joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409990
Capabilities:
Check mutex on windows

Disassembly:
push ebp
lea ebp, [esp - 0x88]
sub esp, 0x88
push 0xffffffffffffffff
push 0x4bcb6b
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x4e97d0]
xor eax, ebp
mov dword [ebp + 0x84], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [0x4ee52c], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.1830B7BD_F7A3_4c4d_989B_C004DE465EDE
push str._s__u
mov ecx, 0x41
lea ebx, [ebp]
call fcn.004095f0
add esp, 0xc
xor eax, eax
mov word [ebp + 0x80], ax
xor edi, edi
mov ecx, ebx
push ecx
mov ebx, 1
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov dword [ebp - 0x14], esi
test esi, esi
je 0x409acf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x409a35
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], 0
call fcn.00409740
test eax, eax
je 0x409a4c
mov dword [0x4ee52c], eax
jmp 0x409ab0
call fcn.00409fa0
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], bl
test eax, eax
je 0x409a64
push esi
push eax
call fcn.00409de0
jmp 0x409a66
xor eax, eax
mov byte [ebp - 4], 0
mov dword [0x4ee52c], eax
test eax, eax
jne 0x409a84
mov dword [ebp - 0x1c], ebx
push 0x4df5ec
lea edx, [ebp - 0x1c]
push edx
call fcn.00484656
mov edi, ebx
mov dword [ebp - 0x24], edi
push eax
call fcn.00409830
add esp, 4
test eax, eax
jne 0x409aab
mov dword [ebp - 0x18], 3
push 0x4df5ec
lea eax, [ebp - 0x18]
push eax
call fcn.00484656
mov eax, dword [0x4ee52c]
add dword [eax + 0x5bc], ebx
mov dword [ebp - 4], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test edi, edi
jne 0x409acf
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x4ee52c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x84]
xor ecx, ebp
call fcn.00484647
add ebp, 0x88
mov esp, ebp
pop ebp
ret
Function at 0x422765
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4e97d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0xc], 0
or dword [esi + 8], 0xffffffff
test ebx, ebx
jne 0x42278f
xor eax, eax
jmp 0x422854
push edi
call fcn.0041e676
and dword [ebp - 0x10], 0
mov ecx, dword [ebp + 8]
lea edi, [esi + 0x10]
mov dword [ebp - 0x14], 0x12
mov eax, dword [ebp - 0x10]
xor edx, edx
div ebx
inc dword [ebp - 0x10]
mov al, byte [edx + ecx]
mov byte [ebp - 5], al
mov eax, dword [ebp - 0x10]
xor edx, edx
div ebx
inc dword [ebp - 0x10]
mov al, byte [edx + ecx]
mov byte [ebp - 6], al
mov eax, dword [ebp - 0x10]
xor edx, edx
div ebx
inc dword [ebp - 0x10]
mov al, byte [edx + ecx]
mov byte [ebp - 7], al
mov eax, dword [ebp - 0x10]
xor edx, edx
div ebx
inc dword [ebp - 0x10]
mov al, byte [edx + ecx]
mov byte [ebp - 8], al
mov eax, dword [ebp - 8]
xor dword [edi], eax
add edi, 4
dec dword [ebp - 0x14]
jne 0x4227a6
and dword [ebp - 0xc], 0
and dword [ebp - 8], 0
push 9
lea edi, [esi + 0x14]
pop ebx
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00420f04
mov eax, dword [ebp - 0xc]
mov dword [edi - 4], eax
mov eax, dword [ebp - 8]
mov dword [edi], eax
add edi, 8
dec ebx
jne 0x422801
lea edi, [esi + 0x5c]
mov dword [ebp - 0x14], 4
mov ebx, 0x80
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00420f04
mov eax, dword [ebp - 0xc]
mov dword [edi - 4], eax
mov eax, dword [ebp - 8]
mov dword [edi], eax
add edi, 8
dec ebx
jne 0x42282c
dec dword [ebp - 0x14]
jne 0x422827
xor eax, eax
inc eax
mov dword [esi + 0xc], eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00484647
leave
ret 8

Function at 0x4236ec
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x10
mov eax, 0x4b4655
call fcn.00485421
mov esi, ecx
lea ecx, [ebp - 0x14]
call fcn.00421e07
and dword [ebp - 4], 0
mov eax, dword [esi + 0x1414]
push eax
push dword [esi + 0x1410]
lea ecx, [eax + 1]
mov dword [esi + 0x1414], ecx
mov ecx, dword [esi + 0x10c0]
push ecx
lea eax, [ebp - 0x14]
push str._sCabTmp__02X__02X
push eax
call fcn.0041dd06
add esp, 0x14
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x423706
lea ecx, [ebp - 0x1c]
call fcn.00421dea
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.0041dae4
push dword [ebp + 0xc]
lea ecx, [ebp - 0x1c]
push dword [ebp + 8]
call fcn.0041dab8
test eax, eax
jne 0x42379e
lea eax, [esi + 0x109c]
and dword [eax + 0x1c], 0
and dword [eax + 0x20], 0
mov dword [eax + 0x18], 0x3eb
xor esi, esi
push dword [ebp - 0x1c]
call fcn.00485811
push dword [ebp - 0x14]
call fcn.00485811
pop ecx
pop ecx
mov eax, esi
call fcn.004854f9
ret 8
xor esi, esi
inc esi
jmp 0x423782
Function at 0x4395c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
mov eax, dword [0x4e97d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push edi
push 0x4c292c
push eax
call fcn.0048ad5e
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x4395f3
or eax, 0xffffffff
jmp 0x43965e
lea eax, [ebp - 0x45c]
push esi
push eax
call fcn.00402e70
push edi
mov esi, 0x400
push esi
lea eax, [ebp - 0x404]
push 1
push eax
call fcn.0048b2fc
add esp, 0x14
jmp 0x439641
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x45c]
push eax
call fcn.00402ea0
push edi
push esi
lea eax, [ebp - 0x404]
push 1
push eax
call fcn.0048b2fc
add esp, 0x1c
test eax, eax
jne 0x43961a
lea eax, [ebp - 0x45c]
push eax
push ebx
call fcn.00402f40
push edi
call fcn.0048ac1c
add esp, 0xc
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00484647
leave
ret

Function at 0x4396c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x4e97d0]
xor eax, ebp
mov dword [ebp + 0x190], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x78], ax
lea eax, [ebp - 0x76]
push eax
call fcn.00484550
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
push str.IsHideMedalWall
push 0x4c298c
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x80], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x78]
push 0x4c2988
push eax
call fcn.00489a35
pop ecx
neg eax
pop ecx
mov ecx, dword [ebp + 0x190]
sbb eax, eax
xor ecx, ebp
inc eax
call fcn.00484647
add ebp, 0x194
leave
ret

Function at 0x439947
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x4b662f
call fcn.00485421
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.0043985d
test eax, eax
je 0x43996a
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
jmp 0x4399cb
and dword [ebp + 8], 0
push 4
pop eax
push str.360Modularize_
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
call fcn.0040b680
and dword [ebp - 4], 0
add esi, 8
push esi
lea ecx, [ebp - 0x10]
call fcn.0041b65b
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x10]
push 0x4c2a70
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x4399bb
and dword [ebp + 8], 0
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0040dd20
mov eax, esi
call fcn.004854f9
ret 4
Function at 0x439b1b
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x4e97d0]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x14
mov eax, 0x4b6662
call fcn.00485421
xor eax, eax
push 0x206
mov word [ebp], ax
xor esi, esi
xor ebx, ebx
lea eax, [ebp + 2]
push esi
inc ebx
push eax
mov dword [ebp - 0x20], ebx
call fcn.00484550
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x20]
push eax
push str.UninstallString
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall360
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x18], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x439c51
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040b680
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], esi
call fcn.0042695e
push 0x4ccc68
push 0x4c1f8c
lea ecx, [ebp - 0x10]
call fcn.004313a3
push str..exe
lea ecx, [ebp - 0x14]
call fcn.0040b680
push esi
push dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.00418675
cmp eax, esi
mov ecx, dword [ebp - 0x14]
jle 0x439c3e
mov ecx, dword [ecx - 0xc]
add ecx, eax
push ecx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x10]
call fcn.0041a88c
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.0041cb91
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.0040dd20
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x439c3b
push esi
push esi
push ebx
push dword [ebp - 0x10]
call fcn.0040e410
test eax, eax
je 0x439c3b
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0040dd20
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040dd20
xor eax, eax
jmp 0x439c53
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0040dd20
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040dd20
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.00484647
add ebp, 0x20c
leave
ret

Function at 0x439caf
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x4b6692
call fcn.00485421
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.0043985d
test eax, eax
je 0x439cd2
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
jmp 0x439d43
and dword [ebp + 8], 0
push 4
pop eax
push str.360Modularize_
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
call fcn.0040b680
and dword [ebp - 4], 0
lea eax, [esi + 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.0041b65b
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x10]
push 0x4c2a70
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x439d31
mov ecx, esi
call fcn.004396c0
neg eax
sbb eax, eax
neg eax
mov dword [ebp + 8], eax
jmp 0x439d34
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.0040dd20
mov eax, esi
call fcn.004854f9
ret 4
Function at 0x439d84
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x4b66b5
call fcn.00485421
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.0043985d
test eax, eax
je 0x439da7
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
jmp 0x439e17
and dword [ebp + 8], 0
push 4
pop eax
push str.360Modularize_
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
call fcn.0040b680
and dword [ebp - 4], 0
lea eax, [esi + 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.0041b65b
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x10]
push 0x4c2a70
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x439e05
mov ecx, esi
call fcn.0043974c
neg eax
sbb eax, eax
inc eax
mov dword [ebp + 8], eax
jmp 0x439e08
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.0040dd20
mov eax, esi
call fcn.004854f9
ret 4

Function at 0x439ef7
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x4b6723
call fcn.00485421
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.0043985d
test eax, eax
je 0x439f1d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
jmp 0x439fbc
and dword [ebp + 8], 0
push 4
pop eax
push str.360Modularize_
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
call fcn.0040b680
and dword [ebp - 4], 0
lea eax, [esi + 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.0041b65b
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x10]
push 0x4c2a70
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x439f90
mov ecx, esi
call fcn.0043967a
test eax, eax
je 0x439f7d
xor eax, eax
inc eax
mov dword [ebp + 8], eax
jmp 0x439f98
mov ecx, esi
call fcn.00439b1b
test eax, eax
je 0x439f90
xor eax, eax
inc eax
mov dword [ebp + 8], eax
jmp 0x439f93
mov eax, dword [ebp + 8]
cmp eax, 1
jne 0x439fad
cmp dword [esi + 4], 0
je 0x439fad
mov ecx, esi
call fcn.00439a0c
neg eax
sbb eax, eax
inc eax
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.0040dd20
mov eax, esi
call fcn.004854f9
ret 4
Function at 0x45556a
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 8]
push edi
mov edi, dword [esp + 8]
mov dword [edi + 0xba], eax
test eax, eax
je 0x4555ac
push esi
push 0x3ed
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call esi
push 5
push dword [edi + 0x768]
call esi
push 5
push dword [edi + 0x690]
call esi
pop esi
pop edi
ret 8

Function at 0x455604
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
test ecx, ecx
je 0x455614
lea esi, [ecx - 0x9a]
jmp 0x455616
xor esi, esi
cmp byte [ecx + 0x1c], 0
je 0x45564a
push 0xe801
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp dword [ebp + 0xc], 2
jne 0x45563b
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x455650
cmp dword [ebp + 0xc], 0
jne 0x45564a
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 0xc], 1
je 0x455668
mov eax, dword [ebp + 0x10]
shr eax, 0x10
cwde
push eax
movsx eax, word [ebp + 0x10]
push eax
lea ecx, [esi + 0x9a]
call fcn.0045515a
xor eax, eax
pop esi
pop ebp
ret 0x10
Function at 0x45592d
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4e97d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4c2130]
mov dword [ebp - 0xc], eax
mov eax, dword [0x4c2134]
mov dword [ebp - 8], eax
mov ax, word [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
mov word [ebp - 0xc], ax
push esi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor esi, esi
cmp eax, 3
je 0x455975
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], esi
jmp 0x4559b6
push 8
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.00484550
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push esi
push esi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x4559a2
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], eax
jmp 0x4559a8
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
cmp eax, esi
ja 0x4559ca
jb 0x4559b6
cmp ecx, 0x400
jae 0x4559ca
push ecx
push str._d_Bytes
push ebx
call fcn.0041cc03
add esp, 0xc
jmp 0x455a9e
push edi
cmp eax, esi
ja 0x455a57
jb 0x4559dd
cmp ecx, 0x100000
jae 0x455a13
push esi
mov edi, ecx
push 0x64
shrd edi, eax, 0xa
and ecx, 0x3ff
push esi
shr eax, 0xa
push ecx
mov dword [ebp - 0x18], eax
call fcn.0048a970
mov ecx, eax
or ecx, edx
jne 0x455a07
push edi
push str._d_KB
jmp 0x455a82
push eax
push edi
push str._d._d_KB
jmp 0x455a94
cmp eax, esi
ja 0x455a57
jb 0x455a21
cmp ecx, 0x40000000
jae 0x455a57
push esi
mov edi, ecx
push 0x19000
shrd edi, eax, 0x14
and ecx, 0xfffff
push esi
shr eax, 0x14
push ecx
mov dword [ebp - 0x18], eax
call fcn.0048a970
mov ecx, eax
or ecx, edx
jne 0x455a4e
push edi
push 0x4c216c
jmp 0x455a82
push eax
push edi
push str._d._d_MB
jmp 0x455a94
push esi
mov edi, ecx
push 0x6400000
shrd edi, eax, 0x1e
and ecx, 0x3fffffff
push esi
shr eax, 0x1e
push ecx
mov dword [ebp - 0x18], eax
call fcn.0048a970
mov ecx, eax
or ecx, edx
jne 0x455a8d
push edi
push str._d_GB
push ebx
call fcn.0041cc03
add esp, 0xc
jmp 0x455a9d
push eax
push edi
push str._d._d_GB
push ebx
call fcn.0041cc03
add esp, 0x10
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00484647
leave
ret 8
Function at 0x457a3b
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x4e8]
push 0
mov ecx, ebx
call fcn.004513ed
push dword [esi + 0x92]
mov ecx, ebx
call fcn.00446576
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3f9
push dword [esi + 4]
call edi
push eax
lea ecx, [esi + 0x53a]
call fcn.00436c96
cmp dword [esi + 0x148], 0x5001
push 4
mov ecx, ebx
push 0x4c23a0
jne 0x457a95
push 0x13a
jmp 0x457a9a
push 0x138
call fcn.0045134f
push dword [esi + 0x53e]
lea ebx, [esi + 0x20]
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
push 0x3fa
push dword [esi + 4]
call edi
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call ebp
lea ecx, [esi + 0xc2]
push 0xffffff
call fcn.004465a2
push dword [esi + 0x92]
lea ecx, [esi + 0xc2]
call fcn.00446576
push 0x3fb
push dword [esi + 4]
call edi
push eax
lea ecx, [esi + 0x114]
call fcn.0044f7d0
push dword [esi + 0x118]
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
lea ebx, [esi + 0x338]
push 1
mov ecx, ebx
call fcn.004513ed
push dword [esi + 0x92]
mov ecx, ebx
call fcn.00446576
push 0x3fe
push dword [esi + 4]
call edi
push eax
lea ecx, [esi + 0x38a]
call fcn.00436c96
push 0xc
push 0x4c23a0
push 0xf7
mov ecx, ebx
call fcn.004513b8
lea ebx, [esi + 0x410]
push 1
mov ecx, ebx
call fcn.004513ed
push dword [esi + 0x92]
mov ecx, ebx
call fcn.00446576
push 0x3ff
push dword [esi + 4]
call edi
push eax
lea ecx, [esi + 0x462]
call fcn.00436c96
push 0xc
push 0x4c23a0
push 0xf7
mov ecx, ebx
call fcn.004513b8
xor edi, edi
push edi
push dword [esi + 0x118]
call ebp
push edi
push dword [esi + 0x38e]
call ebp
push edi
push dword [esi + 0x466]
call ebp
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x457fc2
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
test ecx, ecx
je 0x457fd2
lea esi, [ecx - 0x9a]
jmp 0x457fd4
xor esi, esi
cmp byte [ecx + 0x1c], 0
je 0x458008
push 0xe801
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp dword [ebp + 0xc], 2
jne 0x457ff9
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x45800e
cmp dword [ebp + 0xc], 0
jne 0x458008
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 0xc], 1
je 0x458026
mov eax, dword [ebp + 0x10]
shr eax, 0x10
cwde
push eax
movsx eax, word [ebp + 0x10]
push eax
lea ecx, [esi + 0x9a]
call fcn.00457bd0
xor eax, eax
pop esi
pop ebp
ret 0x10

Function at 0x458208
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0x91
lea ecx, [esi + 0x14c]
call fcn.0040bf10
push 0
push dword [esi + 0x118]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret
Function at 0x45a480
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
push 0xb
push 0x7d0
mov esi, ecx
call fcn.004472a6
mov ebx, dword [sym.imp.USER32.dll_SetTimer]
pop ecx
pop ecx
push 0
push 0x927c0
push 0x2727
push dword [esi + 4]
call ebx
lea eax, [esi + 0x72]
lea edi, [esi + 0x353]
push eax
mov ecx, edi
call fcn.0046c894
push 0x102
mov ecx, edi
call fcn.0046c8c1
mov eax, dword [esi + 0x92]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x30]
cmp eax, 0x3001
jl 0x45a4e4
pop edi
mov ecx, esi
pop esi
pop ebx
jmp fcn.00459ed6
push 0
push 0x64
push 0x2711
push dword [esi + 4]
call ebx
pop edi
pop esi
pop ebx
ret

Function at 0x45a4f6
Capabilities:
Hide graphical window

Disassembly:
push 4
mov eax, 0x4b9a20
call fcn.00485421
mov esi, ecx
push 0x4c5190
lea ecx, [ebp - 0x10]
call fcn.0040b680
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push 0x64
mov ecx, 0x4ebc68
call fcn.0041bf9c
mov ecx, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.0040dd20
push 0xd
push 0x7d0
call fcn.004472a6
push 0
push 0x79
call fcn.004473d5
fld dword [0x4c4ce8]
add esp, 0xc
lea ecx, [esi + 0x276]
fstp dword [esp]
call fcn.00458c7a
cmp dword [esi + 0x40f], 0
je 0x45a575
mov dword [esi + 0x40b], 1
jmp 0x45a5a7
mov eax, dword [esi + 0x92]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x45a5a0
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.0045a0fd
jmp 0x45a5a7
mov ecx, esi
call fcn.00458b8f
call fcn.004854f9
ret

Function at 0x45a5ad
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, 0x4b9a43
call fcn.00485421
mov esi, dword [ebp + 8]
push dword [esi - 0x6e]
call dword [sym.imp.USER32.dll_GetParent]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea edi, [esi - 0x72]
mov ecx, edi
call fcn.0045a3b3
mov ecx, edi
call fcn.00458ceb
mov ecx, edi
call fcn.0045a480
lea eax, [ebp + 8]
push 0xb6
push eax
call fcn.00455f33
pop ecx
pop ecx
and dword [ebp - 4], 0
push eax
lea ecx, [esi + 0x3e3]
call fcn.0041cb91
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0040dd20
push 0
push 0x64
push 0x2711
push dword [esi - 0x6e]
call dword [sym.imp.USER32.dll_SetTimer]
call fcn.004854f9
ret 4
Function at 0x45a71d
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
sub esp, 0x254
lea ebp, [esp - 4]
mov eax, dword [0x4e97d0]
xor eax, ebp
mov dword [ebp + 0x254], eax
push 0xc
mov eax, 0x4b9a6e
call fcn.00485421
xor ebx, ebx
push 0x250
lea eax, [ebp + 4]
push ebx
push eax
mov esi, ecx
mov dword [ebp], ebx
call fcn.00484550
add esp, 0xc
lea eax, [ebp]
push eax
lea ecx, [esi + 0x353]
call fcn.0046c90b
cmp dword [ebp + 0xc], ebx
ja 0x45a778
cmp dword [ebp + 8], 1
jb 0x45a915
push 0x2711
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
shrd eax, ecx, 0xa
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
shr ecx, 0xa
mov ecx, dword [ebp + 0x14]
shrd eax, ecx, 0xa
mov dword [ebp - 0x14], eax
shr ecx, 0xa
fild dword [ebp - 0x14]
fidiv dword [ebp - 0x18]
fld dword [esi + 0x3eb]
fsubr qword [0x4c0d30]
fmulp st(1)
call fcn.0048df60
cmp dword [esi + 0x407], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov dword [ebp - 0x10], edi
jne 0x45a7da
call ebx
mov dword [esi + 0x407], eax
call ebx
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
cmp ecx, dword [esi + 0x3ff]
jne 0x45a80f
cmp edx, dword [esi + 0x403]
jne 0x45a80f
sub eax, dword [esi + 0x407]
xor edx, edx
mov ecx, 0x3e8
div ecx
cmp eax, 0x5a
jb 0x45a821
mov ecx, esi
call fcn.0045a6c9
jmp 0x45a821
mov dword [esi + 0x407], eax
mov dword [esi + 0x3ff], ecx
mov dword [esi + 0x403], edx
cmp edi, 0x3c
jl 0x45a84f
lea eax, [esi + 0x3f7]
cmp dword [eax], 0
jne 0x45a84f
push 0xc
push 0x7d0
mov dword [eax], 1
call fcn.004472a6
push 0
push 0x78
call fcn.004473d5
add esp, 0x10
cmp edi, dword [esi + 0x3df]
je 0x45a889
fild dword [ebp - 0x10]
push ecx
lea ecx, [esi + 0x276]
fadd dword [esi + 0x3eb]
fstp dword [ebp - 0x10]
fld dword [ebp - 0x10]
fstp dword [esp]
call fcn.00458c7a
push edi
push 1
lea ecx, [esi + 0x574]
mov dword [esi + 0x3df], edi
call fcn.00440ff3
push 0x4c5190
lea ecx, [ebp - 0x10]
call fcn.0040b680
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push edi
mov ecx, 0x4ebc68
call fcn.0041bf9c
mov ecx, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.0040dd20
mov eax, dword [ebp - 0x18]
cdq
mov ecx, 0x3ff
and edx, ecx
add eax, edx
mov ebx, eax
mov eax, dword [ebp - 0x14]
cdq
and edx, ecx
add eax, edx
mov edi, eax
sar edi, 0xa
lea eax, [esi + 0x3e3]
sar ebx, 0xa
cmp edi, dword [eax]
je 0x45a915
push 0x4ecda4
lea ecx, [ebp - 0x14]
mov dword [eax], edi
call fcn.0040ba90
push ebx
push edi
lea eax, [ebp - 0x14]
push 0x90
push eax
mov dword [ebp - 4], 1
call fcn.00455b90
mov ecx, dword [ebp - 0x14]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.0040dd20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x254]
xor ecx, ebp
call fcn.00484647
add ebp, 0x258
leave
ret