joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44ea85
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.0044ea01
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x44ebf4
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x44ebf4
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x44eba9
jg 0x44eae1
test eax, eax
je 0x44eb9f
push 1
push 0x1000
call fcn.00440bf0
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x44eb04
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x44eb96
push 0x8000
push ebx
call fcn.0043c4a9
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x44eb2d
jg 0x44eb28
cmp ecx, 0x1000
jb 0x44eb2d
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.00440440
add esp, 0x10
cmp eax, 0xffffffff
je 0x44eb72
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x44eb28
jl 0x44eb59
test ecx, ecx
jne 0x44eb1a
push dword [ebp - 0xc]
push ebx
call fcn.0043c4a9
push esi
call fcn.00440660
add esp, 0xc
xor ebx, ebx
jmp 0x44ec02
cmp byte [edi + 0x24], 0
je 0x44eb89
cmp dword [edi + 0x20], 5
jne 0x44eb89
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x44eb94
mov ebx, dword [edi + 0x18]
jmp 0x44eb96
xor ebx, ebx
push esi
call fcn.00440660
pop ecx
jmp 0x44ec02
test ecx, ecx
jg 0x44eb6b
jl 0x44eba9
test eax, eax
jae 0x44eb6b
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00443ae9
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x44ebc9
cmp byte [edi + 0x1c], 0
je 0x44eb6b
jmp 0x44ebfa
push ebx
call fcn.00446ea2
pop ecx
push eax
call dword [sym.imp.KERNEL32.DLL_SetEndOfFile]
test eax, eax
jne 0x44eb6b
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x44ec02
cmp byte [edi + 0x1c], 0
je 0x44ebff
mov ebx, dword [edi + 0x18]
jmp 0x44ec02
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.00443ae9
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x44f4d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x44f4fd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x44f4fd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4026b4
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040302c
test esi, esi
jne 0x4026ea
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004030f0
jmp 0x402708
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402568
mov edi, eax
test esi, esi
je 0x402708
cmp dword [ebx], 0
je 0x402708
dec esi
jmp 0x4026f1
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4027d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40400c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402868
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402848
xor eax, eax
push ebp
push 0x402841
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402884
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402848
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x40400c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x40400c], ax
mov esp, ebp
pop ebp
ret

Function at 0x402eb0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x405034], 0
je 0x402f11
cmp word [0x405208], 0xd7b2
jne 0x402ed9
cmp dword [0x405210], 0
jbe 0x402ed9
mov eax, 0x405204
call dword [0x405220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x40404c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x402f38
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x404018], 0
jne 0x402f2d
push 0
push 0x40406c
push 0x40404c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x4038c4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, 0x403894
call fcn.00403750
mov esi, 0x405714
xor eax, eax
push ebp
push 0x403a44
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00402654
cmp eax, 3
jl 0x403a29
lea edx, [ebp - 0x14]
mov eax, 1
call fcn.004026b4
mov eax, dword [ebp - 0x14]
mov edx, esi
call fcn.004032c4
mov ebx, eax
test ebx, ebx
je 0x403a29
lea edx, [ebp - 0x18]
mov eax, 2
call fcn.004026b4
mov eax, dword [ebp - 0x18]
call fcn.004031e8
push eax
push 0
push 2
call sub.kernel32.dll_OpenEventA
mov edi, eax
test edi, edi
je 0x403a29
push ebx
push 0
push 0x100000
call sub.kernel32.dll_OpenProcess
mov ebx, eax
push edi
call sub.kernel32.dll_SetEvent
test ebx, ebx
je 0x403a29
push 0x7530
push ebx
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x403a29
mov eax, 0x405718
call fcn.0040302c
call fcn.00402654
mov ebx, eax
sub ebx, 3
jl 0x4039df
inc ebx
mov dword [esi], 3
cmp dword [esi], 3
je 0x4039ae
mov eax, 0x405718
mov edx, 0x403a5c
call fcn.00403120
push dword [0x405718]
push 0x403a68
lea edx, [ebp - 0x1c]
mov eax, dword [esi]
call fcn.004026b4
push dword [ebp - 0x1c]
push 0x403a68
mov eax, 0x405718
mov edx, 4
call fcn.00403164
inc dword [esi]
dec ebx
jne 0x40399a
mov eax, 0x40572c
mov edx, 0x44
call fcn.0040382c
mov dword [0x40572c], 0x44
mov word [0x40575c], 5
push 0x40571c
push 0x40572c
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [0x405718]
call fcn.004031e8
push eax
push 0
call sub.kernel32.dll_CreateProcessA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403a4b
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403050
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x40ef7e16
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e3d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x53f26fa6
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x40ab5c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x5073a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10c]
push 0x105
push 0
push eax
mov dword [ebp - 0x110], esi
call fcn.004722a0
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0xffffffffffffffff
lea eax, [ebp - 0x10c]
mov ecx, esi
push eax
call sym.BearSCInstall.exe_public:_void___thiscall_DuiLib::CDuiString::constructor_char_const___int_
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00470058
leave
ret

Function at 0x40ba9a
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
push 0x11
call edi
push 8
pop ecx
test ax, ax
push 2
cmovs esi, ecx
call edi
test ax, ax
jns 0x40babd
or esi, 2
push 1
call edi
test ax, ax
jns 0x40bac9
or esi, 1
push 0x10
call edi
test ax, ax
jns 0x40bad5
or esi, 4
push 0x12
call edi
test ax, ax
jns 0x40bae1
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x40f14d
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov edi, ecx
call dword [sym.imp.USER32.dll_GetFocus]
cmp byte [ebp + 0xc], 0
mov esi, dword [ebp + 8]
je 0x40f185
cmp eax, dword [edi + 0x44]
je 0x40f185
cmp esi, dword [edi + 0xa8]
je 0x40f185
cmp byte [edi + 0xa0], 0
jne 0x40f185
push dword [edi + 0x44]
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [edi + 0xa8]
cmp esi, eax
je 0x40f26d
test eax, eax
je 0x40f1ed
and dword [ebp - 4], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x14], xmm0
movlpd qword [ebp - 0xc], xmm0
mov dword [ebp - 0x20], 0x14
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0xa8]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x11c]
push 1
xor eax, eax
mov ecx, edi
push eax
push eax
push eax
push str.killfocus
push dword [edi + 0xa8]
call sym.BearSCInstall.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___char_const___unsigned_int__long_int__bool__bool_
and dword [edi + 0xa8], 0
test esi, esi
je 0x40f26d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x24]
cmp eax, edi
jne 0x40f26d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xdc]
test al, al
je 0x40f26d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xe8]
test al, al
je 0x40f26d
and dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [edi + 0xa8], esi
movlpd qword [ebp - 0x14], xmm0
movlpd qword [ebp - 0xc], xmm0
mov dword [ebp - 0x20], 0x15
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0xa8]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x18], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x11c]
push 1
xor eax, eax
mov ecx, edi
push eax
push eax
push eax
push str.setfocus
push dword [edi + 0xa8]
call sym.BearSCInstall.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___char_const___unsigned_int__long_int__bool__bool_
pop edi
pop esi
leave
ret 8
Function at 0x427ae9
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x454], edi
je 0x427b54
cmp dword [ebp + 8], 0x100
jne 0x427b43
cmp byte [ebp + 0xc], 0xd
jne 0x427b43
cmp byte [esi + 0x45a], 0
je 0x427b28
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x427b43
cmp byte [esi + 0x45b], 0
jne 0x427b43
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x427b3f
push 1
push edi
push edi
push edi
push str.return
push esi
call sym.BearSCInstall.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___char_const___unsigned_int__long_int__bool__bool_
xor eax, eax
jmp 0x427b57
mov eax, dword [esi + 0x454]
pop edi
pop esi
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret 0x10

Function at 0x427f5c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5073a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x427ffa
mov al, byte [esi]
test al, al
je 0x427ffa
push edi
mov edi, esi
mov ecx, esi
cmp al, 0x2f
je 0x427f8e
cmp al, 0x5c
jne 0x427f90
mov edi, ecx
inc ecx
mov al, byte [ecx]
test al, al
jne 0x427f86
cmp edi, esi
je 0x427fcd
sub edi, esi
lea eax, [ebp - 0x108]
push edi
push esi
push eax
call fcn.0048a0ac
add esp, 0xc
cmp edi, 0x104
jae 0x428008
lea eax, [ebp - 0x108]
mov byte [ebp + edi - 0x108], 0
push eax
push ebx
call fcn.00427f5c
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.00489b20
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00489b30
add esp, 0x10
lea eax, [ebp - 0x20c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00470058
leave
ret
call fcn.00470ea4
int3

Function at 0x428874
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x4288f0
cmp dword [edi + 4], 0xffffffff
jne 0x4288f0
push esi
lea esi, [edi + 0x138]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x4c09d4
push esi
call fcn.00489b30
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
pop esi
jne 0x4288c2
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x4288c2
mov eax, 0x2000000
jmp 0x4288f5
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0042ad66
add esp, 0x10
test eax, eax
jne 0x4288e0
mov eax, dword [ebp - 4]
jmp 0x4288f5
push eax
call fcn.0042b581
mov dword [edi], eax
mov eax, dword [0x509f04]
pop ecx
jmp 0x4288f5
mov eax, 0x1000000
pop edi
leave
ret 0xc
Function at 0x42ae73
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
imul ecx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
cmp byte [edi], 0
je 0x42aea6
push 0
lea eax, [ebp + 0x10]
push eax
push ecx
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x42aea1
mov byte [edi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x42aed0
mov edx, dword [edi + 0x18]
push esi
mov esi, dword [edi + 0x14]
sub esi, edx
lea eax, [edx + ecx]
cmp eax, dword [edi + 0x14]
cmovbe esi, ecx
mov ecx, dword [edi + 0x10]
push esi
add ecx, edx
push ecx
push dword [ebp + 8]
call fcn.00472400
add esp, 0xc
mov eax, esi
add dword [edi + 0x18], esi
pop esi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop ebp
ret

Function at 0x42b05e
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x42b06c
xor eax, eax
pop ebp
ret
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not ecx
cmp esi, 8
jb 0x42b12b
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4c0298]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4c0298]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4c0298]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4c0298]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4c0298]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4c0298]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4c0298]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4c0298]
sub edi, 1
jne 0x42b084
pop edi
test esi, esi
je 0x42b147
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4c0298]
inc edx
sub esi, 1
jne 0x42b12f
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x432da2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 8]
mov edi, eax
mov edx, eax
and edi, 7
je 0x432dd0
cmp eax, edi
jge 0x432dc4
push esi
call fcn.0042ef9e
mov eax, dword [esi + 8]
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub eax, edi
mov dword [esi + 8], eax
mov edx, eax
xor ecx, ecx
test eax, eax
jle 0x432df3
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x432dd9
mov dword [esi + 8], edx
jmp 0x432e08
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jb 0x432dfe
xor dl, dl
jmp 0x432e03
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x432df3
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x432e42
push str.zlib_corrupt
call fcn.0042eec9
add esp, 4
jmp 0x432e82
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x432e52
push str.read_past_buffer
jmp 0x432e38
mov ecx, dword [esi + 0x10]
lea eax, [ecx + edi]
cmp eax, dword [esi + 0x18]
jbe 0x432e6c
push edi
push ecx
push esi
call fcn.00435cb4
add esp, 0xc
test eax, eax
je 0x432e82
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.00472400
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret
Function at 0x436d33
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov ebx, ecx
push 4
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindow]
push 1
push dword [ebx + 4]
mov esi, eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
push 7
pop ecx
push dword [ebx + 4]
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_IsWindow]
mov edi, dword [sym.imp.USER32.dll_SetFocus]
jmp 0x436de2
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x436de6
cmp dword [ebp - 0x1c], 0x10
jne 0x436db1
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebx + 4]
jne 0x436db1
mov eax, dword [ebp - 0x18]
push 1
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
call edi
lea eax, [ebp - 0x20]
push eax
call sym.BearSCInstall.exe_public:_static_bool___cdecl_DuiLib::CPaintManagerUI::TranslateMessage_struct_tagMSG__const_
pop ecx
test al, al
jne 0x436dd3
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [ebp - 0x1c], 0x12
je 0x436de6
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x436d7e
push 1
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
push esi
call edi
cmp dword [ebp - 0x1c], 0x12
pop edi
pop esi
pop ebx
jne 0x436e04
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [ebp - 4]
leave
ret

Function at 0x436e09
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x436e3b
xor eax, eax
inc eax
cmp byte [ebp + 0xc], 0
push 4
pop edx
cmovne edx, eax
xor eax, eax
cmp byte [ebp + 8], al
cmovne eax, edx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
Function at 0x44137f
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5073a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call sym.BearSCInstall.exe_public_virtual:_void___thiscall_DuiLib::CControlUI::Move_struct_tagSIZE__bool_
mov ecx, dword [esi + 0x498]
test ecx, ecx
je 0x4413fb
lea eax, [ebp - 0x14]
push eax
call fcn.00440943
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
mov ecx, dword [esi + 0x498]
test eax, eax
je 0x4413d7
push 0
call sym.BearSCInstall.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4413fb
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0
call sym.BearSCInstall.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00470058
leave
ret 0xc

Function at 0x44140a
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x5073a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x18], 0
je 0x441493
cmp dword [esi + 0x10], 0
je 0x441493
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea edi, [eax + 1]
mov eax, edi
call fcn.00470630
mov ebx, esp
test ebx, ebx
je 0x441493
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esi + 0x10]
push ebx
add ecx, 0x164
call fcn.004089e9
mov ecx, dword [esi + 0x10]
xor eax, eax
push 1
push eax
push eax
push eax
mov eax, dword [ecx]
push str.textchanged
push ecx
call dword [eax + 0x24]
mov ecx, eax
call sym.BearSCInstall.exe_public:_void___thiscall_DuiLib::CPaintManagerUI::SendNotify_class_DuiLib::CControlUI___char_const___unsigned_int__long_int__bool__bool_
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, eax
call sym.BearSCInstall.exe_public:_bool___thiscall_DuiLib::CPaintManagerUI::IsLayered_void_
test al, al
je 0x441493
mov ecx, dword [esi + 0x10]
call sym.BearSCInstall.exe_public:_void___thiscall_DuiLib::CControlUI::Invalidate_void_
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00470058
leave
ret 0x10
Function at 0x441b15
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x5073a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [ebp + 0x18]
lea esi, [ebp + 8]
mov ebx, ecx
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call sym.BearSCInstall.exe_public_virtual:_void___thiscall_DuiLib::CControlUI::SetPos_struct_tagRECT__bool_
mov ecx, dword [ebx + 0x498]
test ecx, ecx
je 0x441b99
lea eax, [ebp - 0x14]
push eax
call fcn.00440943
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
mov ecx, dword [ebx + 0x498]
test eax, eax
je 0x441b75
push 0
call sym.BearSCInstall.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x441b99
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push 0x54
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0
call sym.BearSCInstall.exe_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::operator_struct_HWND____void_const
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00470058
leave
ret 0x14