joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461460
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ace10
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x5bd344]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x24], ebx
mov eax, dword [ebx + 0x6c4]
test eax, eax
je 0x4614c7
push dword [eax + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4614c7
mov eax, dword [ebx + 0x6c4]
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebx + 0x6c4]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, dword [ebx + 0x6c4]
test ecx, ecx
je 0x4614d8
mov eax, dword [ecx]
push 1
call dword [eax + 4]
movaps xmm0, xmmword [0x44e0e0]
push 0x6f0
movups xmmword [ebp - 0x20], xmm0
call fcn.0057eb4e
mov ebx, eax
add esp, 4
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 4], 0
lea edi, [ebx + 0x20]
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [ebx + 4], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [edi], eax
mov byte [ebp - 4], 1
lea ecx, [ebx + 0x30]
mov dword [ebx + 0x24], 0x4025e0
mov dword [ebx + 0x28], 0x4025e8
mov dword [ebx + 0x2c], 0x41ddf4
mov dword [ebx], 0x41e100
mov dword [ebx + 0x24], 0x41e114
mov dword [ebx + 0x28], 0x41e124
mov dword [ebx + 0x2c], 0x41e1f4
call fcn.00541de7
mov dword [ebx], fcn.00462390
mov dword [ebx + 0x24], 0x41e1ac
mov dword [ebx + 0x28], 0x41e1a4
mov dword [ebx + 0x2c], 0x41e12c
mov dword [ebx + 0x350], 0
mov dword [ebx + 0x354], 0
mov dword [ebx + 0x358], 0
mov dword [ebx + 0x35c], 0
mov dword [ebx + 0x360], 0
mov dword [ebx + 0x364], 0
mov dword [ebx + 0x34c], 0x41e1cc
lea esi, [ebx + 0x384]
mov byte [ebp - 4], 3
lea ecx, [esi + 4]
mov dword [ebp - 0x28], esi
call fcn.0045dd00
mov dword [esi], 0
mov esi, dword [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
push dword [ebp - 0x28]
mov dword [ebx], 0x41e1b4
mov dword [ebx + 0x24], 0x41e1d8
mov dword [ebx + 0x28], 0x41e11c
mov dword [ebx + 0x2c], 0x41e1e0
mov dword [ebx + 0x34c], 0x41e1e8
mov dword [ebx + 0x6e8], 0
mov dword [ebx + 0x6ec], 0
push edi
mov dword [esi + 0x6c4], ebx
mov esi, dword [esi + 4]
push 0x5bde40
call fcn.00463570
add esp, 8
movzx eax, ax
mov ecx, ebx
push eax
push 0
push 0x80
push 0x80040000
push 0x41d1ec
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.00463480
mov ebx, dword [ebp - 0x24]
mov ecx, dword [ebx + 0x6c4]
push dword [ebx + 4]
add ecx, 4
call fcn.0045db10
mov ecx, dword [ebx + 0x6c4]
lea ecx, [ecx + 0x34c]
call fcn.00462030
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057e93d
mov esp, ebp
pop ebp
ret
Function at 0x462cf0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x28
mov eax, dword [0x5bd344]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
push edi
mov edi, ecx
mov eax, 4
test edi, edi
lea esi, [edi - 0x34c]
cmove esi, eax
push dword [esi]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x462e0a
push dword [edi + 8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x462e0a
push dword [esi]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x462dff
push dword [esi]
call dword [sym.imp.USER32.dll_IsZoomed]
test eax, eax
jne 0x462dff
push dword [esi]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x462dff
lea eax, [esp + 0x10]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, edi
push ecx
lea ecx, [edi + 8]
movups xmm1, xmmword [eax + 0x350]
movd eax, xmm1
movaps xmm0, xmm1
psrldq xmm0, 8
sub dword [esp + 0x14], eax
movd eax, xmm0
movaps xmm0, xmm1
psrldq xmm0, 4
psrldq xmm1, 0xc
add dword [esp + 0x1c], eax
movd eax, xmm0
sub dword [esp + 0x18], eax
movd eax, xmm1
add dword [esp + 0x20], eax
lea eax, [esp + 0x14]
cmp dword [ebp + 8], 0
movaps xmm0, xmmword [esp + 0x14]
movaps xmmword [esp + 0x14], xmm0
push eax
je 0x462de5
call fcn.0045dab0
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0057e93d
mov esp, ebp
pop ebp
ret 4
push dword [esi]
call fcn.0045dae0
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0057e93d
mov esp, ebp
pop ebp
ret 4
push 0
push dword [edi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
xor ecx, esp
call fcn.0057e93d
mov esp, ebp
pop ebp
ret 4
Function at 0x463d70
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x28
mov eax, dword [0x5bd344]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
push edi
mov edi, ecx
mov eax, 4
test edi, edi
lea esi, [edi - 0x384]
cmove esi, eax
push dword [esi]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x463e8a
push dword [edi + 8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x463e8a
push dword [esi]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x463e7f
push dword [esi]
call dword [sym.imp.USER32.dll_IsZoomed]
test eax, eax
jne 0x463e7f
push dword [esi]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x463e7f
lea eax, [esp + 0x10]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, edi
push ecx
lea ecx, [edi + 8]
movups xmm1, xmmword [eax + 0x350]
movd eax, xmm1
movaps xmm0, xmm1
psrldq xmm0, 8
sub dword [esp + 0x14], eax
movd eax, xmm0
movaps xmm0, xmm1
psrldq xmm0, 4
psrldq xmm1, 0xc
add dword [esp + 0x1c], eax
movd eax, xmm0
sub dword [esp + 0x18], eax
movd eax, xmm1
add dword [esp + 0x20], eax
lea eax, [esp + 0x14]
cmp dword [ebp + 8], 0
movaps xmm0, xmmword [esp + 0x14]
movaps xmmword [esp + 0x14], xmm0
push eax
je 0x463e65
call fcn.0045dab0
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0057e93d
mov esp, ebp
pop ebp
ret 4
push dword [esi]
call fcn.0045dae0
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0057e93d
mov esp, ebp
pop ebp
ret 4
push 0
push dword [edi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
xor ecx, esp
call fcn.0057e93d
mov esp, ebp
pop ebp
ret 4
Function at 0x4644b0
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ad09b
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x5bd344]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0
push 0
push 0x859
push dword [0x5eafd8]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi + 0x6bc]
lea edx, [ebp - 0x94]
push edx
mov eax, dword [ecx]
call dword [eax + 0x28]
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.0048f4c0
mov edx, eax
mov dword [ebp - 0x98], eax
lea esi, [edx + 2]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x464520
push 0
push 0
push 0
push 0
sub edx, esi
sar edx, 1
push edx
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
lea ecx, [esi + 1]
push ecx
call fcn.0057eb8c
mov ebx, eax
add esp, 4
mov eax, dword [ebp - 0x98]
mov edx, eax
lea ecx, [edx + 2]
mov dword [ebp - 0x98], ecx
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x464564
sub edx, dword [ebp - 0x98]
push 0
push 0
push esi
push ebx
sar edx, 1
push edx
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ecx, [ebp - 0x94]
mov byte [ebx + esi], 0
mov dword [ebp - 4], 0xffffffff
call fcn.00537eb5
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
push 0x5e9fc0
call esi
push ebx
push 0x5ea3c0
call esi
push 0x41695d
push 0x5ea1c0
call esi
push 0x41695d
push 0x5ea9c0
call esi
mov dword [0x5eafc0], 0
mov ecx, dword [edi + 0x6c4]
call fcn.00549b7c
test al, al
je 0x4645ed
or dword [0x5eafc0], 4
mov ecx, dword [edi + 0x6c8]
call fcn.00549b7c
test al, al
je 0x464603
or dword [0x5eafc0], 2
mov ecx, dword [edi + 0x6cc]
call fcn.00549b7c
test al, al
je 0x46461c
or dword [0x5eafc0], 0x100000
mov ecx, dword [edi + 0x6d0]
call fcn.00549b7c
test al, al
je 0x464635
or dword [0x5eafc0], 0x600000
mov ecx, dword [edi + 0x6d4]
call fcn.00549b7c
xor ecx, ecx
test al, al
setne cl
mov dword [0x5eafc4], ecx
mov ecx, dword [edi + 0x6d8]
call fcn.00549b7c
xor ecx, ecx
test al, al
setne cl
mov dword [0x5eafd4], ecx
mov ecx, dword [edi + 0x6dc]
call fcn.00549b7c
xor ecx, ecx
test al, al
setne cl
mov dword [0x5eafcc], ecx
test al, al
je 0x46468c
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [0x5e9fbc]
mov edx, 0x5e9fc0
shr eax, 8
cmp dword [ebp + 8], 0
movzx eax, al
push eax
je 0x4646b3
call fcn.0046ffb0
jmp 0x4646b8
call fcn.0046fdc0
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057e93d
mov esp, ebp
pop ebp
ret 4
Function at 0x464de0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ad18c
mov eax, dword fs:[0]
push eax
sub esp, 0x114
mov eax, dword [0x5bd344]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 0x6e8]
lea edx, [ebp - 0x94]
push edx
mov eax, dword [ecx]
call dword [eax + 0x28]
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.00549393
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0xffffffff
mov bl, al
call fcn.00537eb5
mov ecx, dword [esi + 0x6e8]
mov eax, dword [ecx]
test bl, bl
jne 0x464f6f
lea edx, [ebp - 0x94]
push edx
call dword [eax + 0x28]
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.0048f4c0
push eax
call fcn.0058b641
add esp, 4
mov dword [ebp - 0x11c], eax
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0xffffffff
call fcn.00537eb5
push 0
push 0
push 0x86a
push dword [0x5e9fbc]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esi + 0x6ec]
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0x94]
push eax
mov edx, dword [ecx]
call dword [edx + 0x28]
mov ecx, eax
mov dword [ebp - 4], 2
call fcn.00549393
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0xffffffff
mov bl, al
call fcn.00537eb5
test bl, bl
je 0x464ee7
mov edi, 1
jmp 0x464f24
mov ecx, dword [esi + 0x6ec]
lea edx, [ebp - 0x118]
push edx
mov eax, dword [ecx]
call dword [eax + 0x28]
mov ecx, eax
mov dword [ebp - 4], 3
call fcn.0048f4c0
push eax
call fcn.0058b641
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x118]
mov edi, eax
call fcn.00537eb5
mov eax, dword [ebp - 0x11c]
test eax, eax
jle 0x464f67
cmp eax, dword [ebp - 0x120]
jg 0x464f67
test edi, edi
jle 0x464f67
push edi
mov edx, eax
call fcn.0046e570
add esp, 4
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
push dword [0x5e9fbc]
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x464f75
mov ecx, dword [esi + 0x6e8]
mov eax, dword [ecx]
call dword [eax + 0xf4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057e93d
mov esp, ebp
pop ebp
ret
Function at 0x464fd0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x28
mov eax, dword [0x5bd344]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
push edi
mov edi, ecx
mov eax, 4
test edi, edi
lea esi, [edi - 0x380]
cmove esi, eax
push dword [esi]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4650ea
push dword [edi + 8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4650ea
push dword [esi]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x4650df
push dword [esi]
call dword [sym.imp.USER32.dll_IsZoomed]
test eax, eax
jne 0x4650df
push dword [esi]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4650df
lea eax, [esp + 0x10]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, edi
push ecx
lea ecx, [edi + 8]
movups xmm1, xmmword [eax + 0x350]
movd eax, xmm1
movaps xmm0, xmm1
psrldq xmm0, 8
sub dword [esp + 0x14], eax
movd eax, xmm0
movaps xmm0, xmm1
psrldq xmm0, 4
psrldq xmm1, 0xc
add dword [esp + 0x1c], eax
movd eax, xmm0
sub dword [esp + 0x18], eax
movd eax, xmm1
add dword [esp + 0x20], eax
lea eax, [esp + 0x14]
cmp dword [ebp + 8], 0
movaps xmm0, xmmword [esp + 0x14]
movaps xmmword [esp + 0x14], xmm0
push eax
je 0x4650c5
call fcn.0045dab0
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0057e93d
mov esp, ebp
pop ebp
ret 4
push dword [esi]
call fcn.0045dae0
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0057e93d
mov esp, ebp
pop ebp
ret 4
push 0
push dword [edi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
xor ecx, esp
call fcn.0057e93d
mov esp, ebp
pop ebp
ret 4
Function at 0x465b20
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ad256
mov eax, dword fs:[0]
push eax
sub esp, 0x10c
mov eax, dword [0x5bd344]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 0
push 0
push 0x859
push dword [0x5eafd8]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebx + 0x6cc]
lea edx, [ebp - 0x94]
push edx
mov eax, dword [ecx]
call dword [eax + 0x28]
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.0048f4c0
mov ecx, eax
call fcn.00465730
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.00537eb5
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
push 0x5e9fc0
call edi
push esi
push 0x5ea3c0
call edi
mov ecx, dword [ebx + 0x6d0]
lea edx, [ebp - 0x118]
push edx
mov eax, dword [ecx]
call dword [eax + 0x28]
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.0048f4c0
mov ecx, eax
call fcn.00465730
lea ecx, [ebp - 0x118]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.00537eb5
push esi
push 0x5ea1c0
call edi
push esi
push 0x5ea9c0
call edi
mov dword [0x5eafc0], 0
mov ecx, dword [ebx + 0x6d4]
call fcn.00549b7c
test al, al
je 0x465c21
or dword [0x5eafc0], 4
mov ecx, dword [ebx + 0x6d8]
call fcn.00549b7c
test al, al
je 0x465c37
or dword [0x5eafc0], 2
mov ecx, dword [ebx + 0x6dc]
call fcn.00549b7c
test al, al
je 0x465c50
or dword [0x5eafc0], 0x100000
mov ecx, dword [ebx + 0x6e0]
call fcn.00549b7c
test al, al
je 0x465c69
or dword [0x5eafc0], 0x600000
mov ecx, dword [ebx + 0x6e4]
call fcn.00549b7c
xor ecx, ecx
test al, al
setne cl
mov dword [0x5eafc4], ecx
mov ecx, dword [ebx + 0x6e8]
call fcn.00549b7c
xor ecx, ecx
test al, al
setne cl
mov dword [0x5eafd4], ecx
mov ecx, dword [ebx + 0x6ec]
call fcn.00549b7c
xor ecx, ecx
test al, al
setne cl
mov dword [0x5eafd0], ecx
test al, al
je 0x465cc0
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0057e93d
mov esp, ebp
pop ebp
ret
Function at 0x466730
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x5bd344]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push dword [0x5f0394]
push 0xfb03
push ecx
push 0
push 0
push 0
push 0
push 0x54000000
push 0
push 0x41eeb4
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
push 0
push dword [0x5e8f74]
push 0x7f5
push edi
call esi
push 0
push 0
push 0x7ef
push edi
call esi
push 0
push 1
push 0x9a3
push edi
call esi
push 0
push 3
push 0x937
push edi
call esi
push 0
push 0
push 0x943
push edi
call esi
push 0
push 0x800
push 0x8e2
push edi
call esi
push 0
push 1
push 0x9d4
push edi
call esi
push 0
push 1
push 0x8e5
push edi
call esi
push 0
push 0
push 0x99a
push edi
call esi
push 0x32
push 9
push 0x962
push edi
call esi
push 0
push 8
push 0x963
push edi
call esi
push 0
push 0
push 0xa03
push edi
call esi
push 0
push 0
push 0xa05
push edi
call esi
push 0
push 0
push 0xa24
push edi
call esi
push 0
push 0
push 0xa07
push edi
call esi
push 0
push 0
push 0xa30
push edi
call esi
push 0x96d
push 0x20133
push 0x816
push edi
call esi
push 0x96f
push 0x20132
push 0x816
push edi
call esi
push 0x96e
push 0x30133
push 0x816
push edi
call esi
push 0x970
push 0x30132
push 0x816
push edi
call esi
push 0x995
push pe_nt_image_headers32
push 0x816
push edi
call esi
push 0x993
push 0x131
push 0x816
push edi
call esi
push 0x996
push 0x10130
push 0x816
push edi
call esi
push 0x994
push 0x10131
push 0x816
push edi
call esi
cmp dword [0x5f02d0], 0xffffffff
je 0x4668ef
cmp dword [0x5f02d4], 0xffffffff
je 0x4668ef
cmp dword [0x5f02d8], 0xffffffff
je 0x4668ef
cmp dword [0x5f02dc], 0xffffffff
jne 0x466920
push 3
lea eax, [ebp - 0xc]
push eax
push 0xd
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp word [ebp - 0xc], 0x30
jne 0x466912
movaps xmm0, xmmword [0x44e120]
jmp 0x466919
movaps xmm0, xmmword [0x44e110]
movups xmmword [0x5f02d0], xmm0
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0057e93d
mov esp, ebp
pop ebp
ret
Function at 0x466f10
Capabilities:
Get graphical window text
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push 0xd
mov ebx, ecx
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x46708d
push ebx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x46708d
push esi
push edi
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
push 0
push 0
push 0x859
push ebx
call esi
push 0
push 0
push 0x7ee
push ebx
mov dword [ebp - 4], eax
call esi
push 0
push 0
push 0
push 0
mov dword [ebp - 0x10], eax
lea eax, [edi + 1]
mov edi, dword [ebp - 8]
push eax
push edi
push 0
push dword [ebp - 4]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ebx, [eax - 1]
lea eax, [ebx + 1]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
je 0x466fd1
push 0
push 0
lea eax, [ebx + 1]
push eax
push esi
push dword [ebp - 0xc]
push edi
push 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebx*2 + 1]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x467075
xor edx, edx
mov ecx, esi
mov esi, eax
test ebx, ebx
jle 0x46704b
mov al, byte [ecx]
test al, al
je 0x46704b
cmp al, 0xa
je 0x467009
cmp al, 0xd
je 0x467009
mov byte [esi], al
inc esi
jmp 0x467045
mov edi, dword [ebp - 0x10]
lea eax, [esi + 1]
cmp edi, 1
jne 0x46701b
mov byte [esi], 0xd
mov esi, eax
jmp 0x467030
cmp edi, 2
jne 0x467027
mov byte [esi], 0xa
mov esi, eax
jmp 0x467030
mov byte [esi], 0xd
mov esi, eax
mov byte [esi], 0xa
inc esi
cmp byte [ecx], 0xd
jne 0x467045
lea eax, [edx + 1]
cmp eax, ebx
jge 0x467045
cmp byte [ecx + 1], 0xa
jne 0x467045
mov edx, eax
inc ecx
inc edx
inc ecx
cmp edx, ebx
jl 0x466ff6
push dword [ebp - 8]
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
mov byte [esi], 0
call edi
mov ebx, dword [ebp - 0xc]
sub esi, ebx
inc esi
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
call edi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46e660
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push esi
push edi
push 0
push dword [ebp + 8]
mov edi, ecx
mov esi, edx
push 0x876
push edi
mov dword [ebp - 8], esi
call ebx
push 0
push esi
push 0x876
push edi
mov dword [ebp - 4], eax
call ebx
mov ecx, dword [0x5f0374]
mov esi, eax
push 0
push esi
push 0x8b8
mov edx, dword [ecx]
call dword [edx + 0x104]
mov edx, dword [ebp - 4]
cmp esi, edx
je 0x46e6c6
mov ecx, dword [0x5f0374]
push 0
push edx
push 0x8b8
mov eax, dword [ecx]
call dword [eax + 0x104]
push 0x32
push 0xd
push 0x962
push edi
call ebx
push 5
push 0xd
push 0x963
push edi
call ebx
push dword [ebp + 8]
push dword [ebp - 8]
push 0x870
push edi
call ebx
push 0x32
push 9
push 0x962
push edi
call ebx
push 0
push 8
push 0x963
push edi
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x473570
Capabilities:
Read .ini file

Disassembly:
push esi
mov esi, ecx
test edx, edx
je 0x4735fb
push edi
push 0x41f340
push 0x41f35c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x4735f8
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
or eax, 0x80000
push eax
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0x5e8d50
push 0x4b
push 0x41f36c
push 0x41ef2c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
js 0x4735d1
cmp eax, 0x64
jle 0x4735d6
mov eax, 0x4b
imul ecx, eax, 0xff
mov eax, 0x51eb851f
push 2
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
movzx eax, al
push eax
push 0
push esi
call edi
pop edi
pop esi
ret
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xfff7ffff
push eax
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_SetWindowLongW]
pop esi
ret
Function at 0x474450
Capabilities:
Get common file path
Get program files directory
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x684
mov eax, dword [0x5bd344]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x13
mov edi, ecx
push 0x41f3ac
push edi
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpynW]
test eax, eax
lea eax, [ebp - 0x414]
jne 0x4744a7
push eax
push 0
push 0
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [edi + 0x26]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
jmp 0x4744b0
push 0x104
push edi
push eax
call esi
push 0x138
lea eax, [ebp - 0x684]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x4744e2
push 0x104
lea eax, [ebp - 0x684]
push eax
lea eax, [ebp - 0x414]
push eax
call esi
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
push 0x104
test eax, eax
je 0x47452a
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
jmp 0x47453a
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCanonicalizeW]
test eax, eax
je 0x474566
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetDriveNumberW]
cmp eax, 0xffffffff
je 0x474587
push 1
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.USER32.dll_CharUpperBuffW]
mov eax, dword [ebp + 8]
mov ecx, 0x104
test eax, eax
cmove eax, ecx
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0057e93d
mov esp, ebp
pop ebp
ret