joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428acb
Capabilities:
Get graphical window text

Disassembly:
push ebp
lea ebp, [esp - 0x2020]
mov eax, 0x20a0
call fcn.00446050
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp + 0x201c], eax
cmp dword [ebp + 0x2028], 0x64
push esi
mov esi, ecx
jne 0x428c75
push 0x64
push dword [esi + 0x28]
call dword [sym.imp.USER32.dll_KillTimer]
test byte [esi + 0x7c], 2
je 0x428b18
cmp dword [esi + 0x84], 0
je 0x428c75
mov eax, dword [esi + 0x4c]
push edi
mov edi, 0x824
push edi
lea ecx, [ebp + 0xfd4]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp dword [esi + 0x84], 0
mov dword [ebp - 0x78], eax
je 0x428c58
push ebx
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0xb0
push dword [esi + 0x4c]
or ebx, 0xffffffff
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x80], ebx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [ebp - 0x7c], ebx
je 0x428c3b
mov ecx, dword [ebp - 0x80]
cmp ecx, ebx
je 0x428c3b
cmp dword [ebp - 0x7c], ecx
je 0x428c3b
xor eax, eax
xor ebx, ebx
cmp dword [ebp - 0x78], eax
jle 0x428c22
cmp eax, dword [ebp - 0x7c]
jl 0x428b93
cmp eax, ecx
jl 0x428bb4
mov dx, word [ebp + eax*2 + 0xfd4]
mov word [ebp + ebx*2 + 0xfd4], dx
inc ebx
cmp ebx, 0x823
je 0x428c22
inc eax
cmp eax, dword [ebp - 0x78]
jl 0x428b8a
jmp 0x428c22
push dword [esi + 0x84]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov ecx, dword [ebp - 0x80]
mov dword [ebp - 0x78], eax
push edi
lea ecx, [ebp + ecx*2 + 0xfd4]
lea eax, [ebp - 0x74]
call fcn.00440c1b
xor edx, edx
pop ecx
cmp dword [ebp - 0x78], edx
jle 0x428c01
mov ecx, dword [esi + 0x84]
mov di, word [ecx]
mov word [ebp + ebx*2 + 0xfd4], di
inc ebx
cmp ebx, 0x823
je 0x428c01
inc edx
add ecx, 2
cmp edx, dword [ebp - 0x78]
jl 0x428be4
xor ecx, ecx
test eax, eax
jle 0x428c22
mov dx, word [ebp + ecx*2 - 0x74]
mov word [ebp + ebx*2 + 0xfd4], dx
inc ebx
cmp ebx, 0x823
je 0x428c22
inc ecx
cmp ecx, eax
jl 0x428c07
xor eax, eax
mov word [ebp + ebx*2 + 0xfd4], ax
lea eax, [ebp + 0xfd4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x428c54
mov eax, dword [ebp - 0x78]
mov ecx, dword [esi + 0x84]
sub edi, eax
push edi
lea eax, [ebp + eax*2 + 0xfd4]
call fcn.00440c1b
pop ecx
mov dword [ebp - 0x78], eax
pop ebx
cmp dword [ebp - 0x78], 0
pop edi
je 0x428c75
call fcn.0042a46d
test eax, eax
je 0x428c75
mov ecx, dword [eax]
lea edx, [ebp + 0xfd4]
push edx
push eax
call dword [ecx + 0x18]
mov ecx, dword [ebp + 0x201c]
xor ecx, ebp
xor eax, eax
pop esi
call fcn.0044552e
add ebp, 0x2020
leave
ret 4
Function at 0x42924d
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, eax
mov eax, 0x8082
push edi
lea ecx, [eax + 2]
cmp ax, dx
je 0x4292a0
cmp cx, dx
je 0x4292a0
add eax, 0x1c
cmp ax, dx
jne 0x429281
xor edi, edi
push edi
push edi
push edi
push edi
lea eax, [esi + 0xc]
mov ecx, dword [eax]
push 0xd4
push eax
call dword [ecx + 0xc]
jmp 0x429300
mov esi, dword [esi + 0x38]
movzx eax, dx
push 0
push eax
mov eax, dword [esi]
push 0x111
push esi
call dword [eax + 0x3c]
push dword [eax + 0x6c]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x429300
xor edi, edi
cmp word [esi + 0x60], di
je 0x4292fa
push ebx
xor ebx, ebx
cmp cx, dx
sete bl
shl ebx, 4
xor ebx, dword [esi + 0x7c]
and ebx, 0x10
xor dword [esi + 0x7c], ebx
pop ebx
cmp ax, dx
jne 0x4292d4
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4292d4
or dword [esi + 0x7c], 0x10
movzx eax, word [esi + 0x60]
push edi
push eax
push 0x111
push dword [esi + 0x28]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esi + 0x38]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x3c]
push dword [eax + 0x6c]
call dword [sym.imp.USER32.dll_SetFocus]
push edi
call fcn.0042a61b
pop edi
xor eax, eax
pop esi
ret
Function at 0x429305
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10a0
call fcn.00446050
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, ecx
xor eax, eax
test byte [esi + 0x7c], 2
push edi
mov word [ebp - 0x1054], ax
jne 0x429345
push 0x824
lea eax, [ebp - 0x1054]
push eax
push dword [esi + 0x4c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
movzx eax, word [ebp + 8]
cmp eax, 0x93ff
jg 0x429404
cmp eax, 0x9000
jl 0x429404
or dword [ebp - 0x106c], 0xffffffff
and dword [ebp - 0x1060], 0
push 3
mov dword [ebp - 0x1084], eax
pop ecx
mov word [ebp - 0x108c], cx
mov eax, 0x4000
mov ecx, eax
mov word [ebp - 0x107c], cx
mov word [ebp - 0x109c], ax
lea eax, [ebp - 0x106c]
lea ecx, [ebp - 0x1054]
mov dword [ebp - 0x1074], ecx
mov dword [ebp - 0x1094], eax
mov eax, dword [esi + 0x7c]
mov ecx, eax
shr ecx, 8
and ecx, 7
mov dword [ebp - 0x1064], 0x449aa0
je 0x4293cc
or edx, 0xffffffff
sub edx, ecx
mov dword [ebp - 0x106c], edx
shr eax, 5
and eax, 7
mov dword [ebp - 0x1068], eax
push 0
lea eax, [ebp - 0x109c]
push eax
lea eax, [ebp - 0x107c]
push eax
lea eax, [ebp - 0x108c]
push eax
mov eax, dword [esi + 0x38]
push 0x60000013
call fcn.00414878
add esp, 0x14
jmp 0x429536
mov eax, dword [esi + 0x7c]
and dword [ebp - 0x1058], 0
mov edi, dword [esi + 0x38]
test al, 0x20
je 0x42941b
or eax, 0x10
mov dword [esi + 0x7c], eax
mov eax, dword [esi + 0x7c]
test al, 0x10
je 0x429454
mov edx, eax
shr edx, 6
and edx, 3
je 0x42942e
add edx, edx
shr eax, 8
or ecx, 0xffffffff
and eax, 7
je 0x42943d
or ecx, ecx
sub ecx, eax
mov eax, dword [edi]
lea ebx, [ebp - 0x1058]
push ebx
push 0
push edx
push ecx
push edi
call dword [eax + 0x18]
and dword [esi + 0x7c], 0xffffffef
jmp 0x429461
mov eax, dword [edi]
lea ecx, [ebp - 0x1058]
push ecx
push edi
call dword [eax + 0x28]
xor ebx, ebx
cmp dword [ebp - 0x1058], ebx
je 0x429509
push 3
pop eax
mov word [ebp - 0x107c], ax
movzx eax, word [ebp + 8]
xor edi, edi
mov dword [ebp - 0x1074], eax
cmp word [ebp - 0x1054], bx
je 0x4294b1
lea eax, [ebp - 0x1054]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
push 8
pop ecx
mov word [ebp - 0x106c], cx
mov dword [ebp - 0x1064], eax
lea edi, [ebp - 0x106c]
mov eax, dword [esi + 0x80]
test eax, eax
je 0x4294d1
push 8
pop ecx
mov word [ebp - 0x108c], cx
mov dword [ebp - 0x1084], eax
lea ebx, [ebp - 0x108c]
mov eax, dword [ebp - 0x1058]
mov ecx, dword [eax]
push 0
push ebx
push edi
lea edx, [ebp - 0x107c]
push edx
push 0xab
push eax
call dword [ecx + 0xc]
test edi, edi
je 0x4294fd
push dword [ebp - 0x1064]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x1058]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test dword [esi + 0x7c], 0x200000
je 0x429536
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esi + 0x4c]
cmp eax, ecx
jne 0x42952d
push 0x449aa0
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x429536
or dword [esi + 0x7c], 2
call fcn.0042a291
push 0
call fcn.0042a61b
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0044552e
leave
ret 4
Function at 0x42e9b2
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
mov ebx, ecx
push dword [ebx + 0xc]
push 0x419
push dword [ebx]
call edi
mov dword [ebp - 0x20], eax
cmp eax, 0xffffffff
je 0x42ea59
push eax
push dword [ebx]
call fcn.00443224
pop ecx
pop ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x2c]
mov ecx, dword [eax]
push 0
push eax
call dword [ecx + 0x3c]
mov ecx, dword [esi + 0x2c]
mov edx, eax
call fcn.0041f409
pop ecx
test eax, eax
jne 0x42ea3c
mov eax, dword [0x450820]
cmp eax, 0xffffffff
je 0x42ea3c
cmp eax, dword [ebp - 0x20]
je 0x42ea3c
lea ecx, [ebp - 0x18]
push ecx
push eax
push 0x417
push dword [ebx]
call edi
test eax, eax
je 0x42ea3c
push 0
push dword [ebp - 0x14]
push 0x8050
push dword [ebx]
call dword [sym.imp.USER32.dll_PostMessageW]
cmp dword [ebp - 0x1c], 0
je 0x42ea59
push dword [ebp - 0x1c]
and dword [0x45081c], 0
or dword [0x450820], 0xffffffff
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0044552e
leave
ret

Function at 0x43070f
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp + 8]
mov esi, ecx
call fcn.0043068f
mov ebx, eax
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x20], eax
mov edi, 0x400000
cmp ebx, 0xffffffff
je 0x430783
test dword [ebp - 0x1c], edi
je 0x430783
mov ecx, dword [esi + 0x18]
and ecx, edi
cmp dword [ebp - 0x1c], ecx
je 0x4307c6
push 0
push dword [esi + 0xb0]
push 0x419
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, ebx
jne 0x4307c6
mov eax, dword [esi + 0x18]
mov ecx, eax
and ecx, edi
cmp dword [ebp - 0x1c], ecx
je 0x4307c6
cmp dword [ebp - 0x1c], 0
je 0x43078a
or eax, edi
jmp 0x43078f
mov eax, dword [esi + 0x18]
test edi, eax
je 0x4307c6
and eax, 0xffbfffff
mov dword [esi + 0x18], eax
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0xb0]
push 0x433
push dword [ebp - 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x4307c6
push 0
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.USER32.dll_InvalidateRect]
push dword [ebp - 0x20]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044552e
leave
ret 4
Function at 0x430e9c
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x48]
mov ecx, dword [eax]
push edi
push eax
mov ebx, edx
call dword [ecx + 0x3c]
test byte [eax + 0x6a], 1
je 0x430ed7
xor edi, edi
push edi
push edi
push ebx
push dword [esi + 0x20]
call fcn.00405f29
add esp, 0x10
jmp 0x430fa2
movzx eax, byte [esi + 0xe0]
push eax
lea eax, [esi + 0x2c]
call fcn.00430455
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0x20]
xor edi, edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], edi
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0x14]
push eax
push ebx
lea ebx, [ebp - 0x40]
call fcn.00421168
movzx ebx, byte [esi + 0x8a]
push edi
push edi
push edi
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
push dword [esi + 0x50]
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.COMCTL32.dll_ImageList_Draw]
mov esi, dword [sym.imp.GDI32.dll_BitBlt]
mov dword [ebp - 0x18], ebx
cmp ebx, dword [ebp - 0xc]
jge 0x430f64
push 0xcc0020
push edi
push edi
push dword [ebp - 0x20]
push ebx
push dword [ebp - 0x1c]
push edi
push dword [ebp - 0x18]
push dword [ebp - 0x20]
call esi
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x18], eax
add eax, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0xc]
jl 0x430f3a
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], eax
cmp ebx, eax
jge 0x430f9a
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push 0xcc0020
push edi
push edi
push dword [ebp - 0x20]
push ebx
push eax
push dword [ebp - 0x18]
push edi
push dword [ebp - 0x20]
call esi
add dword [ebp - 0x18], ebx
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x1c]
jl 0x430f74
lea esi, [ebp - 0x40]
call fcn.0042111e
mov ecx, dword [ebp - 4]
pop edi
xor eax, eax
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.0044552e
leave
ret
Function at 0x4313df
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
and dword [ebp - 0x28], 0
push ebx
mov ebx, dword [esi + 0x40]
push edi
xor eax, eax
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [esi + 0x48]
mov ecx, dword [eax]
push eax
mov byte [ebp - 0x59], 0
call dword [ecx + 0x3c]
movzx eax, word [eax + 0x2e]
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esi + 0x10c]
test eax, eax
je 0x43144f
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x43144f
lea eax, [ebp - 0x28]
push eax
push dword [esi + 0x10c]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x20]
add dword [ebp - 0x10], eax
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x418
push ebx
call edi
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x64], eax
imul eax, dword [ebp - 0x60]
mov edx, ecx
sub edx, dword [ebp - 0x18]
cmp eax, edx
jge 0x431482
xor eax, eax
mov word [esi + 0xe4], ax
jmp 0x43152d
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 8]
push 0x433
push ebx
call edi
push 2
lea eax, [ebp - 0x38]
push eax
push 0
push ebx
call dword [sym.imp.USER32.dll_MapWindowPoints]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.USER32.dll_IntersectRect]
push 0
push dword [ebp + 8]
mov dword [ebp - 0x68], eax
push 0x419
push ebx
call edi
cmp dword [ebp - 0x68], 0
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x38]
je 0x431509
cmp dword [ebp - 0x58], ecx
jne 0x431509
cmp dword [ebp - 0x50], edx
jne 0x431509
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp - 0x64]
dec eax
push eax
push 0x41d
push ebx
call edi
push 2
lea eax, [ebp - 0x48]
push eax
push 0
push ebx
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov ecx, dword [ebp - 0x10]
mov eax, ecx
sub eax, dword [ebp - 0x40]
js 0x431550
mov eax, ecx
sub eax, dword [ebp - 0x40]
jmp 0x431526
cmp ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
jge 0x431522
mov edx, dword [ebp - 0x60]
imul edx, eax
neg edx
mov word [esi + 0xe4], dx
jmp 0x43152d
mov eax, ecx
sub eax, edx
add word [esi + 0xe4], ax
sub ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x28]
sub eax, dword [ebp - 0x14]
add ecx, dword [ebp - 0x20]
or dword [esi + 0x44], 0x80000
push eax
push ecx
mov ecx, esi
mov byte [ebp - 0x59], 1
call fcn.00431563
mov ecx, dword [ebp - 8]
mov al, byte [ebp - 0x59]
pop edi
xor ecx, ebp
pop ebx
call fcn.0044552e
leave
ret 4
Function at 0x432221
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2114
call fcn.00446050
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x20b0], eax
mov eax, dword [ebp + 0x10]
push edi
lea ecx, [ebp - 0x20a0]
mov dword [ebp - 0x20a4], eax
mov eax, dword [ebp + 0x14]
push ecx
push 0x44b0f8
mov dword [ebp - 0x20a8], eax
mov eax, dword [esi]
push esi
mov dword [ebp - 0x20ac], esi
call dword [eax]
test eax, eax
js 0x432459
lea eax, [ebp - 0x20c8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push 6
push str.Atalic
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov ecx, dword [esi]
lea edx, [ebp - 0x20c8]
push edx
push 1
push eax
push esi
mov dword [ebp - 0x20b4], eax
call dword [ecx + 0x20]
test eax, eax
js 0x432441
cmp word [ebp - 0x20c8], 3
jne 0x432434
cmp dword [ebp - 0x20c0], 0x8001
jne 0x432434
mov eax, dword [ebp - 0x20a0]
lea edx, [ebp - 0x209c]
xor esi, esi
push edx
mov dword [ebp - 0x209c], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
mov ecx, dword [ebp - 0x209c]
cmp dword [ebp - 0x209c], esi
jne 0x4322fb
mov ecx, 0x449aa0
mov edi, 0x824
push edi
lea eax, [ebp - 0x2098]
call fcn.00440c1b
pop ecx
push dword [ebp - 0x209c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 0x38
lea eax, [ebp - 0x2110]
push esi
push eax
call fcn.004432d0
add esp, 0xc
push 0x3c
pop ebx
lea eax, [ebp - 0x2114]
push eax
push esi
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCrackUrlW]
lea eax, [ebp - 0x2098]
push eax
mov dword [ebp - 0x2114], ebx
mov dword [ebp - 0x20dc], 1
call esi
mov eax, dword [ebp - 0x20e0]
test eax, eax
je 0x432365
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebp + 0xc]
push edi
lea eax, [ebp - 0x1050]
call fcn.00440c1b
push ebx
xor edi, edi
lea eax, [ebp - 0x2114]
push edi
push eax
call fcn.004432d0
add esp, 0x10
lea eax, [ebp - 0x2114]
push eax
mov dword [ebp - 0x2114], ebx
push edi
xor ebx, ebx
push edi
lea eax, [ebp - 0x1050]
inc ebx
push eax
mov dword [ebp - 0x20dc], ebx
call esi
mov eax, dword [ebp - 0x20e0]
cmp eax, edi
je 0x4323b7
xor ecx, ecx
mov word [eax], cx
push ebx
lea eax, [ebp - 0x2098]
push eax
lea eax, [ebp - 0x1050]
push eax
call dword [sym.imp.SHLWAPI.dll_UrlCompareW]
test eax, eax
jne 0x432441
call dword [sym.imp.USER32.dll_GetFocus]
cmp dword [ebp - 0x20a4], eax
je 0x4323ef
push eax
push dword [ebp - 0x20a4]
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x432441
push 9
pop eax
mov word [ebp - 0x20d8], ax
mov eax, dword [ebp - 0x20ac]
push edi
push edi
mov dword [ebp - 0x20d0], eax
push edi
lea eax, [ebp - 0x20d8]
push eax
mov eax, dword [ebp - 0x20b0]
push 0x60000007
call fcn.00414878
add esp, 0x14
test eax, eax
je 0x432441
mov ecx, dword [ebp - 0x20a8]
or eax, 0xffffffff
mov word [ecx], ax
jmp 0x432441
lea eax, [ebp - 0x20c8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
push dword [ebp - 0x20b4]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x20a0]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044552e
leave
ret
Function at 0x432e7f
Capabilities:
Read file via mapping

Disassembly:
push ebx
push edi
xor edi, edi
push edi
push 4
push esi
mov ebx, 0x80004005
mov dword [esi], edi
mov dword [esi + 4], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
push dword [esp + 0x1c]
push dword [esp + 0x24]
call fcn.00422f82
add esp, 0x18
test eax, eax
je 0x432ec2
push edi
push edi
push edi
push 4
push dword [esi]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 4], eax
cmp eax, edi
je 0x432ec2
xor ebx, ebx
pop edi
mov eax, ebx
pop ebx
ret

Function at 0x432fc1
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push 0x38
lea eax, [ebp - 0x38]
push 0
push eax
call fcn.004432d0
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
push 0
push dword [ebp + 0xc]
xor esi, esi
push dword [ebp + 8]
inc esi
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0xc], esi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x433036
mov eax, dword [ebp - 0x30]
cmp eax, 0xffffffff
jne 0x433007
mov eax, esi
jmp 0x433038
cmp eax, 5
jne 0x433014
cmp dword [ebp - 0xc], 4
ja 0x433036
jmp 0x433003
cmp eax, 3
je 0x433022
cmp eax, 4
je 0x433022
cmp eax, esi
jne 0x433036
cmp dword [ebp - 0xc], esi
jne 0x433036
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x433036
push 0x2f
pop ecx
cmp cx, word [eax]
je 0x433003
xor eax, eax
pop esi
leave
ret
Function at 0x434abe
Capabilities:
Check if file exists

Disassembly:
push ebp
lea ebp, [esp - 0x5a4]
sub esp, 0x624
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp + 0x5a0], eax
mov eax, dword [ebp + 0x5ac]
push 0x61
mov dword [ebp - 0x80], edx
pop edx
mov byte [ebp - 0x79], 0
cmp dx, word [eax]
jne 0x434c2b
push 0x62
pop edx
cmp dx, word [eax + 2]
jne 0x434c2b
push 0x6f
pop edx
cmp dx, word [eax + 4]
jne 0x434c2b
push 0x75
pop edx
cmp dx, word [eax + 6]
jne 0x434c2b
push 0x74
pop edx
cmp dx, word [eax + 8]
jne 0x434c2b
push 0x3a
pop edx
cmp dx, word [eax + 0xa]
jne 0x434c2b
push ebx
push esi
push edi
mov esi, 0x104
lea ecx, [eax + 0xc]
push esi
lea eax, [ebp + 0x190]
call fcn.00440c1b
lea eax, [ebp + 0x190]
mov dword [esp], str..html
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddExtensionW]
push esi
lea eax, [ebp - 0x78]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.settingcustomize
lea ecx, [ebp - 0x78]
lea esi, [ebp + 0x398]
call fcn.00442350
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
pop ecx
lea eax, [ebp + 0x190]
push eax
mov eax, esi
push eax
call ebx
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov eax, esi
push eax
call edi
test eax, eax
jne 0x434c02
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor ecx, ecx
mov word [ebp + eax*2 + 0x396], cx
mov eax, esi
push eax
call edi
test eax, eax
jne 0x434c02
push str.resource
lea ecx, [ebp - 0x78]
call fcn.00442350
pop ecx
lea eax, [ebp + 0x190]
push eax
mov eax, esi
push eax
call ebx
mov eax, esi
push eax
call edi
test eax, eax
jne 0x434c02
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor ecx, ecx
mov word [ebp + eax*2 + 0x396], cx
mov eax, esi
push eax
call edi
test eax, eax
jne 0x434c02
mov word [ebp + 0x398], ax
cmp word [ebp + 0x398], 0
pop edi
pop esi
pop ebx
je 0x434c3f
cmp dword [ebp - 0x80], 0
mov byte [ebp - 0x79], 1
je 0x434c3f
lea eax, [ebp + 0x398]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x434c3f
test ecx, ecx
je 0x434c3f
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x434c3f
mov byte [ebp - 0x79], 1
mov ecx, dword [ebp + 0x5a0]
mov al, byte [ebp - 0x79]
xor ecx, ebp
call fcn.0044552e
add ebp, 0x5a4
leave
ret
Function at 0x43a90d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
test byte [ebp + 8], 1
push esi
push edi
mov edi, eax
je 0x43a960
mov eax, dword [edi + 0x1e4]
lea esi, [ebx + 0x18]
test eax, eax
je 0x43a934
push eax
call fcn.004429de
pop ecx
mov dword [esi], eax
jmp 0x43a941
mov eax, dword [edi + 0x94]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x78]
cmp dword [esi], 0
jne 0x43a950
mov eax, 0x80004005
jmp 0x43aaf5
mov eax, dword [edi + 0x94]
mov ecx, dword [eax]
lea edx, [ebx + 0x14]
push edx
push eax
call dword [ecx + 0x74]
mov eax, dword [edi + 0x88]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x3c]
test byte [ebp + 8], 2
mov dword [ebp - 8], eax
je 0x43a9d4
test byte [ebp + 8], 4
movzx esi, word [eax + 0x88]
je 0x43a987
mov esi, SysReAllocString
mov eax, dword [edi + 0x44]
test al, 6
je 0x43a9a2
push esi
push eax
push dword [edi + 0x94]
mov eax, ebx
call fcn.004335c3
add esp, 0xc
jmp 0x43a9d4
mov eax, dword [edi + 0x1c4]
test eax, eax
je 0x43a9bc
lea ecx, [ebx + 0x1c]
push ecx
push eax
mov eax, esi
call fcn.00406aa2
pop ecx
pop ecx
sub esi, eax
mov eax, dword [edi + 0x1c8]
test eax, eax
je 0x43a9d4
lea ecx, [ebx + 0x20]
push ecx
push eax
mov eax, esi
call fcn.00406aa2
pop ecx
pop ecx
push 8
push dword [edi + 0x40]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [edi + 0x68]
mov esi, eax
call fcn.0040706b
test byte [ebp + 8], 0x10
pop ecx
je 0x43aa0a
mov dword [ebx + 0x24], esi
test eax, 0x80000
je 0x43aa03
or dword [ebx + 4], 0x100
jmp 0x43aa0a
or dword [ebx + 4], 0x200
test byte [ebp + 8], 8
je 0x43aa33
mov ecx, dword [edi + 0x1ec]
test ecx, ecx
je 0x43aa1d
mov dword [ebx + 0x28], ecx
test eax, 0x20000
je 0x43aa28
or dword [ebx + 4], 0x10
test eax, 0x40000
je 0x43aa33
or dword [ebx + 4], 0x20
test byte [ebp + 8], 0x40
je 0x43aa72
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov eax, dword [edi + 0x94]
push str._D_3
call fcn.00411043
mov esi, dword [ebp - 4]
pop ecx
pop ecx
test esi, esi
je 0x43aa72
lea eax, [ebx + 0x34]
push eax
lea eax, [ebx + 0x30]
push eax
call fcn.00411385
mov eax, dword [ebp - 4]
pop ecx
pop ecx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
test byte [ebp + 8], 0x20
jne 0x43aa87
mov eax, dword [ebp - 8]
test dword [eax + 0xa8], 0x200
je 0x43aab5
push 2
lea eax, [ebp + 8]
push eax
push 0x44d08c
push 0x190
mov ecx, edi
call fcn.0043a053
test eax, eax
jne 0x43aab5
mov esi, dword [ebp + 8]
push ebx
call fcn.004060f0
mov eax, dword [ebp + 8]
pop ecx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp byte [ebp + 0xc], 0
je 0x43aaf3
test dword [edi + 0x44], 0x8000000
je 0x43aaf3
mov eax, edi
call fcn.00439904
test al, al
je 0x43aaf3
call dword [sym.imp.USER32.dll_GetFocus]
test eax, eax
je 0x43aaf3
mov edi, dword [edi + 0x40]
cmp edi, eax
je 0x43aaec
push eax
push edi
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x43aaf3
or dword [ebx + 4], 0x200000
xor eax, eax
pop edi
pop esi
leave
ret 8