joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b120
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0
push 0
push 3
push 0
push 0
push 0
push dword [ebp + 8]
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, dword [ebp + 0xc]
mov edi, eax
cmp edi, 0xffffffff
je 0x43b166
lea eax, [esi + 8]
push eax
lea eax, [esi + 0x10]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileTime]
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp dword [ebp - 4], 0
pop edi
mov dword [esi + 0x18], eax
pop esi
je 0x43b188
cmp eax, 0xffffffff
je 0x43b188
mov eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x43b370
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50eca8
mov eax, dword fs:[0]
push eax
push ecx
push edi
mov eax, dword [0x55e2f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x56abe4], 0
mov dword [ebp - 4], 0
jne 0x43b421
cmp dword [0x56abe8], 0
jne 0x43b421
movups xmm0, xmmword [ebp + 0x18]
mov eax, dword [ebp + 0x30]
mov ecx, 0x56abb8
mov dword [0x56abdc], eax
lea eax, [ebp + 0xc]
movups xmmword [0x56abc4], xmm0
push eax
movq xmm0, qword [ebp + 0x28]
movq qword [0x56abd4], xmm0
call fcn.00438e10
mov dword [0x56abe0], 0
mov dword [0x56abe4], 0
mov dword [0x56abe8], 1
mov dword [0x564274], 0x51d7c4
call fcn.00420eb0
push dword [ebp + 8]
push 0
push 0x43b480
call fcn.004f1e00
add esp, 0xc
mov edi, 1
jmp 0x43b423
xor edi, edi
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x43b460
push dword [ebp - 0x10]
lea ecx, [ebp + 0xc]
push ecx
push dword [ebp + 0x10]
push eax
call fcn.00403d30
mov ecx, dword [ebp + 0x14]
mov eax, 0x2aaaaaab
sub ecx, dword [ebp + 0xc]
add esp, 0x10
imul ecx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.00405300
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x43b5d0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x43b5fb
pop esi
xor eax, eax
pop ebx
pop ebp
ret
push edi
mov edi, dword [ebp + 0xc]
lea eax, [edi + 8]
push eax
lea eax, [edi + 0x10]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_SetFileTime]
push esi
test eax, eax
jne 0x43b621
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
mov edx, eax
cmp edx, 0xffffffff
je 0x43b61a
mov ecx, dword [edi + 0x18]
or eax, 1
and edx, 0xfffffffe
test cl, 1
cmovne edx, eax
mov eax, edx
and edx, 0xfffffffd
or eax, 2
test cl, 2
cmovne edx, eax
mov eax, edx
and edx, 0xfffffffb
or eax, 4
test cl, 4
cmovne edx, eax
mov eax, edx
and edx, 0xffffffdf
or eax, 0x20
test cl, 0x20
cmovne edx, eax
push edx
push ebx
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
neg eax
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
pop ebp
ret

Function at 0x43bf90
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
lea eax, [ebp - 0x808]
push 0x400
push eax
push 0x40a
mov eax, dword [esi]
call dword [eax + 0x8c]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x808]
push eax
call fcn.0042a830
lea eax, [ebp - 0x808]
push eax
call fcn.0042ad90
add esp, 8
test eax, eax
jne 0x43bff6
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x808]
push eax
call fcn.00427e90
add esp, 4
mov ecx, esi
push eax
mov eax, dword [esi]
push 0x552
call dword [eax + 0x8c]
push eax
mov eax, dword [esi]
mov ecx, esi
push 0x536
call dword [eax + 0x8c]
push eax
call fcn.00405d30
mov ecx, eax
add esp, 0xc
and ecx, edx
cmp ecx, 0xffffffff
je 0x43bfe5
test edx, edx
jg 0x43c044
jl 0x43bfe5
cmp eax, 0xa000
jb 0x43bfe5
cmp edx, dword [esi + 0x3c]
jl 0x43c050
jg 0x43bfe5
cmp eax, dword [esi + 0x38]
ja 0x43bfe5
push dword [esi + 0x844]
mov dword [esi + 0x30], eax
mov ecx, esi
mov eax, dword [esi]
push 0x3ea
mov dword [esi + 0x34], edx
call dword [eax + 0x8c]
push eax
mov eax, dword [esi]
mov ecx, esi
push 0x40b
call dword [eax + 0x8c]
push eax
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 0x8c]
push eax
call fcn.004bd7d0
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
pop esi
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
Function at 0x442150
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50ef38
mov eax, dword fs:[0]
push eax
mov eax, 0x1008
call fcn.004e1f60
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x442197
mov eax, dword [eax]
lea ecx, [ebp - 0x1010]
push ecx
push eax
call fcn.0041ecd0
lea eax, [ebp - 0x1010]
push 0x2e
push eax
call fcn.004e3c44
add esp, 0x10
test eax, eax
je 0x4421be
xor ecx, ecx
mov word [eax], cx
xor ecx, ecx
movzx eax, word [ebp + ecx - 0x1010]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x812], ax
test ax, ax
jne 0x4421c0
lea ecx, [ebp - 0x810]
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x4421e1
mov eax, dword [str..ccx]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [ecx], eax
mov eax, dword [0x51e228]
mov dword [ecx + 4], eax
mov ax, word [0x51e22c]
mov word [ecx + 8], ax
lea eax, [ebp - 0x810]
push eax
call ebx
test eax, eax
je 0x44224a
mov esi, 1
nop
push esi
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x810]
push str._s__d_.ccx
push eax
call fcn.004054c0
add esp, 0x10
lea eax, [ebp - 0x810]
inc esi
push eax
call ebx
test eax, eax
jne 0x442220
lea ecx, [ebp - 0x810]
mov eax, ecx
sub edi, eax
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edi + ecx - 2], ax
test ax, ax
jne 0x442254
mov eax, dword [ebp + 8]
test eax, eax
je 0x4422a4
push dword [ebp - 0x1014]
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 0xc]
push eax
call fcn.00403d30
mov ecx, dword [ebp + 0x10]
mov eax, 0x2aaaaaab
mov esi, dword [ebp + 8]
add esp, 0x10
sub ecx, esi
imul ecx
lea ecx, [ebp + 8]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push esi
call fcn.00405300
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret 0x10
Function at 0x444210
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.004e1f60
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x56b474]
push ebx
mov ebx, ecx
test eax, eax
je 0x444259
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x56b474]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [ebx]
mov ecx, ebx
push 2
call dword [eax + 0xf4]
jmp 0x444433
mov eax, dword [ebx + 0x10]
push esi
lea esi, [ebx + 0x48]
mov dword [0x56b474], eax
mov dword [esi], 0
cmp dword [0x5685fc], 0
jne 0x444287
mov eax, dword [ebx + 0x10]
mov dword [0x5685fc], eax
push dword [ebx + 0x10]
call fcn.00421790
add esp, 4
push edi
push str.IDD_DISKTRACE_ERASE
push dword [ebx + 0x10]
call fcn.004bc030
push str.INFO_DISKTRACE_ERASE
call fcn.004bb8b0
add esp, 0xc
push eax
push str.TITLE_DISKTRACE_ERASE
call fcn.004bb8b0
add esp, 4
mov ecx, ebx
push eax
push 0x1f5
call fcn.00423c00
mov ecx, ebx
call fcn.00444740
push 1
push dword [ebx + 0x10]
call dword [sym.imp.SHELL32.dll_DragAcceptFiles]
mov eax, dword [ebx]
mov ecx, ebx
push 0
push 0
push 0x5cd
mov dword [esi], 0x64
call dword [eax + 0x8c]
push eax
call fcn.0045da70
mov eax, dword [ebx]
add esp, 0xc
mov ecx, ebx
push esi
push 0x5cd
call dword [eax + 0x8c]
push eax
call fcn.004066d0
lea eax, [ebp - 0x808]
push eax
push 0
push 0
call fcn.00416440
lea edi, [ebp - 0x808]
add esp, 0x14
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x444323
mov eax, dword [0x5170a0]
mov dword [edi], eax
lea eax, [ebp - 0x808]
push eax
push str.IDT_RUN_TIME
call fcn.004bb8b0
add esp, 4
push eax
lea eax, [ebp - 0x100c]
push eax
call fcn.004054c0
add esp, 0xc
lea eax, [ebp - 0x100c]
mov ecx, ebx
push eax
mov eax, dword [ebx]
push 0x5ef
call dword [eax + 0x8c]
mov esi, dword [sym.imp.USER32.dll_SetWindowTextW]
push eax
call esi
push str.WIPE
call fcn.004bb8b0
add esp, 4
mov ecx, ebx
push eax
mov eax, dword [ebx]
push 1
call dword [eax + 0x8c]
push eax
call esi
call sub.SHELL32.dll_IsUserAnAdmin
pop edi
test eax, eax
jne 0x4443a9
call fcn.0041c240
test eax, eax
jne 0x4443c1
mov eax, dword [ebx]
mov ecx, ebx
push 0
push 0x5f3
call dword [eax + 0x8c]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebx + 0x38]
push eax
push dword [ebx + 0x44]
call fcn.00416dd0
add esp, 8
test eax, eax
je 0x4443f3
push ebx
push 0x442de0
push str.WAIT_PROCESS_INFO
call fcn.004bb8b0
add esp, 4
push eax
push dword [ebx + 0x10]
call fcn.0040e610
add esp, 0x10
push 1
mov ecx, ebx
call fcn.00443760
mov eax, dword [ebx]
mov ecx, ebx
push 0x5e6
call dword [eax + 0x8c]
push 3
push 0
push 0
push 0
push 0
mov esi, eax
push 1
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
push 1
push 0
push esi
call dword [sym.imp.USER32.dll_InvalidateRect]
push esi
call dword [sym.imp.USER32.dll_SetFocus]
pop esi
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop ebx
call fcn.004e1f40
mov esp, ebp
pop ebp
ret 4
Function at 0x444740
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ecx]
push ebx
push esi
push edi
push 0x5e6
call dword [eax + 0x8c]
push 0x30
push 0
mov ebx, eax
push 0x1036
push ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0x14f
push str.PATH
push 0
push ebx
call fcn.004063a0
push 1
push 0x37
push str.SIZE
push 1
push ebx
call fcn.004063a0
push 2
push 0x56
push str.LIST_STATE
push 2
push ebx
call fcn.004063a0
add esp, 0x3c
push 2
push 2
push 0x20
push 0x10
push 0x10
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
push 0x3e6
push dword [0x568608]
mov edi, eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov esi, eax
test esi, esi
je 0x4447e5
mov ebx, dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
push esi
push 0xffffffffffffffff
push edi
call ebx
push esi
cmp eax, 0xffffffff
jne 0x4447ee
call dword [sym.imp.GDI32.dll_DeleteObject]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
call esi
push 0x3e5
push dword [0x568608]
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 4], eax
test eax, eax
je 0x4447e5
push eax
push 0xffffffffffffffff
push edi
call ebx
push dword [ebp - 4]
cmp eax, 0xffffffff
jne 0x444827
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call esi
push 0x3e7
push dword [0x568608]
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 4], eax
test eax, eax
je 0x4447e5
push eax
push 0xffffffffffffffff
push edi
call ebx
push dword [ebp - 4]
cmp eax, 0xffffffff
je 0x44481c
call esi
push 0x3e4
push dword [0x568608]
call dword [sym.imp.USER32.dll_LoadIconW]
mov ebx, eax
test ebx, ebx
je 0x4447e5
push ebx
push 0xffffffffffffffff
push edi
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
push ebx
cmp eax, 0xffffffff
je 0x44481c
call esi
mov esi, dword [ebp - 8]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push edi
push 0
push 0x1003
push esi
call ebx
push edi
push 1
push 0x1003
push esi
call ebx
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x450990
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00405570
push 0
push str.SaveVolumeHistory
call fcn.00405640
add esp, 8
mov dword [0x559304], eax
test eax, eax
jne 0x4509c5
call fcn.004188c0
mov eax, dword [0x55934c]
cmp eax, 0xe
je 0x4509de
cmp eax, 0x2d
je 0x4509de
call fcn.00418ac0
jmp 0x450a5e
push esi
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
lea eax, [ebp - 0x808]
push 0x400
push eax
push 0x40a
push dword [0x56aba4]
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
call fcn.00418ac0
push 0x40a
push dword [0x56aba4]
call esi
push eax
call fcn.00418de0
add esp, 4
lea eax, [ebp - 0x808]
push eax
push 0x40a
push dword [0x56aba4]
call esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
xor eax, eax
cmp dword [0x559304], eax
sete al
push eax
push 0x3ee
push dword [0x56aba4]
call esi
push eax
call fcn.00405b70
add esp, 8
pop esi
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret 8
Function at 0x451800
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.004e1f60
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
call fcn.00466b80
test eax, eax
je 0x451a63
push esi
push edi
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
cmp eax, 0x409
je 0x451980
cmp eax, 0x4090409
je 0x451980
call fcn.004523e0
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x56bdc0
push 0x40b
push dword [0x56aba4]
call edi
mov esi, dword [sym.imp.USER32.dll_SetWindowTextA]
push eax
call esi
push 0x56be08
push 0x3ea
push dword [0x56aba4]
call edi
push eax
call esi
push 1
push 0x51ee44
call dword [sym.imp.USER32.dll_LoadKeyboardLayoutW]
cmp eax, 0x409
je 0x4518cf
cmp eax, 0x4090409
je 0x4518cf
push 0x104
push ebx
call dword [sym.imp.USER32.dll_KillTimer]
push ebx
push str.CANT_CHANGE_KEYB_LAYOUT_FOR_SYSENC
call fcn.00419a00
push ebx
call fcn.0044f750
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
push str.KEYB_LAYOUT_CHANGE_PREVENTED
mov dword [0x570404], 1
call fcn.004bb8b0
lea edx, [ebp - 0x2004]
add esp, 4
sub edx, eax
nop
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [edx + eax - 2], cx
test cx, cx
jne 0x4518f0
lea ecx, [ebp - 0x2004]
add ecx, 0xfffffffe
nop dword [eax]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x451910
mov eax, dword [0x5171d0]
mov dword [ecx], eax
mov ax, word [0x5171d4]
push str.KEYB_LAYOUT_SYSENC_EXPLANATION
mov word [ecx + 4], ax
call fcn.004bb8b0
mov edx, eax
add esp, 4
mov esi, edx
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x451940
lea edi, [ebp - 0x2004]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x451956
mov ecx, edx
lea eax, [ebp - 0x2004]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.00419d30
add esp, 8
cmp dword [0x570404], 0
je 0x451a61
cmp dword [0x570408], 0
jne 0x451a61
push 0xa5
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x451a61
push str.ALT_KEY_CHARS_NOT_FOR_SYSENC
mov dword [0x570408], 1
call fcn.004bb8b0
lea edx, [ebp - 0x2004]
add esp, 4
sub edx, eax
nop dword [eax]
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [edx + eax - 2], cx
test cx, cx
jne 0x4519d0
lea ecx, [ebp - 0x2004]
add ecx, 0xfffffffe
nop dword [eax]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x4519f0
mov eax, dword [0x5171d0]
mov dword [ecx], eax
mov ax, word [0x5171d4]
push str.KEYB_LAYOUT_SYSENC_EXPLANATION
mov word [ecx + 4], ax
call fcn.004bb8b0
mov edx, eax
add esp, 4
mov esi, edx
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x451a20
lea edi, [ebp - 0x2004]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x451a36
mov ecx, edx
lea eax, [ebp - 0x2004]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.00419b70
add esp, 8
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
Function at 0x451e60
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x56b52c], 0
push edi
mov edi, dword [ebp + 8]
jne 0x451fd3
push ebx
push esi
push edi
call fcn.004503b0
add esp, 4
mov dword [0x559a1c], eax
cmp dword [0x56b550], 0
je 0x451ec8
cmp dword [0x56b540], 0
je 0x451eac
cmp dword [0x56b544], 0
je 0x451ec8
mov ebx, dword [0x56b564]
mov edx, ebx
mov esi, dword [0x56b560]
mov ecx, esi
call fcn.004e23c0
movsd qword [ebp - 0x70], xmm0
jmp 0x451f3e
push 0x31
lea eax, [ebp - 0x68]
push eax
push 0x536
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x68]
push eax
call fcn.00416a70
add esp, 4
test eax, eax
je 0x451f86
push 0x56b570
call fcn.00427e90
mov esi, eax
lea eax, [ebp - 0x68]
push eax
call fcn.004f1575
movd xmm0, dword [0x559a1c]
add esp, 8
cvtdq2pd xmm0, xmm0
push esi
fstp qword [ebp - 0x70]
movsd xmm1, qword [ebp - 0x70]
mulsd xmm0, xmm1
movsd qword [ebp - 0x70], xmm1
call fcn.004e226f
push edx
push eax
call fcn.00415690
add esp, 0xc
mov esi, eax
mov ebx, edx
push ebx
push esi
call fcn.0044ee50
add esp, 8
test eax, eax
je 0x451f86
cmp dword [ebp + 0xc], 0
je 0x451f86
cmp dword [0x56b550], 0
movsd xmm0, qword [ebp - 0x70]
movsd qword [0x56b530], xmm0
je 0x451f7a
cmp dword [0x56b540], 0
je 0x451f86
cmp dword [0x56b544], 0
jne 0x451f86
mov dword [0x56b560], esi
mov dword [0x56b564], ebx
push eax
push 0x5a0
push edi
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [0x56b560]
mov eax, dword [0x56b564]
pop esi
pop ebx
cmp ecx, dword [0x56be78]
jne 0x451fbe
cmp eax, dword [0x56be7c]
je 0x451fd3
mov dword [0x56be4c], 0
mov dword [0x56be78], ecx
mov dword [0x56be7c], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
Function at 0x451ff0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x56b52c], 0
push ebx
mov ebx, dword [ebp + 8]
jne 0x4520c7
push ebx
call fcn.004503b0
add esp, 4
mov dword [0x559a28], eax
lea eax, [ebp - 0x68]
push 0x31
push eax
push 0x536
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x68]
push eax
call fcn.00416a70
add esp, 4
test eax, eax
je 0x4520ac
push esi
push edi
push 0x56b570
call fcn.00427e90
mov esi, eax
lea eax, [ebp - 0x68]
push eax
call fcn.004f1575
movd xmm0, dword [0x559a28]
add esp, 8
cvtdq2pd xmm0, xmm0
push esi
fstp qword [ebp - 0x70]
mulsd xmm0, qword [ebp - 0x70]
call fcn.004e226f
push edx
push eax
call fcn.00415690
mov edi, edx
mov esi, eax
push edi
push esi
call fcn.0044ee00
movsd xmm0, qword [ebp - 0x70]
add esp, 0x14
mov dword [0x559a44], edi
mov dword [0x559a40], esi
movsd qword [0x559a20], xmm0
pop edi
pop esi
push eax
push 0x5a0
push ebx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
Function at 0x4520e0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x56b52c], 0
push ebx
mov ebx, dword [ebp + 8]
jne 0x452241
push esi
push edi
push ebx
call fcn.004503b0
add esp, 4
mov dword [0x559a1c], eax
cmp dword [0x56b540], 0
je 0x4521a1
cmp dword [0x56b544], 0
jne 0x4521a1
push 0x31
lea eax, [ebp - 0x68]
push eax
push 0x536
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x68]
push eax
call fcn.00416a70
add esp, 4
test eax, eax
je 0x4521f4
push 0x56b570
call fcn.00427e90
mov edi, dword [0x559a1c]
mov esi, eax
lea eax, [ebp - 0x68]
push eax
call fcn.004f1575
movd xmm0, edi
add esp, 8
cvtdq2pd xmm0, xmm0
push esi
fstp qword [ebp - 0x70]
movsd xmm1, qword [ebp - 0x70]
mulsd xmm0, xmm1
movsd qword [ebp - 0x70], xmm1
call fcn.004e226f
push edx
push eax
call fcn.00415690
add esp, 0xc
mov esi, eax
mov edi, edx
jmp 0x4521c7
mov esi, dword [0x56be60]
sub esi, dword [0x559a40]
mov edi, dword [0x56be64]
mov ecx, esi
sbb edi, dword [0x559a44]
mov edx, edi
call fcn.004e23c0
movsd qword [ebp - 0x70], xmm0
push edi
push esi
call fcn.0044ee50
add esp, 8
test eax, eax
je 0x4521f4
cmp dword [ebp + 0xc], 0
movsd xmm0, qword [ebp - 0x70]
movsd qword [0x56b530], xmm0
je 0x4521f4
mov dword [0x56b560], esi
mov dword [0x56b564], edi
push eax
push 0x5a0
push ebx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [0x56b560]
mov eax, dword [0x56b564]
pop edi
pop esi
cmp ecx, dword [0x56be80]
jne 0x45222c
cmp eax, dword [0x56be84]
je 0x452241
mov dword [0x56be4c], 0
mov dword [0x56be80], ecx
mov dword [0x56be84], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004e1f40
mov esp, ebp
pop ebp
ret

Function at 0x452920
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x56df48], 0
jne 0x452975
cmp dword [0x56df4c], 0
jne 0x452975
cmp dword [0x56df44], 0
jne 0x452975
push dword [ebp + 8]
mov dword [0x56df44], 0
push 0
mov dword [0x56df4c], 1
push 0x452980
mov dword [0x56df48], 0
call fcn.004f1e00
add esp, 0xc
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x453760
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x55e2f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea esi, [ebp - 0x808]
xor edi, edi
sub esi, ebx
mov eax, ebx
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [esi + eax - 2], cx
test cx, cx
jne 0x453785
push edi
push str._bak__d.bmp
lea eax, [ebp - 0x808]
push str..bmp
push eax
call fcn.0042c560
add esp, 8
push eax
call fcn.004054c0
lea eax, [ebp - 0x808]
inc edi
push eax
call fcn.00414f30
add esp, 0x10
test eax, eax
je 0x4537ce
cmp edi, 0x64
jl 0x453783
push 1
lea eax, [ebp - 0x808]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e1f40
mov esp, ebp
pop ebp
ret
Function at 0x453960
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x56efc0], 0
jne 0x4539b5
cmp dword [0x56efc4], 0
jne 0x4539b5
cmp dword [0x56efbc], 0
jne 0x4539b5
push dword [ebp + 8]
mov dword [0x56efbc], 0
push 0
mov dword [0x56efc4], 1
push 0x453bf0
mov dword [0x56efc0], 0
call fcn.004f1e00
add esp, 0xc
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret