joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448367
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
mov eax, dword [0xee37e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xa4], edx
mov dword [ebp - 0xb4], edi
call fcn.005b5305
test al, al
je 0x448579
mov ecx, edi
call fcn.005c00cc
test eax, eax
jne 0x4483b2
mov ecx, edi
call fcn.005c0242
test eax, eax
je 0x448579
cmp eax, str.fileChm
jne 0x4483d3
mov eax, dword [0xefc0c8]
cmp byte [eax + 0x84], 0
jne 0x4483d3
mov ecx, edi
call fcn.004482d5
jmp 0x448579
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [ebp - 0xc0]
push eax
call esi
push edi
push str.Starting:__s_n
call fcn.005b3a54
pop ecx
pop ecx
lea eax, [ebp - 0xb0]
push eax
call esi
push 1
xor edx, edx
mov ecx, edi
call fcn.00470057
mov ebx, eax
mov dword [ebp - 0xa8], ebx
pop ecx
test ebx, ebx
jne 0x448422
push edi
push str.Error:_failed_to_load__s_n
call fcn.005b3a54
pop ecx
pop ecx
jmp 0x448579
push dword [ebp - 0xac]
push dword [ebp - 0xb0]
call fcn.00420fef
movsd qword [esp], xmm0
push str.load:__.2f_ms_n
call fcn.005b3949
add esp, 0xc
mov ecx, ebx
call fcn.0046ec18
push eax
push str.page_count:__d_n
mov dword [ebp - 0xac], eax
call fcn.005b3949
mov esi, dword [ebp - 0xa4]
xor ebx, ebx
pop ecx
pop ecx
test esi, esi
jne 0x4484e8
inc esi
cmp dword [ebp - 0xac], 1
jl 0x448497
mov edi, dword [ebp - 0xa8]
mov ebx, dword [ebp - 0xac]
mov edx, esi
mov ecx, edi
call fcn.00448219
inc esi
cmp esi, ebx
jle 0x448481
mov edi, dword [ebp - 0xb4]
xor ebx, ebx
mov esi, dword [ebp - 0xa4]
mov cl, bl
call fcn.00420997
push ecx
push ecx
lea ecx, [ebp - 0xa0]
call fcn.00436440
lea edx, [ebp - 0xa0]
mov ecx, esi
call fcn.00435986
test al, al
je 0x44853a
mov eax, dword [ebp - 0x9c]
test eax, eax
je 0x44853a
mov edi, dword [ebp - 0xa8]
cmp ebx, eax
sbb cl, cl
inc cl
call fcn.00420997
mov eax, dword [ebp - 0x90]
mov esi, dword [eax + ebx*8]
jmp 0x44850e
mov ecx, esi
call fcn.00435b10
test al, al
jne 0x44849d
mov cl, 1
jmp 0x44849f
cmp esi, 1
jl 0x44850d
cmp esi, dword [ebp - 0xac]
jg 0x44850d
mov edx, esi
mov ecx, edi
call fcn.00448219
inc esi
cmp ebx, dword [ebp - 0x9c]
sbb cl, cl
inc cl
call fcn.00420997
mov eax, dword [ebp - 0x90]
cmp esi, dword [eax + ebx*8 + 4]
jle 0x4484f7
mov eax, dword [ebp - 0x9c]
inc ebx
cmp ebx, eax
jb 0x4484d4
mov edi, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0xa8]
push 1
mov eax, dword [ecx]
call dword [eax]
push edi
push ecx
push dword [ebp - 0xbc]
push dword [ebp - 0xc0]
call fcn.00420fef
movsd qword [esp + 4], xmm0
mov dword [esp], str.Finished__in__.2f_ms_:__s_n
call fcn.005b3a54
add esp, 0x10
lea ecx, [ebp - 0xa0]
call fcn.00421c7c
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006f3e28
leave
ret
Function at 0x44af10
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0xee37e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0xefe358]
push ebx
mov ebx, ecx
push esi
push edi
test eax, eax
je 0x44af3d
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
jmp 0x44b09a
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor edi, edi
cmp word [0xefe364], di
jne 0x44af94
push 0x44ad6d
mov edx, str.SUMATRA_PDF_ABOUT
lea ecx, [ebp - 0xa8]
call fcn.005b641f
pop ecx
push edi
call esi
push 1
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0xa8]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
mov word [0xefe364], ax
sete cl
call fcn.00420997
push edi
call esi
mov ecx, str.About_SumatraPDF
mov esi, eax
call fcn.00460e8f
push edi
push esi
push edi
push edi
mov ecx, SysReAllocString
push ecx
push ecx
push ecx
push ecx
push 0xc80000
push eax
push str.SUMATRA_PDF_ABOUT
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ecx, eax
mov dword [0xefe358], ecx
test ecx, ecx
je 0x44b09a
call fcn.00460f5d
mov dl, al
call fcn.005b7869
lea eax, [ebp - 0x48]
mov dword [ebp - 0x50], edi
push eax
push dword [0xefe358]
mov dword [ebp - 0x4c], edi
call dword [sym.imp.USER32.dll_BeginPaint]
mov esi, eax
push edi
push esi
call dword [sym.imp.GDI32.dll_SetLayout]
mov ecx, dword [0xefe358]
lea eax, [ebp - 0x58]
push eax
mov edx, esi
call fcn.0044a82a
pop ecx
lea eax, [ebp - 0x48]
push eax
push dword [0xefe358]
call dword [sym.imp.USER32.dll_EndPaint]
mov ecx, dword [0xefe358]
call fcn.005b9d31
push 0x60
push eax
push 8
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov edx, dword [0xefe358]
lea ecx, [ebp - 0x68]
mov edi, eax
add edi, edi
call fcn.005b64bc
mov edx, dword [0xefe358]
lea ecx, [ebp - 0x78]
call fcn.005b6467
mov eax, dword [ebp - 0x5c]
mov ecx, edi
sub edi, dword [ebp - 0x6c]
sub ecx, dword [ebp - 0x70]
add edi, dword [ebp - 0x4c]
add ecx, dword [ebp - 0x50]
add eax, edi
mov esi, dword [ebp - 0x60]
push 0
push eax
add esi, ecx
push esi
push dword [ebp - 0x64]
push dword [ebp - 0x68]
push dword [0xefe358]
call dword [sym.imp.USER32.dll_MoveWindow]
mov edx, dword [ebx + 0x5c]
call fcn.005b8c96
push 5
push dword [0xefe358]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006f3e28
leave
ret
Function at 0x44cbdc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
mov eax, ecx
push esi
push edi
push 0x410
push eax
mov dword [ebp - 8], eax
call ebx
mov edx, eax
lea ecx, [ebp - 0x20]
call fcn.005b64bc
sub esp, 0x10
lea ecx, [ebp - 0x30]
mov esi, eax
mov edi, esp
xor edx, edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 8]
push esi
call fcn.005b6511
add esp, 0x14
push 0x404
push esi
call ebx
mov edx, eax
lea ecx, [ebp - 0x40]
call fcn.005b64bc
sub esp, 0x10
lea ecx, [ebp - 0x20]
mov esi, eax
mov edi, esp
xor edx, edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 8]
push esi
call fcn.005b6511
mov eax, dword [ebp - 0x24]
add esp, 0x14
sub eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x2c]
push 5
mov dword [ebp - 0xc], eax
push esi
jmp 0x44cd29
mov edx, ebx
lea ecx, [ebp - 0x40]
call fcn.005b64bc
sub esp, 0x10
lea ecx, [ebp - 0x20]
mov esi, eax
mov edi, esp
xor edx, edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 8]
push esi
call fcn.005b6511
mov ecx, dword [ebp - 0x24]
add esp, 0x14
mov eax, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x10], eax
cmp eax, ecx
jl 0x44ccb1
sub eax, dword [ebp - 0xc]
push 1
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push eax
push dword [ebp - 0x20]
push ebx
call dword [sym.imp.USER32.dll_MoveWindow]
jmp 0x44cd26
sub esp, 0x10
lea esi, [ebp - 0x30]
mov edi, esp
lea eax, [ebp - 0x50]
lea ecx, [ebp - 0x20]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.005b5f91
lea ecx, [ebp - 0x20]
push ecx
mov ecx, eax
call fcn.005b60bf
test al, al
je 0x44cce3
push 0
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x44cd23
sub esp, 0x10
lea esi, [ebp - 0x20]
mov edi, esp
lea eax, [ebp - 0x60]
lea ecx, [ebp - 0x30]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.005b5f91
lea ecx, [ebp - 0x30]
push ecx
mov ecx, eax
call fcn.005b60bf
test al, al
je 0x44cd23
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
push 1
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x10]
push dword [ebp - 0x20]
push ebx
call dword [sym.imp.USER32.dll_MoveWindow]
mov esi, dword [ebp - 8]
push 2
push ebx
call dword [sym.imp.USER32.dll_GetWindow]
mov ebx, eax
test ebx, ebx
jne 0x44cc63
mov edx, esi
lea ecx, [ebp - 0x30]
call fcn.005b64bc
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0xc]
push 1
push eax
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push esi
call dword [sym.imp.USER32.dll_MoveWindow]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x451397
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov bl, dl
test edi, edi
mov byte [esp + 0x13], bl
mov dword [esp + 0x14], edi
sete cl
call fcn.00420997
test edi, edi
je 0x4515a2
cmp byte [ebp + 8], 0
je 0x4513cf
test bl, bl
jne 0x4513cf
mov cl, 1
jmp 0x4513d1
xor cl, cl
call fcn.00420997
movzx eax, byte [esp + 0x13]
xor ebx, ebx
inc ebx
cmp byte [ebp + 8], 0
cmove ebx, eax
cmp dword [0xefc718], 0
mov dword [esp + 0x18], ebx
je 0x45140c
push ecx
lea eax, [esp + 0x18]
push eax
call fcn.00456634
cmp eax, 0xffffffff
jne 0x45140c
cmp byte [ebp + 8], 0
je 0x4515a2
mov dl, 1
mov ecx, edi
call fcn.00445a91
mov ecx, edi
call fcn.00440e88
mov esi, dword [edi + 0x14]
mov eax, dword [edi + 8]
lea eax, [esi + eax*4]
cmp esi, eax
je 0x45144f
mov ebx, eax
mov ecx, dword [esi]
call fcn.0045a89e
test eax, eax
je 0x451444
mov ecx, dword [esi]
call fcn.0045a89e
mov byte [eax + 0x21e], 1
add esi, 4
cmp esi, ebx
jne 0x45142b
mov ebx, dword [esp + 0x18]
cmp dword [edi + 0x1c4], 0
je 0x45145f
mov ecx, edi
call fcn.00453b60
mov esi, dword [edi + 0x14]
mov eax, dword [edi + 8]
mov byte [esp + 0x13], 1
lea eax, [esi + eax*4]
cmp esi, eax
je 0x45149b
mov bl, byte [esp + 0x13]
mov edi, eax
mov ecx, dword [esi]
call fcn.0045113a
neg al
sbb al, al
add esi, 4
and bl, al
cmp esi, edi
jne 0x451477
mov edi, dword [esp + 0x14]
test bl, bl
mov ebx, dword [esp + 0x18]
je 0x4515a2
cmp dword [0xef5f0c], 1
mov ecx, edi
sete byte [esp + 0x13]
call fcn.0044de6d
cmp byte [esp + 0x13], 0
je 0x4514b9
test bl, bl
je 0x4514c4
push 0
push dword [edi + 0x5c]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [0xefe337], 0
jne 0x4514d2
call fcn.004216aa
mov esi, dword [edi + 0x108]
push 0
push 0
push 0x1309
push dword [esi + 0x238]
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [esi + 0x2e4]
call fcn.00435514
mov ecx, dword [edi + 0x110]
call fcn.00421c54
and dword [edi + 0x58], 0
lea ecx, [edi + 4]
and dword [edi], 0
call fcn.0045e055
cmp byte [ebp + 8], 0
je 0x451521
mov ecx, edi
call fcn.0044fba3
jmp 0x451575
cmp byte [esp + 0x13], 0
je 0x451559
test bl, bl
jne 0x451559
push 0
xor dl, dl
mov ecx, edi
call fcn.00450b24
pop ecx
push dword [edi + 0x5c]
call dword [sym.imp.USER32.dll_SetFocus]
push ecx
lea eax, [esp + 0x18]
push eax
call fcn.00456634
cmp eax, 0xffffffff
sete cl
call fcn.00420997
jmp 0x4515a2
mov ecx, dword [edi + 0x124]
call fcn.0043ca0d
mov esi, dword [edi + 0x5c]
mov ecx, edi
call fcn.0044fba3
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
cmp byte [esp + 0x13], 0
je 0x4515a2
test bl, bl
je 0x4515a2
push str.Calling_PostQuitMessage___in_CloseWindow___because_closing_lastWindow_n
call fcn.005b3949
cmp dword [0xef5f0c], 0
pop ecx
setne cl
call fcn.00420997
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45398f
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0xef591c]
push ebx
shr eax, 6
mov ebx, ecx
mov byte [ebp - 1], dl
push esi
push edi
test al, 1
je 0x453b5b
cmp dword [0xefc718], 0
jne 0x453b5b
push dword [ebx + 0x5c]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x453b5b
mov al, byte [ebp - 1]
test al, al
je 0x4539da
mov ecx, dword [ebx + 0x1c4]
jmp 0x4539e1
movzx ecx, byte [ebx + 0x1c0]
test ecx, ecx
jne 0x453b5b
test al, al
je 0x4539f6
movzx eax, byte [ebx + 0x1c0]
jmp 0x4539fc
mov eax, dword [ebx + 0x1c4]
test eax, eax
setne cl
call fcn.00420997
cmp byte [ebp - 1], 0
je 0x453a5d
cmp dword [ebx], 0
sete cl
call fcn.00420997
mov ecx, ebx
call fcn.00462c37
test al, al
je 0x453b5b
push dword [ebx + 0x5c]
call dword [sym.imp.USER32.dll_IsZoomed]
xor ecx, ecx
test eax, eax
setne cl
inc ecx
mov dword [ebx + 0x1c8], ecx
mov dword [ebx + 0x1c4], 1
mov dword [ebx + 0x138], 0xfffffffe
mov dword [ebx + 0x13c], 0xfffffffd
jmp 0x453a64
mov byte [ebx + 0x1c0], 1
cmp byte [ebp - 1], 0
mov eax, dword [0xefc0c8]
mov al, byte [eax + 0x153]
mov byte [ebp - 2], al
je 0x453a91
cmp byte [ebx + 0x9d], 0
jne 0x453a85
test al, al
je 0x453a91
push 0
xor dl, dl
mov ecx, ebx
call fcn.00454905
pop ecx
push 0xfffffffffffffff0
push dword [ebx + 0x5c]
call dword [sym.imp.USER32.dll_GetWindowLongW]
cmp byte [ebp - 1], 0
mov dword [ebp - 8], eax
je 0x453aae
cmp byte [ebx + 0x1c0], 0
jne 0x453ab4
mov dword [ebx + 0x1cc], eax
mov edx, dword [ebx + 0x5c]
lea ecx, [ebp - 0x18]
call fcn.005b64bc
mov edx, dword [ebx + 0x5c]
lea edi, [ebx + 0x1d0]
mov esi, eax
lea ecx, [ebp - 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.005b7336
xor edi, edi
push edi
push dword [ebx + 0x5c]
call dword [sym.imp.USER32.dll_SetMenu]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push edi
push dword [ebx + 0x64]
call esi
mov ecx, dword [ebx + 0x108]
push 2
mov eax, dword [ecx]
call dword [eax + 8]
push edi
push dword [ebx + 0x114]
call esi
mov eax, dword [ebp - 8]
and eax, 0xff3bffff
or eax, 0x1000000
push eax
push 0xfffffffffffffff0
push dword [ebx + 0x5c]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x34
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push edi
push dword [ebx + 0x5c]
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp byte [ebp - 1], 0
je 0x453b44
mov ecx, dword [ebx]
push 1
mov eax, dword [ecx]
call dword [eax + 0x2c]
push dword [ebx + 0x5c]
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [0xefc0c8]
mov cl, byte [ebp - 2]
mov byte [eax + 0x153], cl
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4545f7
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
cmp dword [edi + 4], 0
je 0x454649
xor dl, dl
call fcn.00450956
cmp byte [ebp + 8], 0
mov eax, dword [esi + 0x58]
je 0x454624
mov edx, edi
mov ecx, eax
pop edi
pop esi
pop ebx
pop ebp
jmp fcn.0043189a
mov ebx, dword [eax + 0x98]
test ebx, ebx
je 0x45464e
mov esi, dword [edi + 0x10]
mov eax, dword [edi + 4]
lea edi, [esi + eax*4]
jmp 0x454645
mov edx, dword [esi]
mov ecx, ebx
call fcn.004317ff
add esi, 4
cmp esi, edi
jne 0x454639
pop edi
pop esi
pop ebx
pop ebp
ret
mov ecx, edi
pop edi
pop esi
pop ebx
pop ebp
jmp fcn.00431fac

Function at 0x454659
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov eax, dword [edi + 0x1c4]
cmp eax, 2
je 0x4547b5
cmp eax, 3
je 0x4547b5
call fcn.005b701d
mov bl, al
call fcn.005b7009
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0xffff8000
and ax, cx
movzx ecx, ax
cmp esi, 0x100
jb 0x4546cd
mov eax, dword [ebp + 8]
test eax, eax
je 0x4546ec
test bl, bl
jne 0x4546ec
test cx, cx
jne 0x4546ec
sar eax, 0x10
push 1
movzx eax, al
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
lea ecx, [eax - 0x41]
cmp ecx, 0x19
ja 0x4546ec
mov esi, eax
mov eax, esi
cmp esi, 9
je 0x4546e5
cmp eax, 0x1b
jne 0x4546ec
mov ecx, edi
call fcn.004540cd
jmp 0x4547c6
mov ecx, edi
call fcn.00453d28
mov ecx, edi
call fcn.00462c37
test al, al
je 0x4547c6
movzx ebx, si
push ebx
call dword [sym.imp.USER32.dll_IsCharUpperW]
test eax, eax
je 0x454723
xor eax, eax
mov word [ebp - 4], bx
mov word [ebp - 2], ax
lea eax, [ebp - 4]
push 1
push eax
call dword [sym.imp.USER32.dll_CharLowerBuffW]
movzx esi, word [ebp - 4]
mov ebx, dword [edi]
mov ecx, edi
call fcn.00462c67
sub esi, 0x2b
je 0x454751
dec esi
sub esi, 1
je 0x45479e
dec esi
sub esi, 1
je 0x454785
sub esi, 0xe
je 0x454751
sub esi, 0x25
je 0x45477c
sub esi, 0x7e
je 0x454751
sub esi, 4
jne 0x4547c6
mov eax, dword [ebx]
push ecx
mov ecx, ebx
mov dword [esp], 0x45c80000
mov eax, dword [eax + 0x38]
mov dword [ebp - 4], eax
call dword [ebp - 4]
fstp dword [ebp - 4]
movss xmm1, dword [ebp - 4]
xor dl, dl
push 0
mov ecx, edi
call fcn.004476e6
pop ecx
jmp 0x4547c6
mov ecx, edi
call fcn.0045419f
jmp 0x4547c6
cmp byte [0xefe336], 0
jne 0x454795
mov ecx, edi
call fcn.004450d4
mov byte [0xefe336], 0
jmp 0x4547c6
mov eax, dword [ebx]
push ecx
mov ecx, ebx
mov dword [esp], 0x410547ae
mov eax, dword [eax + 0x38]
mov dword [ebp - 4], eax
call dword [ebp - 4]
jmp 0x454766
push 0
mov dword [edi + 0x1c4], 1
call fcn.00462e0a
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45822c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
push edi
call dword [sym.imp.USER32.dll_IsWindow]
neg eax
sbb al, al
lea ecx, [eax + 1]
call fcn.00420997
cmp dword [0xefc718], 0
sete cl
call fcn.00420997
mov ebx, dword [esi + 0x5c]
push 0xfffffffffffffff0
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0x3f3bffff
or eax, 0x40000000
push eax
push 0xfffffffffffffff0
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongW]
push edi
push ebx
call dword [sym.imp.USER32.dll_SetParent]
mov edx, edi
lea ecx, [ebp - 0x10]
call fcn.005b6467
sub esp, 0x10
mov esi, eax
mov edi, esp
mov ecx, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.005b656e
add esp, 0x10
push 5
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
call dword [sym.imp.USER32.dll_UpdateWindow]
push ebx
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4582be
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x455c9f
mov edx, str.SUMATRA_PDF_FRAME
lea ecx, [ebp - 0x30]
mov esi, eax
call fcn.005b641f
pop ecx
push 1
push esi
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
mov dword [ebp - 0x18], eax
sete cl
call fcn.00420997
push 4
call dword [sym.imp.GDI32.dll_GetStockObject]
mov esi, dword [sym.imp.USER32.dll_RegisterClassExW]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x30]
push eax
call esi
movzx eax, ax
test ax, ax
sete cl
call fcn.00420997
push fcn.00425624
mov edx, str.SUMATRA_PDF_CANVAS
lea ecx, [ebp - 0x30]
call fcn.005b641f
or dword [ebp - 0x2c], 8
lea eax, [ebp - 0x30]
pop ecx
push eax
call esi
movzx eax, ax
test ax, ax
sete cl
call fcn.00420997
push 0x426060
mov edx, str.CustomCaption
lea ecx, [ebp - 0x60]
call fcn.005b641f
pop ecx
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x40], 6
push ecx
call esi
mov al, 1
pop esi
leave
ret
Function at 0x458c55
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x18]
push edi
call fcn.005b6ca0
mov ecx, dword [ebp - 0x18]
call fcn.005b2414
mov ecx, dword [ebp - 0x18]
call fcn.005b0bf2
mov ecx, dword [ebp - 0x18]
add eax, eax
mov edx, eax
call fcn.005b3f50
push eax
push str.SumatraPDF__08x
call fcn.005b24d2
pop ecx
xor edi, edi
mov dword [ebp - 0xc], eax
pop ecx
mov dword [ebp - 8], 3
mov esi, edi
push eax
push 4
push edi
push 4
push edi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
test ebx, ebx
je 0x458d28
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 4
push edi
push edi
cmp eax, 0xb7
push 0xf001f
push ebx
sete byte [ebp - 1]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
jne 0x458ce3
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x458d28
cmp byte [ebp - 1], 0
je 0x458d47
mov eax, dword [edi]
push edi
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov ebx, str.SUMATRA_PDF_FRAME
jmp 0x458d18
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x14], eax
je 0x458d3e
push edi
push ebx
push esi
push edi
call dword [sym.imp.USER32.dll_FindWindowExW]
mov esi, eax
test esi, esi
jne 0x458d05
sub dword [ebp - 8], 1
js 0x458d5f
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0xc]
jmp 0x458ca0
push eax
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
jmp 0x458d61
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push edi
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x1c]
xor esi, esi
mov dword [eax], ebx
jmp 0x458d61
mov esi, edi
push dword [ebp - 0xc]
call fcn.00702f96
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x45930e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
cmp byte [0xefc712], 0
push ebx
push esi
jne 0x459466
call fcn.00422045
test al, al
je 0x459466
call fcn.004388b2
mov esi, eax
mov edx, str.0__expectedSize
test esi, esi
sete cl
call fcn.0042ada1
test esi, esi
je 0x459466
lea ecx, [ebp - 8]
call fcn.005b6ca0
lea ecx, [ebp - 0x10]
mov edx, dword [eax]
call fcn.005b4980
xor ebx, ebx
lea ecx, [ebp - 8]
push ebx
push str.libmupdf.dll
mov edx, dword [eax]
call fcn.005b4ae7
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
mov edx, dword [eax]
call fcn.005b471e
add esp, 0xc
push dword [eax + 4]
push dword [eax]
call fcn.005b5344
pop ecx
pop ecx
cmp eax, esi
jne 0x459399
cmp edx, ebx
je 0x459466
call fcn.005b6b7b
test al, al
je 0x4593b3
push str._nLooks_like_corrupted_installation_of_SumatraPDF._n_nLearn_more_at_https:__www.sumatrapdfreader.org_docs_Corrupted_installation_n
push 0xcce380
call fcn.00411a49
pop ecx
pop ecx
push ebx
push str._installer
mov edx, 0xe736e0
lea ecx, [ebp - 0x10]
call fcn.005b46e5
pop ecx
pop ecx
mov ecx, eax
call fcn.00420fec
push 0x60
mov esi, eax
lea eax, [ebp - 0x70]
push ebx
push eax
call fcn.006f59b0
add esp, 0xc
call fcn.00460f5d
push 0xffffffffffffffff
mov edx, str.Looks_like_corrupted_installation_of_SumatraPDF._n
mov dword [ebp - 0x70], 0x60
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x5c], esi
mov bl, al
call fcn.005b47cf
pop ecx
mov ecx, eax
call fcn.00420fec
mov dword [ebp - 0x54], eax
xor esi, esi
movzx eax, bl
inc esi
shl eax, 0xd
add eax, 0x1001009
mov dword [ebp - 0x50], str.Learn_more_at__a_href_https:__www.sumatrapdfreader.org_docs_Corrupted_installation__www.sumatrapdfreader.org_docs_Corrupted_installation__a_.
mov dword [ebp - 0x64], eax
xor eax, eax
push eax
push eax
push eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x1c], 0x4592eb
mov dword [ebp - 0x60], 0x20
mov dword [ebp - 0x58], 0xfffe
call dword [sym.imp.COMCTL32.dll_Ordinal_345]
cmp eax, 0x80070057
sete cl
call fcn.00420997
call fcn.005b6c7b
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
pop ebx
leave
ret