mov dword [esp], str.ZIPRES
push str.IDR_ZIPRES
call fcn.0043390d
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x4295b2
push esi
call fcn.0043390d
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x429502
push esi
call fcn.0043390d
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x429502
push str.gsound_shuy_duilib
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
call fcn.00438f1b
add esp, 0xc
push ebx
push ecx
mov eax, esp
mov dword [eax], 0x4fb948
call fcn.00403cdb
mov ecx, eax
call fcn.00430bb6
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x4295b2
push str.skinGsound4to8_feelart_
lea ecx, [ebp - 0x94]
call fcn.0042f666
lea ecx, [ebp - 0x94]
call fcn.0042fad9
push eax
call fcn.00438ec5
mov dword [esp], 0x4fb960
push ecx
mov eax, esp
mov dword [eax], str.IDR_RES
jmp 0x4295a6
push str.skinGsound4to8_feelart_
lea ecx, [ebp - 0x94]
call fcn.0042f666
lea ecx, [ebp - 0x94]
call fcn.0042fad9
push eax
call fcn.00438ec5
mov dword [esp], str.duilib_ultimate
push 1
push str.duidemo_pwd.zip
call fcn.00438fa9
add esp, 0xc
jmp 0x42959c
push str.skinGsound4to8_feelart_
lea ecx, [ebp - 0x94]
call fcn.0042f666
lea ecx, [ebp - 0x94]
call fcn.0042fad9
push eax
call fcn.00438ec5
pop ecx
push ebx
push ecx
mov eax, esp
mov dword [eax], 0x4fb948
call fcn.00403cdb
mov ecx, eax
call fcn.00430bb6
lea ecx, [ebp - 0x94]
call fcn.0042f32e
call fcn.00495b60
ret
Function at 0x4295c3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x536260]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
mov esi, 0x208
xor ebx, ebx
push esi
push ebx
push eax
call fcn.00497890
push esi
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.00497890
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push str._s_savelog.ini
push eax
call esi
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.004c97f1
add esp, 0x14
test eax, eax
je 0x429648
cmp eax, 0xd
jne 0x429666
lea eax, [ebp - 0x20c]
push eax
push str._s_save.log
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0042e337
add esp, 0x10
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x4296fb
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
push edi
call fcn.00438bd4
call fcn.0042941d
push 0x8e
push str.Gsound.cpp
push 1
push 0xdd658
call fcn.00495dea
add esp, 0x14
test eax, eax
je 0x4296af
mov ecx, eax
call fcn.00429b60
mov esi, eax
jmp 0x4296b1
mov esi, ebx
test esi, esi
je 0x4296fb
push ebx
push 0x28a
push 0x4ce
push ebx
push ebx
push ebx
push 0x10cf0000
push str.Feelart_DSP_Audio
push ebx
mov ecx, esi
call fcn.00439a47
mov ecx, esi
call fcn.004398f1
call fcn.00436497
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 0x14]
call fcn.004391b3
call dword [sym.imp.ole32.dll_OleUninitialize]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00495b3a
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42b054
Capabilities:
Hide graphical window

Disassembly:
push 4
mov eax, 0x4ec94a
call fcn.00495b82
push 0x1b0e8
call fcn.00495470
pop ecx
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
test eax, eax
je 0x42b07f
mov ecx, eax
call fcn.004041f2
jmp 0x42b081
xor eax, eax
mov edx, dword [ebp + 0xc]
mov dword [0x538538], eax
mov dword [eax + 0x1b0c8], edx
mov eax, dword [0x538538]
or dword [ebp - 4], 0xffffffff
lea ecx, [edx + 0x228]
push 0
mov dword [eax + 0x1b0c4], ecx
lea ecx, [edx + 0xdc184]
mov eax, dword [0x538538]
mov dword [eax + 0x1b0cc], ecx
mov eax, Ordinal_1
mov ecx, dword [0x538538]
push eax
push eax
push eax
push eax
push 0x80
push 0x82000000
push str.updatefwwnd
push dword [ebp + 8]
call fcn.00439a47
mov ecx, dword [0x538538]
call fcn.004398f1
push 2
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x538538]
call fcn.0043a2c3
push 1
push dword [ebp + 8]
mov esi, eax
call dword [sym.imp.USER32.dll_ShowWindow]
and dword [0x538538], 0
mov eax, esi
call fcn.00495b4b
ret

Function at 0x42d611
Capabilities:
Create process on windows

Disassembly:
push 0x88
mov eax, 0x4ecc2d
call fcn.00495bb6
mov edi, ecx
mov esi, dword [ebp + 8]
lea edx, [ebp - 0x94]
push edx
mov ecx, dword [esi + 0x108]
mov eax, dword [ecx]
call dword [eax + 4]
xor ebx, ebx
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], ebx
call fcn.0042fd52
mov eax, dword [esi + 0x108]
cmp eax, dword [edi + 0x76c]
jne 0x42d65f
push ebx
mov ecx, edi
call fcn.00439a21
jmp 0x42d6cc
cmp eax, dword [edi + 0x778]
jne 0x42d66f
push ebx
push 0xf020
jmp 0x42d68d
cmp eax, dword [edi + 0x770]
jne 0x42d67f
push ebx
push 0xf030
jmp 0x42d68d
cmp eax, dword [edi + 0x774]
jne 0x42d69b
push ebx
push 0xf120
push 0x112
mov ecx, edi
call fcn.0043a219
jmp 0x42d6cc
cmp eax, dword [edi + 0x77c]
je 0x42d6cc
push str.homepage_btn
lea ecx, [ebp - 0x94]
call fcn.0042f86a
test eax, eax
jne 0x42d6cc
push 5
push ebx
push ebx
push str.https:__github.com_qdtroy
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x94]
call fcn.0042f32e
call fcn.00495b60
ret 4

Function at 0x42e608
Capabilities:
Create thread

Disassembly:
push esi
push str._BeginUpdate_CUpdateFwWnd__IAEXXZ
push 0x4f24b4
mov esi, ecx
call fcn.0042e448
pop ecx
pop ecx
mov ecx, dword [esi + 0x788]
call fcn.0048d3a1
test al, al
je 0x42e6aa
mov ecx, dword [esi + 0x788]
push ebx
call fcn.0048afaa
mov ecx, dword [esi + 0x780]
xor ebx, ebx
mov byte [esi + 0x78d], bl
push str._loading_fw
mov eax, dword [ecx]
call dword [eax + 0x2c]
push esi
push ebx
push 0x42ee25
call fcn.004b7a2e
mov ecx, dword [esi + 0x76c]
add esp, 0xc
mov eax, dword [ecx]
push ebx
call dword [eax + 0x104]
mov ecx, dword [esi + 0x778]
push ebx
mov eax, dword [ecx]
call dword [eax + 0x104]
mov ecx, dword [esi + 0x774]
push ebx
mov eax, dword [ecx]
call dword [eax + 0x104]
mov ecx, dword [esi + 0x784]
push ebx
mov eax, dword [ecx]
call dword [eax + 0x104]
mov ecx, dword [esi + 0x770]
push ebx
mov eax, dword [ecx]
call dword [eax + 0x104]
pop ebx
pop esi
ret
Function at 0x42ed33
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x536260]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x20c]
mov esi, ecx
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x58
pop edi
push edi
lea eax, [ebp - 0x264]
push 0
push eax
call fcn.00497890
add esp, 0xc
mov dword [ebp - 0x264], edi
mov ecx, esi
call fcn.00439e99
and dword [ebp - 0x240], 0
lea edi, [esi + 0x78e]
and dword [ebp - 0x23c], 0
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x264]
push eax
mov dword [ebp - 0x248], edi
mov dword [ebp - 0x244], 0x208
mov dword [ebp - 0x258], 0x4fcd28
mov dword [ebp - 0x24c], 1
mov dword [ebp - 0x230], 0x81800
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
test eax, eax
je 0x42ee15
push edi
push str.Upg_GetOpenFileName__s_ok_n
call fcn.0042e448
pop ecx
pop ecx
mov ecx, dword [esi + 0x770]
push edi
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x770]
mov eax, dword [ecx]
call dword [eax + 0x11c]
mov ecx, dword [esi + 0x770]
call fcn.0045fe54
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00495b3a
mov esp, ebp
pop ebp
ret

Function at 0x430bb6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x536260]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, ecx
mov ecx, eax
shr ecx, 0x10
mov dword [ebp - 0x214], ebx
push esi
push edi
test cx, cx
je 0x430c21
add ebx, 0x144
cmp word [eax], 0x3c
mov ecx, ebx
jne 0x430c13
push eax
call fcn.0046437f
test al, al
jne 0x430c81
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00495b3a
leave
ret 8
push 0
push eax
call fcn.004643cd
test al, al
je 0x430c00
jmp 0x430c81
push edx
push eax
call fcn.0043390d
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x430c00
push esi
call fcn.0043390d
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x430c51
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x430c00
push 0
push esi
add ebx, 0x144
call fcn.0043390d
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
mov ecx, ebx
call fcn.004646c0
test al, al
je 0x430c00
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
lea eax, [ebp - 0x210]
mov ecx, ebx
push eax
call fcn.0046423c
sub esp, 0x20c
mov esi, eax
mov edi, esp
mov ecx, 0x83
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x214]
call fcn.004308be
mov ecx, ebx
mov esi, eax
call fcn.0046480b
xor eax, eax
test esi, esi
setne al
jmp 0x430c02
Function at 0x433e45
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
push 8
pop ecx
test ax, ax
push 1
cmovs esi, ecx
call edi
test ax, ax
jns 0x433e68
or esi, 1
push 2
call edi
test ax, ax
jns 0x433e74
or esi, 2
push 0x10
call edi
test ax, ax
jns 0x433e80
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x433e8c
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x436fb8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [esi + 0x4a8]
call fcn.0042faf2
mov edi, dword [ebp + 8]
test eax, eax
jle 0x43700e
push ebx
lea ecx, [esi + 0x4a8]
mov byte [ebp + 0xb], 0
call fcn.0042f4d3
lea ecx, [ebp + 0xb]
push ecx
push dword [ebp + 0x10]
mov edx, dword [eax]
mov ecx, eax
push dword [ebp + 0xc]
push edi
call dword [edx]
cmp byte [ebp + 0xb], 0
jne 0x43706c
lea ecx, [esi + 0x4a8]
inc ebx
call fcn.0042faf2
cmp ebx, eax
jl 0x436fd7
sub edi, 0x100
je 0x4370d9
sub edi, 4
je 0x437070
dec edi
sub edi, 1
jne 0x4370d0
push dword [ebp + 0xc]
and dword [ebp + 8], edi
call fcn.004caf51
pop ecx
mov ecx, dword [esi + 0x104]
lea edx, [ebp + 8]
push 0x80000012
mov word [ebp + 8], ax
push edx
mov eax, dword [ecx]
push 0x4396d3
call dword [eax + 0x128]
mov esi, eax
test esi, esi
je 0x4370d0
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x11c]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x18]
mov al, 1
jmp 0x4370d2
cmp dword [esi + 0x108], 0
je 0x4370d0
xor eax, eax
mov dword [ebp - 0x20], 6
mov word [ebp - 2], ax
xorps xmm0, xmm0
mov eax, dword [ebp + 0xc]
mov word [ebp - 0xc], ax
mov eax, dword [esi + 0x11c]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x120]
movlpd qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0xa], xmm0
mov dword [ebp - 0x10], eax
call fcn.00433e45
mov word [ebp - 0xa], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x108]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x134]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x4370d0
mov ecx, dword [esi + 0x108]
test ecx, ecx
je 0x437132
mov eax, dword [ecx]
call dword [eax + 0xf4]
test al, al
je 0x437132
mov ecx, dword [esi + 0x108]
mov eax, dword [ecx]
call dword [eax + 0x100]
test al, al
je 0x437132
mov ecx, dword [esi + 0x108]
push str.RichEditUI
mov eax, dword [ecx]
call dword [eax + 0xc]
push eax
call fcn.00499244
pop ecx
pop ecx
test eax, eax
je 0x437132
mov ecx, dword [esi + 0x108]
call fcn.0046a693
test al, al
jne 0x4370d0
mov ecx, dword [esi + 0x108]
test ecx, ecx
je 0x43717a
mov eax, dword [ecx]
call dword [eax + 0xf4]
test al, al
je 0x43717a
mov ecx, dword [esi + 0x108]
mov eax, dword [ecx]
call dword [eax + 0x100]
test al, al
je 0x43717a
mov ecx, dword [esi + 0x108]
push str.WkeWebkitUI
mov eax, dword [ecx]
call dword [eax + 0xc]
push eax
call fcn.00499244
pop ecx
pop ecx
test eax, eax
jne 0x4370d0
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ecx, esi
setns al
movzx eax, al
push eax
call fcn.00438d2f
jmp 0x43706c
Function at 0x438881
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov edi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [edi + 0xa8]
mov esi, dword [ebp + 8]
cmp eax, ecx
je 0x4388ad
cmp esi, dword [edi + 0x108]
je 0x4388ad
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [edi + 0x108]
cmp esi, eax
je 0x438993
test eax, eax
je 0x438914
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0x17
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x10], xmm0
movlpd qword [ebp - 8], xmm0
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x108]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x134]
xor eax, eax
mov ecx, edi
push eax
push eax
push eax
push str.killfocus
push dword [edi + 0x108]
call fcn.0043837b
and dword [edi + 0x108], 0
test esi, esi
je 0x438993
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
cmp eax, edi
jne 0x438993
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xf4]
test al, al
je 0x438993
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x100]
test al, al
je 0x438993
xorps xmm0, xmm0
mov dword [edi + 0x108], esi
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x10], xmm0
movlpd qword [ebp - 8], xmm0
mov dword [ebp - 0x20], 0x18
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x108]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x134]
xor eax, eax
mov ecx, edi
push eax
push eax
push eax
push str.setfocus
push dword [edi + 0x108]
call fcn.0043837b
pop edi
pop esi
leave
ret 4
Function at 0x43a2c3
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov ebx, ecx
push 4
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindow]
push 1
push dword [ebx + 4]
mov esi, eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
push 7
pop ecx
push dword [ebx + 4]
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_IsWindow]
mov edi, dword [sym.imp.USER32.dll_SetFocus]
jmp 0x43a37f
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x43a383
cmp dword [ebp - 0x1c], 0x20a
mov eax, dword [ebp - 0x20]
jne 0x43a331
cmp eax, esi
je 0x43a376
cmp dword [ebp - 0x1c], 0x10
jne 0x43a34e
cmp eax, dword [ebx + 4]
jne 0x43a34e
mov eax, dword [ebp - 0x18]
push 1
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
call edi
lea eax, [ebp - 0x20]
push eax
call fcn.0043938f
pop ecx
test al, al
jne 0x43a370
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp - 0x1c], 0x12
je 0x43a383
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x43a30e
push 1
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
call edi
cmp dword [ebp - 0x1c], 0x12
pop edi
pop esi
pop ebx
jne 0x43a3a1
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [ebp - 4]
leave
ret

Function at 0x43a3a6
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x43a3d8
xor eax, eax
inc eax
cmp byte [ebp + 0xc], 0
push 4
pop edx
cmovne edx, eax
xor eax, eax
cmp byte [ebp + 8], al
cmovne eax, edx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8