joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445c48
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, eax
mov eax, dword [ebp + 0xc]
sub edi, dword [esi + 0x1c]
sub eax, dword [esi + 0x18]
mov edx, dword [esi]
push 1
xor ebx, ebx
push edi
push eax
mov ecx, esi
mov dword [ebp + 0xc], eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call dword [edx + 0x74]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x144]
cmp eax, ebx
mov dword [ebp - 0x14], eax
je 0x445d81
push eax
call fcn.0043239e
mov ebx, eax
test ebx, ebx
pop ecx
je 0x445d4e
mov eax, dword [ebx + 0x14]
push 2
mov dword [ebp - 0xc], eax
mov eax, dword [ebx]
push 0
mov ecx, ebx
call dword [eax + 0x28]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x34]
test eax, eax
je 0x445cc2
lea eax, [ebx + 0x18]
push eax
call fcn.00432df3
movzx eax, word [ebp + 0xc]
movzx edi, di
shl edi, 0x10
or edi, eax
push edi
push dword [ebp + 8]
mov ecx, ebx
push 0x202
call fcn.0043288a
mov eax, dword [ebp - 0x10]
cmp dword [esi + 0x144], eax
jne 0x445d18
mov ecx, dword [ebx + 0x44]
xor eax, eax
cmp ecx, eax
je 0x445d0a
cmp word [ecx], ax
je 0x445d0a
push 1
push eax
push eax
push ecx
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x445d4e
cmp dword [ebx + 0x14], eax
je 0x445d4e
mov dword [ebp - 4], 1
jmp 0x445d4e
mov eax, dword [ebx]
push 1
push 0
mov ecx, ebx
call dword [eax + 0x28]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x34]
test eax, eax
je 0x445d37
lea eax, [ebx + 0x18]
push eax
call fcn.00432df3
push edi
push dword [ebp + 8]
mov ecx, ebx
push 0x2a3
call fcn.0043288a
mov dword [ebp - 8], 1
xor ecx, ecx
cmp dword [ebp - 4], ecx
mov dword [esi + 0x144], ecx
je 0x445d5f
push 0x67
jmp 0x445d7a
cmp dword [ebp - 8], ecx
je 0x445d81
cmp dword [ebp - 0xc], ecx
je 0x445d81
mov edx, dword [ebp - 0x14]
lea eax, [esi + 0x140]
cmp edx, dword [eax]
jne 0x445d78
mov dword [eax], ecx
push 0x6a
mov edi, ebx
call fcn.00445875
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x447ee4
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x50cd18
call fcn.00509d88
sub esp, 0x10
push dword [ebp + 8]
lea eax, [ebp + 8]
push eax
call fcn.00405b50
and dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0xe]
push eax
movzx eax, word [ebp - 0x10]
push eax
movzx eax, word [ebp - 0x12]
push eax
movzx eax, word [ebp - 0x14]
push eax
push str.__02d__02d__02d__03d__n
lea ecx, [ebp + 8]
call fcn.00427e57
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.004058cb
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 4
Function at 0x449b8c
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x11c
push esi
push edi
mov esi, 0x11c
push esi
xor edi, edi
lea eax, [ebp - 0xa4]
push edi
push eax
call fcn.004ec700
add esp, 0xc
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
cmp eax, edi
jne 0x449be5
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0xa4], 0x114
call esi
cmp eax, edi
je 0x449c93
mov eax, dword [ebp - 0x94]
dec eax
je 0x449c7f
dec eax
jne 0x449c93
cmp dword [ebp - 0xa0], 6
jne 0x449c30
inc eax
cmp dword [ebp - 0x9c], eax
jne 0x449c18
xor ecx, ecx
cmp byte [ebp + 0x76], al
setne cl
add ecx, 8
jmp 0x449c2c
cmp dword [ebp - 0x9c], edi
jne 0x449c6c
xor ecx, ecx
cmp byte [ebp + 0x76], al
setne cl
lea ecx, [ecx + ecx + 7]
mov edi, ecx
jmp 0x449c93
cmp dword [ebp - 0xa0], 5
jne 0x449c5f
cmp dword [ebp - 0x9c], 2
jne 0x449c46
push 5
jmp 0x449c7c
cmp dword [ebp - 0x9c], 1
jne 0x449c53
push 6
jmp 0x449c7c
cmp dword [ebp - 0x9c], edi
jne 0x449c93
push 3
jmp 0x449c7c
cmp dword [ebp - 0xa0], 4
ja 0x449c93
push 4
jmp 0x449c7c
cmp dword [ebp - 0x9c], 2
jne 0x449c93
cmp byte [ebp + 0x76], al
jne 0x449c93
push 0xa
pop edi
jmp 0x449c93
mov eax, dword [ebp - 0x98]
and eax, 0xffff0000
cmp eax, 0x45a0000
sbb edi, edi
inc edi
inc edi
mov eax, edi
pop edi
pop esi
add ebp, 0x78
leave
ret
Function at 0x44ff85
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
xor esi, esi
mov edi, eax
cmp edi, esi
mov ebx, ecx
mov dword [esp + 0x1c], esi
jne 0x44ffba
mov eax, dword [0x55abf0]
cmp eax, esi
je 0x44ffa8
mov edi, dword [eax + 4]
jmp 0x44ffaa
xor edi, edi
cmp edi, esi
jne 0x44ffba
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov edi, eax
cmp edi, esi
je 0x44ffdf
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp edi, eax
je 0x44ffdf
push edi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x44ffdf
push esi
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [esp + 0x1c], 1
push edi
mov ecx, ebx
mov dword [ebx + 0x438], esi
call fcn.004508a3
mov ecx, eax
cmp ecx, esi
mov dword [esp + 0x18], ecx
jne 0x450007
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
jmp 0x450127
mov eax, dword [0x55abf0]
cmp eax, esi
mov dword [esp + 0x20], esi
je 0x45001e
mov edx, dword [eax + 4]
mov dword [esp + 0x20], edx
mov dword [eax + 4], ecx
mov eax, edi
call fcn.00450a44
cmp dword [ebx + 0x428], esi
je 0x4500c3
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push esi
push esi
push esi
push 0x2001
mov dword [esp + 0x24], eax
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
cmp ebp, dword [esp + 0x14]
je 0x45006c
push 1
push ebp
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 5
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x43
push esi
push esi
push esi
push esi
push esi
push dword [esp + 0x30]
call dword [sym.imp.USER32.dll_SetWindowPos]
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
cmp ebp, dword [esp + 0x14]
je 0x4500a4
push esi
push ebp
push dword [esp + 0x1c]
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 0xffffffffffffffec
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x80000
je 0x4500c3
push esi
push esi
push 0xf
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x2c]
push 0x97
push esi
push esi
push esi
push esi
push esi
push dword [ebx + 4]
mov dword [ebx + 0x438], esi
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp dword [esp + 0x1c], esi
je 0x450108
push 1
push edi
call dword [sym.imp.USER32.dll_EnableWindow]
cmp edi, esi
je 0x450108
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [ebx + 4]
jne 0x450108
push edi
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [0x55abf0]
cmp eax, esi
je 0x450118
mov ecx, dword [esp + 0x20]
mov dword [eax + 4], ecx
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebx + 0x43c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x45276b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
push 1
push dword [ebp + 0x10]
lea ecx, [esi + 0x28]
push dword [ebp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov edi, eax
test edi, edi
jne 0x4527b7
push 1
push dword [ebp + 0x10]
lea ecx, [esi + 0x150]
push dword [ebp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov edi, eax
test edi, edi
jne 0x4527b7
push 1
push dword [ebp + 0x10]
lea ecx, [esi + 0x278]
push dword [ebp + 0xc]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov edi, eax
cmp dword [esi + 0x3bc], 0
je 0x45282f
lea ebx, [esi + 0x3cc]
cmp dword [ebx], 0
je 0x4527d4
call dword [sym.imp.USER32.dll_ReleaseCapture]
and dword [ebx], 0
cmp dword [esi + 0x3bc], edi
jne 0x452828
push edi
call fcn.0043239e
mov edi, eax
movzx eax, word [ebp + 0x10]
pop ecx
movzx ecx, word [ebp + 0xc]
shl eax, 0x10
or eax, ecx
push eax
push dword [ebp + 8]
mov ecx, edi
push 0x205
call fcn.0043288a
mov eax, dword [esi + 4]
or dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0xd
mov dword [ebp - 0x14], eax
mov ecx, dword [edi + 0x14]
mov dword [ebp - 8], ecx
lea ecx, [ebp - 0x14]
push ecx
push 0xffffffffffffffff
push 0x4e
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
and dword [esi + 0x3bc], 0
pop edi
pop ebx
leave
ret 0xc
Function at 0x452af5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov esi, eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
xor ebx, ebx
lea edi, [esi + 0x3cc]
cmp dword [edi], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
je 0x452b26
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov dword [edi], ebx
mov ebx, dword [ebp + 0x10]
push 1
push ebx
push dword [ebp + 0xc]
lea ecx, [esi + 0x28]
mov eax, dword [ecx]
call dword [eax + 0x30]
test eax, eax
mov dword [ebp - 4], eax
jne 0x452b6a
push 1
push ebx
push dword [ebp + 0xc]
lea ecx, [esi + 0x150]
mov eax, dword [ecx]
call dword [eax + 0x30]
test eax, eax
mov dword [ebp - 4], eax
jne 0x452b6a
push 1
push ebx
push dword [ebp + 0xc]
lea ecx, [esi + 0x278]
mov eax, dword [ecx]
call dword [eax + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x3b8]
test eax, eax
mov dword [ebp - 0x14], eax
je 0x452cbe
push eax
call fcn.0043239e
mov edi, eax
test edi, edi
pop ecx
je 0x452c3d
mov eax, dword [edi + 0x14]
push 2
mov dword [ebp - 8], eax
mov eax, dword [edi]
push 0
mov ecx, edi
call dword [eax + 0x28]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x34]
test eax, eax
je 0x452bb1
push 1
push edi
push esi
call fcn.00450bbc
movzx eax, word [ebp + 0xc]
movzx ebx, bx
shl ebx, 0x10
or ebx, eax
push ebx
push dword [ebp + 8]
mov ecx, edi
push 0x202
call fcn.0043288a
mov eax, dword [ebp - 4]
cmp dword [esi + 0x3b8], eax
jne 0x452c07
mov ecx, dword [edi + 0x44]
xor eax, eax
cmp ecx, eax
je 0x452bf9
cmp word [ecx], ax
je 0x452bf9
push 1
push eax
push eax
push ecx
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x452c3d
cmp dword [edi + 0x14], eax
je 0x452c3d
mov dword [ebp - 0xc], 1
jmp 0x452c3d
mov eax, dword [edi]
push 1
push 0
mov ecx, edi
call dword [eax + 0x28]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x34]
test eax, eax
je 0x452c26
push 1
push edi
push esi
call fcn.00450bbc
push ebx
push dword [ebp + 8]
mov ecx, edi
push 0x2a3
call fcn.0043288a
mov dword [ebp - 0x10], 1
xor eax, eax
cmp dword [ebp - 0xc], eax
mov dword [esi + 0x3b8], eax
je 0x452c7f
mov eax, dword [esi + 4]
or dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [edi]
mov ecx, edi
mov dword [ebp - 0x20], 1
call dword [eax + 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x24]
push 0x4e
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x452cbe
cmp dword [ebp - 0x10], eax
je 0x452cbe
mov ecx, dword [ebp - 8]
cmp ecx, eax
je 0x452cbe
mov eax, dword [esi + 4]
or dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x28]
push ecx
push 0xffffffffffffffff
push 0x4e
push eax
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x28], eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x14]
add esi, 0x3b4
cmp eax, dword [esi]
jne 0x452cbe
and dword [esi], 0
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x453297
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x50dad0
call fcn.00509d88
sub esp, 0x7c
push ebx
push esi
push edi
lea eax, [ebp - 0x88]
push eax
mov esi, ecx
call fcn.0040177e
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x408], ebx
mov dword [esi + 0x3fc], ebx
mov dword [esi + 0x3e8], 0x80090000
mov dword [esi + 0x3ec], 0x10000
call fcn.00450b5c
push 1
push ebx
push dword [ebp + 8]
lea ecx, [ebp - 0x88]
mov dword [esi + 0x3f0], ebx
mov dword [esi + 0x3f4], ebx
mov dword [esi + 0x3f8], ebx
call fcn.0040340c
cmp byte [ebp - 0x44], bl
je 0x453379
cmp dword [ebp - 0x24], 0x10
mov eax, dword [ebp - 0x38]
jae 0x453313
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp + 8]
push eax
call fcn.00408347
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x18]
inc eax
push eax
mov eax, dword [ebp - 0x1c]
inc eax
push eax
push dword [ebp - 0x40]
lea ecx, [ebp + 8]
push str.__errorid_d__errorrow_d__errorcolom_d_n
call fcn.004545d0
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call fcn.004541bc
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.004058cb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x88]
call fcn.00402b4a
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, ebx
mov dword fs:[0], ecx
pop ebx
leave
ret 4
lea eax, [ebp - 0x88]
call fcn.004028c0
push eax
mov edi, esi
call fcn.00453c29
mov ebx, eax
jmp 0x453357

Function at 0x455de3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x455e46
cmp dword [ebp + 0xc], 1
je 0x455e1f
cmp dword [ebp + 0xc], 2
je 0x455e1f
push 0xd
pop eax
jmp 0x455e46
test edi, edi
mov eax, dword [ebp - 4]
je 0x455e40
test eax, eax
je 0x455e3c
test al, 1
jne 0x455e1a
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x455e40
jmp 0x455e1a
and word [edi], 0
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8
Function at 0x45742a
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, 0x50dd63
call fcn.00509d88
sub esp, 0x21c
mov eax, dword [0x559aac]
push ebx
push esi
push edi
mov ecx, 0x559aac
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
xor ebx, ebx
push 0x206
lea eax, [ebp - 0x226]
push ebx
mov dword [ebp - 4], ebx
push eax
mov word [ebp - 0x228], bx
call fcn.004ec700
add esp, 0xc
push 0x104
lea eax, [ebp - 0x228]
push eax
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00405d6b
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00405d6b
push 0x2e
lea esi, [ebp - 0x10]
call fcn.0040608e
cmp eax, 0xffffffff
je 0x4574df
mov ecx, eax
lea edx, [ebp - 0x14]
mov eax, esi
call fcn.00406198
mov edi, esi
mov byte [ebp - 4], 1
call fcn.00404ebe
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.004058cb
mov eax, dword [0x559aac]
mov ecx, 0x559aac
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
mov byte [ebp - 4], 2
fld1
lea eax, [ebp - 0x10]
fstp qword [ebp - 0x20]
push eax
call fcn.0045712a
test eax, eax
jne 0x45753c
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.004058cb
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004058cb
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0xc
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0x457577
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.004058cb
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004058cb
mov eax, ebx
jmp 0x45752b
push ebx
push eax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, ebx
je 0x4575df
mov esi, dword [ebp + 0xc]
push ebx
lea eax, [ebp - 0x14]
push eax
push edi
lea eax, [edi + 0xa]
push eax
mov dword [ebp - 0x14], ebx
call fcn.004066bc
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
cmp esi, ebx
je 0x4575d5
cmp dword [ebp - 0x14], edi
jne 0x4575d5
mov eax, dword [ebp + 0x10]
cmp eax, ebx
je 0x4575bd
fld qword [ebp - 0x20]
fstp qword [eax]
mov esi, dword [ebp + 0xc]
mov eax, edi
call fcn.00408392
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
inc ebx
jmp 0x45755d
mov edx, dword [ebp + 0xc]
xor eax, eax
call fcn.004066e2
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, esi
jmp 0x45755d
Function at 0x459a6a
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x50bb5b
call fcn.00509d88
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [esi + 4], edi
mov dword [ebp - 4], edi
fld1
fstp qword [esi + 0x10]
mov dword [esi], vtable.CBkPngSkin.0
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x4c], edi
mov eax, vtable.CBkBitmap.0
mov dword [esi + 0x48], eax
mov dword [esi + 0x58], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x60], eax
mov dword [esi + 0x70], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov byte [ebp - 4], 2
mov dword [esi + 0x74], edi
call fcn.00460885
lea ecx, [esi + 0x7c]
mov dword [ecx], eax
mov byte [eax + 0x15], 1
mov eax, dword [ecx]
mov dword [eax + 4], eax
mov eax, dword [ecx]
mov dword [eax], eax
mov ecx, dword [ecx]
mov dword [ecx + 8], ecx
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x80], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x45d794
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x45d80b
xor eax, eax
mov dword [ebp - 0xc], esi
lea edi, [ebp - 8]
stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x45d80b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
shrd ecx, eax, 0x14
shr eax, 0x14
mov dword [ebp - 8], eax
and dword [ebp - 8], 0x80000000
and eax, 0x7fffffff
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], esi
fild qword [ebp - 0x14]
fild qword [ebp - 0xc]
fchs
faddp st(1)
fmul qword [0x53f980]
fcomp qword [0x53f978]
fnstsw ax
test ah, 1
jne 0x45d80b
inc esi
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x45ddb4
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [edi + 0xa8c], 0
jne 0x45ddf0
push esi
lea esi, [ebp - 4]
call fcn.0045ddf8
push dword [eax]
push 2
push 0x53b2bc
push str.basesetting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [edi + 0xa8c], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.004058cb
pop esi
mov eax, dword [edi + 0xa8c]
leave
ret
Function at 0x45dfbb
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
mov eax, 0x50e140
call fcn.00509d88
push ecx
push esi
xor eax, eax
mov esi, ecx
cmp dword [esi + 0x924], 1
push edi
sete al
mov edi, eax
call fcn.00407a3f
cmp eax, 6
jg 0x45e007
test edi, edi
jne 0x45e023
push 2
push 2
push 0x53ed64
push dword [esi + 0x920]
push str._rN_e
push dword [esi + 4]
call fcn.0044f42a
add esp, 0x18
jmp 0x45e023
push esi
call fcn.0045e09e
test eax, eax
jne 0x45e023
call fcn.0045e22a
test eax, eax
je 0x45e023
xor eax, eax
mov ecx, esi
call fcn.0044ff85
call fcn.00455e5b
mov esi, eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45e043
test al, 0x10
jne 0x45e043
push dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
leave
ret

Function at 0x45e09e
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x50e136
call fcn.00509d88
sub esp, 0xc
and dword [ebp - 0x10], 0
push ebx
push esi
push edi
and dword [ebp - 4], 0
mov eax, dword [0x559aac]
mov edi, 0x559aac
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push 1
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.0045de62
mov byte [ebp - 4], 2
push dword [eax]
lea eax, [ebp - 0x14]
push dword [0x55aa70]
call fcn.00406296
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
add eax, 0xfffffff0
call fcn.004058cb
call fcn.004651d9
lea esi, [ebp - 0x18]
call fcn.00465224
mov eax, dword [eax]
push 1
push eax
lea esi, [ebp - 0x10]
call fcn.0040794b
mov ebx, eax
mov eax, dword [ebp - 0x18]
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
call fcn.004058cb
test bl, bl
jne 0x45e1fd
mov eax, dword [0x559aac]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push str.installpath
mov ebx, esi
mov byte [ebp - 4], 3
call fcn.00405e03
test eax, eax
mov ebx, dword [ebp - 0x18]
je 0x45e1f5
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45e1f5
mov esi, dword [ebp + 8]
lea edi, [esi + 0xa84]
lea eax, [ebp - 0x18]
call fcn.00404ebe
xor eax, eax
inc eax
cmp dword [esi + 0x924], eax
mov dword [esi + 0x928], eax
je 0x45e1f5
mov eax, dword [esi + 0x920]
mov edi, dword [ebp - 0x14]
xor ecx, ecx
push ecx
push 3
push ecx
push eax
push edi
push ecx
call fcn.0044f42a
add esp, 0x18
test al, 1
je 0x45e1e8
call fcn.00465d5b
push dword [esi + 0x928]
push 2
call fcn.00465dc1
lea eax, [ebx - 0x10]
call fcn.004058cb
lea eax, [edi - 0x10]
call fcn.004058cb
cmp dword [ebp - 0x10], 0
je 0x45e1e3
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x45e219
lea eax, [ebx - 0x10]
call fcn.004058cb
lea eax, [edi - 0x10]
jmp 0x45e203
lea eax, [ebx - 0x10]
call fcn.004058cb
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.004058cb
cmp dword [ebp - 0x10], 0
je 0x45e217
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x45edd5
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push 0x1e
mov esi, eax
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
push ebx
lea edi, [esi + 0x24]
push 0x64
mov eax, edi
call fcn.00450460
push 1
push 0xc8
mov eax, edi
call fcn.00450460
push ebx
call fcn.0045f4b8
push ebx
push ebx
push esi
push 0x45edbc
push ebx
push ebx
call fcn.004efc47
add esp, 0x18
pop edi
mov dword [esi + 0x91c], eax
pop esi
pop ebx
ret

Function at 0x45f13f
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push dword [edi]
lea esi, [ebp - 4]
call fcn.004289ea
mov eax, dword [ebp - 4]
pop ecx
add eax, 0xfffffff0
call fcn.004058cb
mov eax, dword [edi]
push 3
pop esi
cmp dword [eax - 0xc], esi
jl 0x45f200
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45f182
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 1
je 0x45f200
mov ecx, esi
lea edx, [ebp - 4]
mov eax, edi
call fcn.00406198
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, esi
mov eax, dword [ebp - 4]
setne bl
add eax, 0xfffffff0
call fcn.004058cb
test bl, bl
je 0x45f1af
push 2
pop eax
jmp 0x45f203
push edi
call fcn.0045f0b3
test eax, eax
pop ecx
je 0x45f1be
mov eax, esi
jmp 0x45f203
mov ecx, esi
lea edx, [ebp - 4]
mov eax, edi
call fcn.00406198
push dword [eax]
call fcn.0045d794
mov ebx, eax
mov eax, dword [ebp - 4]
neg ebx
sbb bl, bl
pop ecx
add eax, 0xfffffff0
inc bl
call fcn.004058cb
test bl, bl
je 0x45f1ed
push 4
jmp 0x45f1ac
mov eax, dword [edi]
cmp dword [eax - 0xc], 0x96
jle 0x45f1fc
push 5
jmp 0x45f1ac
xor eax, eax
jmp 0x45f203
xor eax, eax
inc eax
pop esi
pop ebx
leave
ret