joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401220
Capabilities:
Create thread
Delete file
Get common file path
Terminate process

Disassembly:
sub esp, 0x220
push ebx
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x12d]
mov byte [esp + 0x12c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x12c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x10]
call fcn.004018d0
lea ecx, [esp + 0x12c]
push 0
push ecx
lea ecx, [esp + 0x18]
call fcn.004018e0
test eax, eax
jne 0x40129c
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [esp + 0x12c]
push 0
push edx
lea ecx, [esp + 0x18]
call fcn.004018e0
test eax, eax
je 0x40127a
lea ecx, [esp + 0x10]
call fcn.00401a90
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
push 8
mov dword [0x401aa4], eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x401aa4]
mov dword [0x401aa0], eax
push ecx
push eax
lea ecx, [esp + 0x18]
jmp 0x402c16

Function at 0x4014f0
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
mov eax, dword [esp + 4]
push esi
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40151e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, esi
pop esi
ret

Function at 0x401570
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x214
lea eax, [esp]
mov dword [esp], 0
push eax
push 0xf003f
push 0
push 0x4011c0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401662
mov ecx, dword [0x4011b0]
mov eax, dword [0x4011b8]
mov edx, dword [0x4011b4]
mov dword [esp + 0xc], ecx
mov cx, word [0x4011bc]
push edi
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], cx
mov ecx, 0x3d
xor eax, eax
lea edi, [esp + 0x1e]
mov dword [esp + 0x14], edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x115]
mov byte [esp + 0x114], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edx, [esp + 0xc]
lea eax, [esp + 0x114]
push edx
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push ecx
lea edx, [esp + 0x1c]
push 0
push edx
push eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x401656
mov edx, dword [esp + 0x21c]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov edx, dword [esp + 0xc]
push 1
lea ecx, [esp + 0x1c]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
add esp, 0x214
ret
Function at 0x401000
Capabilities:
Allocate thread local storage

Disassembly:
push 0x3c
push 0
push 0x40fb88
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0x40fb8c], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x40fb88], eax
mov eax, 0x40ea38
mov dword [0x40fb94], eax
call fcn.0040325f
call fcn.0040be90
call fcn.0040bd10
call fcn.0040ba6d
call fcn.0040ad01
call fcn.0040a71c
call fcn.0040a12e
call fcn.0040a094
call fcn.004095e0
call fcn.0040771c
call fcn.00406fc0
call fcn.004064d6
call fcn.004059ba
call fcn.00405901
call fcn.004056d4
call fcn.00404499
call fcn.00403bbd
call fcn.00403940
call fcn.004032a8
mov edx, dword [0x40fe44]
push edx
push edx
mov edx, dword [0x40fe44]
push edx
push edx
call fcn.004032d7
mov edx, dword [0x40ea58]
add dword [esp], edx
call fcn.0040a13a
add dword [0x40fe44], 2
push 0x40fb9c
call fcn.0040bf10
mov dword [0x40fba0], 0
push 0x40fbb4
push 0x40ea30
push 8
push 0x65
push 4
call fcn.0040ba96
push 0x40fbbc
push 0x40ea30
push 8
push 0x65
push 4
call fcn.0040ba96
call fcn.00401e83
push 0
jmp 0x401133
call 0x40114d
call fcn.0040bee0
push dword [0x40fb88]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
Function at 0x401be4
Capabilities:
Shutdown system

Disassembly:
push 2
mov eax, str.SeShutdownPrivilege
push eax
call fcn.00401c48
movsx eax, byte [esp + 4]
push eax
push 0
push 1
mov eax, str.Exit
push eax
push 0
call sub.ADVAPI32.dll_InitiateSystemShutdownW
xor eax, eax
ret 4

Function at 0x401e83
Capabilities:
Hide graphical window

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
mov byte [esp + 8], 0xff
call fcn.004017f8
mov ebx, dword [0x40fb90]
imul ebx, ebx, 0x1e
add ebx, 0x34
mov dword [esp + 4], ebx
push dword [esp + 4]
push 0x140
push 0
push 0
call fcn.00401a4d
push 0
call fcn.004048d0
mov dword [0x40fbb0], eax
call fcn.00404a17
push eax
mov ebx, 0x333c
cmp ebx, dword [esp]
jne 0x401ee6
push 0
jmp 0x401133
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x401f5d
mov dword [esp + 4], 1
jmp 0x401efa
mov eax, dword [0x40fb90]
cmp eax, dword [esp + 4]
jl 0x401f41
push dword [esp + 4]
call fcn.004041e5
and eax, eax
je 0x401f3b
push 0
push dword [0x40fbb0]
call sub.USER32.dll_ShowWindow
push dword [esp + 4]
call fcn.0040118a
push 5
push dword [0x40fbb0]
call sub.USER32.dll_ShowWindow
inc dword [esp + 4]
jno 0x401efa
call fcn.0040a836
push eax
mov ebx, dword [0x40fbac]
cmp ebx, dword [esp]
jne 0x401f5c
push 0
jmp 0x401133
pop eax
pop eax
movsx ebx, byte [esp + 8]
and ebx, ebx
jl 0x401eca
xor eax, eax
add esp, 0xc
pop ebx
ret
Function at 0x4053df
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
xor edi, edi
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, dword [esp + 0x3c]
mov ebx, eax
and dword [esp + 0x10], edi
push str.PB_WindowID
push ebp
call dword [sym.imp.USER32.dll_GetPropW]
mov esi, eax
push 9
pop eax
test esi, esi
je 0x405477
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x405474
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x14], eax
jne 0x405474
lea eax, [esi - 1]
push eax
push dword [0x40fea0]
call fcn.0040b330
mov edi, eax
mov dword [esp + 0x10], 1
xor eax, eax
push 9
cmp dword [edi + 0x10], eax
jle 0x405476
mov edx, dword [edi + 4]
xor ecx, ecx
pop esi
cmp word [ecx + edx + 2], si
jne 0x40546b
mov esi, GetKeyState
push 9
cmp word [ecx + edx + 4], si
je 0x40555e
pop esi
inc eax
add ecx, 6
cmp eax, dword [edi + 0x10]
jl 0x405451
push 9
pop eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
test ebx, ebx
je 0x40551d
push eax
call esi
test al, al
jns 0x40551d
push 0x11
call esi
test al, al
js 0x40551d
push 0x10
call esi
test al, al
js 0x40551d
push 0x12
call esi
test al, al
js 0x40551d
push 0x10
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
cmp dword [esp + 0x10], 0
jne 0x40551d
push 5
lea eax, [esp + 0x1c]
push str.RichE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
je 0x4054f1
push 4
lea eax, [esp + 0x1c]
push str.RICHE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
jne 0x405508
push 0
push 0
push 0x44e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, 0x800
je 0x405568
lea eax, [esp + 0x18]
push str.Scintilla
push eax
call sub.MSVCRT.dll_wcscmp
pop ecx
pop ecx
test eax, eax
je 0x405568
test ebp, ebp
je 0x405541
push 0x11
call esi
test al, al
js 0x405539
push 0x10
call esi
test al, al
js 0x405539
push 0x12
call esi
test al, al
jns 0x405541
push 1
push ebp
call fcn.00405574
test ebx, ebx
je 0x405555
push str.PB_Hotkey
push ebx
call dword [sym.imp.USER32.dll_GetPropW]
test eax, eax
jne 0x405568
test edi, edi
je 0x405568
mov eax, dword [edi + 8]
jmp 0x40556a
and dword [esp + 0x14], 0
jmp 0x405476
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4

Function at 0x4076b0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x4076e2
push 0
lea ecx, [esp + 0x10]
push ecx
push esi
push dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4076dd
cmp dword [esp + 0xc], esi
je 0x4076f9
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [edi + 4]
add eax, dword [edi + 8]
push esi
push dword [esp + 0x14]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
add dword [edi + 8], esi
pop edi
mov eax, 1
pop esi
ret
Function at 0x40a1c9
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x40a311
xor ecx, ecx
cmp word [eax], cx
je 0x40a311
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x40a222
cmp eax, 3
jne 0x40a25c
cmp word [esp + 0xa], 0x3a
jne 0x40a25c
cmp eax, 2
jne 0x40a240
lea eax, [esp + 8]
push 0x40d2c8
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x40a311
push 0xfffffffffffffffe
pop edi
jmp 0x40a311
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x40a271
cmp ax, bx
jne 0x40a27b
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x40a264
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x40a2ba
test byte [esp + 0x21c], 0x10
je 0x40a2a1
push 0xfffffffffffffffe
pop edi
jmp 0x40a2b1
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x40a30f
cmp word [esp + 0x10], bp
jne 0x40a2c8
cmp word [esp + 0x12], bp
je 0x40a2e7
cmp word [esp + 0x10], bx
jne 0x40a2d6
cmp word [esp + 0x12], bx
je 0x40a2e7
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x40a30f
cmp word [esp + 0x12], ax
jne 0x40a30f
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x40a2fc
test al, 0x10
je 0x40a30f
jmp 0x40a30c
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x40a30f
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4
Function at 0x40a392
Capabilities:
Check if file exists

Disassembly:
xor eax, eax
push ebp
mov ebp, eax
mov eax, dword [0x40fdd8]
push esi
test eax, eax
jne 0x40a3b7
push fcn.0040a4bf
push 0x10
push 0x258
call fcn.0040b3d9
mov dword [0x40fdd8], eax
push dword [esp + 0xc]
push eax
call fcn.0040b358
mov esi, eax
test esi, esi
je 0x40a4b8
push edi
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x40a3d9
mov edi, 0x40d014
push ebx
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x40a3e9
xor eax, eax
cmp word [ebx], ax
jne 0x40a3ee
mov ebx, 0x40d2cc
push edi
call sub.MSVCRT.dll_wcslen
push ebx
mov dword [esp + 0x24], eax
call sub.MSVCRT.dll_wcslen
add eax, dword [esp + 0x24]
pop ecx
pop ecx
lea eax, [eax*2 + 4]
push eax
xor eax, eax
push eax
push dword [0x40fb88]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x18], eax
test eax, eax
je 0x40a49f
push edi
push eax
call sub.MSVCRT.dll_wcscpy
mov eax, dword [esp + 0x24]
pop ecx
pop ecx
test eax, eax
je 0x40a44f
cmp word [edi + eax*2 - 2], 0x5c
mov edi, dword [esp + 0x18]
je 0x40a453
push 0x40d2c8
push edi
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
jmp 0x40a453
mov edi, dword [esp + 0x18]
push ebx
push edi
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esi + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x40a477
xor eax, eax
mov ebp, esi
mov dword [esi + 4], eax
jmp 0x40a48d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x40a48b
mov dword [esi + 4], 1
mov ebp, esi
xor eax, eax
push edi
push eax
push dword [0x40fb88]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebp, ebp
jne 0x40a4b6
cmp dword [esp + 0x14], 0xffffffff
je 0x40a4aa
mov esi, dword [esp + 0x14]
push esi
push dword [0x40fdd8]
call fcn.0040b2f6
pop ebx
pop edi
pop esi
mov eax, ebp
pop ebp
ret 0xc
Function at 0x406530
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x11c
push esi
push edi
mov esi, 0x11c
push esi
xor edi, edi
lea eax, [ebp - 0xa4]
push edi
push eax
call fcn.0049a380
add esp, 0xc
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push eax
call esi
cmp eax, edi
jne 0x406589
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0xa4], 0x114
call esi
cmp eax, edi
je 0x406637
mov eax, dword [ebp - 0x94]
dec eax
je 0x406623
dec eax
jne 0x406637
cmp dword [ebp - 0xa0], 6
jne 0x4065d4
inc eax
cmp dword [ebp - 0x9c], eax
jne 0x4065bc
xor ecx, ecx
cmp byte [ebp + 0x76], al
setne cl
add ecx, 8
jmp 0x4065d0
cmp dword [ebp - 0x9c], edi
jne 0x406610
xor ecx, ecx
cmp byte [ebp + 0x76], al
setne cl
lea ecx, [ecx + ecx + 7]
mov edi, ecx
jmp 0x406637
cmp dword [ebp - 0xa0], 5
jne 0x406603
cmp dword [ebp - 0x9c], 2
jne 0x4065ea
push 5
jmp 0x406620
cmp dword [ebp - 0x9c], 1
jne 0x4065f7
push 6
jmp 0x406620
cmp dword [ebp - 0x9c], edi
jne 0x406637
push 3
jmp 0x406620
cmp dword [ebp - 0xa0], 4
ja 0x406637
push 4
jmp 0x406620
cmp dword [ebp - 0x9c], 2
jne 0x406637
cmp byte [ebp + 0x76], al
jne 0x406637
push 0xa
pop edi
jmp 0x406637
mov eax, dword [ebp - 0x98]
and eax, 0xffff0000
cmp eax, 0x45a0000
sbb edi, edi
inc edi
inc edi
mov eax, edi
pop edi
pop esi
add ebp, 0x78
leave
ret
Function at 0x409650
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x595350
call fcn.00593620
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [esi], edi
mov dword [ebp - 4], edi
mov eax, vtable.KEvent.0
mov dword [esi + 4], eax
mov dword [esi + 8], edi
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov byte [ebp - 4], 3
call fcn.0047ed1d
lea ecx, [esi + 0x3c]
mov dword [ecx], eax
mov byte [eax + 0x15], 1
mov eax, dword [ecx]
mov dword [eax + 4], eax
mov eax, dword [ecx]
mov dword [eax], eax
mov ecx, dword [ecx]
mov dword [ecx + 8], ecx
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x40a9a2
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
inc edi
cmp dword [ebp + 0xc], 0x4e
jne 0x40a9d7
mov eax, dword [ebp + 0x14]
cmp dword [eax + 4], 0x3e8
jne 0x40a9d7
mov ecx, esi
mov dword [esi + 0x52c], edi
call fcn.0040a910
mov dword [ebx], eax
cmp dword [esi + 0x52c], 0
je 0x40a9d7
mov eax, edi
jmp 0x40aa1e
push 0
push ebx
push dword [ebp + 0x14]
mov ecx, esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0043d671
test eax, eax
jne 0x40a9d3
mov eax, dword [ebp + 0xc]
cmp eax, 0x402
jne 0x40aa23
push 5
push dword [esi + 4]
lea eax, [esi + 0x52c]
mov dword [ebp + 0xc], eax
mov dword [eax], edi
call dword [sym.imp.USER32.dll_ShowWindow]
and dword [ebx], 0
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
jne 0x40a9d3
xor eax, eax
pop edi
pop ebp
ret 0x10
cmp eax, 0x403
jne 0x40aa5d
mov eax, dword [esi + 0x530]
mov dword [esi + 0x28], eax
xor eax, eax
push eax
push eax
push eax
mov dword [esi + 0x52c], edi
mov dword [esi + 0x51c], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
and dword [ebx], 0
cmp dword [esi + 0x52c], 0
jmp 0x40aa1a
cmp eax, 0x465
jne 0x40aa8a
lea ecx, [esi + 0x2c]
mov dword [esi + 0x52c], edi
call fcn.0040b9ce
mov dword [esi + 0x5a4], eax
mov eax, dword [esi + 0x30]
push 5
lea ecx, [esi + 0x568]
call fcn.0048c69e
jmp 0x40aa51
cmp eax, 0x110
jne 0x40aa1c
lea eax, [esi + 0x52c]
push ecx
mov ecx, dword [ebp + 0x10]
mov dword [eax], edi
mov dword [ebp + 0xc], eax
mov eax, esp
mov dword [eax], ecx
mov ecx, esi
call fcn.0040a36c
mov dword [ebx], eax
jmp 0x40aa14
Function at 0x430c49
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x5950e1
call fcn.00593620
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
and dword [ebp - 4], 0
mov dword [edi], vtable.CBkWindow.0
call fcn.00427456
mov esi, 0x61c560
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.00427456
add eax, 0x60
inc dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
call fcn.00427456
mov ebx, eax
mov eax, dword [ebp - 0x10]
call fcn.004486a5
push esi
mov dword [eax], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x10]
xor ebx, ebx
mov dword [edi + 4], eax
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
lea esi, [edi + 0x24]
mov ecx, 0x619864
mov dword [edi + 0x20], ebx
call fcn.0042fe84
lea esi, [edi + 0x3c]
mov ecx, 0x619864
mov dword [edi + 0x28], ebx
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov dword [edi + 0x38], ebx
call fcn.0042fe84
lea esi, [edi + 0x44]
mov ecx, 0x619864
mov dword [edi + 0x40], ebx
call fcn.0042fe84
lea esi, [edi + 0x48]
mov ecx, 0x619864
call fcn.0042fe84
or dword [edi + 0x4c], 0xffffffff
or dword [edi + 0x50], 0xffffffff
or dword [edi + 0x60], 0xffffffff
lea esi, [edi + 0xbc]
mov eax, esi
mov dword [edi + 0x54], ebx
mov word [edi + 0x58], bx
mov dword [edi + 0x5c], ebx
mov dword [edi + 0x64], ebx
mov dword [edi + 0x9c], ebx
mov dword [edi + 0xa0], ebx
mov dword [edi + 0xa4], ebx
mov dword [edi + 0xa8], 1
mov dword [edi + 0xac], ebx
mov dword [edi + 0xb0], ebx
mov dword [edi + 0xb4], ebx
mov dword [edi + 0xb8], ebx
call fcn.00413b6e
mov eax, esi
call fcn.00413b6e
mov byte [esi + 0x28], 0xff
lea esi, [edi + 0xf8]
mov dword [edi + 0xec], ebx
mov dword [edi + 0xf0], ebx
mov dword [edi + 0xf4], ebx
lea eax, [esi + 8]
mov dword [esi], vtable.CBkWindow::BkAnimationHandler.0
mov dword [esi + 4], edi
call fcn.00413b6e
lea eax, [esi + 8]
call fcn.00413b6e
mov byte [esi + 0x30], 0xff
lea eax, [edi + 0x10]
mov byte [esi + 0x38], bl
push eax
mov dword [edi + 0x134], ebx
mov dword [edi + 0x138], ebx
call dword [sym.imp.USER32.dll_SetRectEmpty]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x438385
Capabilities:
Create thread

Disassembly:
push edi
xor edi, edi
cmp dword [esi], edi
je 0x4383f6
cmp dword [esp + 8], edi
je 0x4383f6
mov eax, dword [esi + 8]
cmp eax, edi
je 0x4383b1
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4383b1
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], edi
cmp dword [esi + 8], edi
jne 0x4383f6
push ebx
mov ebx, dword [esi]
push 0xc
call fcn.004657db
cmp eax, edi
pop ecx
jne 0x4383c9
xor eax, eax
jmp 0x4383e7
mov ecx, dword [esp + 0xc]
push edi
push edi
push eax
push 0x439232
push edi
push edi
mov dword [eax], ebx
mov dword [eax + 8], edi
mov dword [eax + 4], ecx
call fcn.0049eaca
add esp, 0x18
xor ecx, ecx
cmp eax, edi
setne cl
mov dword [esi + 8], eax
pop ebx
mov eax, ecx
jmp 0x4383f8
xor eax, eax
pop edi
ret 4

Function at 0x439485
Capabilities:
Delete file

Disassembly:
mov eax, 0x596b69
call fcn.00593620
sub esp, 0x14
mov eax, dword [0x619864]
push ebx
push esi
mov ebx, ecx
xor esi, esi
push edi
mov ecx, 0x619864
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x10], esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
push esi
mov dword [ebp - 4], esi
mov edi, 0x61d618
mov dword [ebp - 0x1c], esi
push str.GetPacketData__d
mov esi, edi
call fcn.004867a7
pop ecx
pop ecx
lea eax, [ebp - 0x10]
push eax
push 0
mov esi, ebx
call fcn.00439595
push eax
push str.GetPacketData_return:_d
mov esi, edi
mov dword [ebp - 0x14], eax
call fcn.004867a7
cmp dword [ebp - 0x14], 0
pop ecx
pop ecx
jne 0x4394fa
mov dword [ebx + 0x1c], 1
jmp 0x439573
push 0x28
call fcn.004657db
test eax, eax
pop ecx
je 0x439510
push eax
call fcn.00474fff
mov ebx, eax
jmp 0x439512
xor ebx, ebx
test ebx, ebx
mov dword [ebp - 0x1c], ebx
je 0x439573
push str.Extract...
call fcn.004867a7
mov eax, dword [ebx]
pop ecx
push dword [ebp + 8]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push ebx
call dword [eax]
mov ebx, eax
xor eax, eax
test ebx, ebx
sete al
push eax
push str.Extract_return:_d
call fcn.004867a7
test ebx, ebx
pop ecx
pop ecx
je 0x43956c
xor esi, esi
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.004011c0
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
mov dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], 0
je 0x439583
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x439590
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov esi, dword [ebp - 0x20]
jmp 0x43954e
Function at 0x43a7fb
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x5980b7
call fcn.00593620
push ecx
push ecx
mov eax, dword [0x619864]
push ebx
push esi
push edi
mov ecx, 0x619864
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
push 0x61d8ec
push 0x65
pop ecx
lea esi, [ebp - 0x10]
call fcn.00439c96
mov ebx, eax
test ebx, ebx
je 0x43a8cc
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push dword [ebp + 8]
push eax
call fcn.0043229f
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x10]
push ecx
lea eax, [esi - 0x10]
mov dword [ebp + 8], esp
mov edi, esp
call fcn.0040135c
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 0
call fcn.00439ec5
mov ebx, eax
test ebx, ebx
je 0x43a8cf
mov eax, dword [esi - 0xc]
mov ecx, dword [0x61d8f0]
cmp eax, dword [ecx - 0xc]
jl 0x43a8cf
lea eax, [ebp - 0x10]
mov edi, 0x61d8f0
call fcn.004013b4
push str.product_tag_cmpc_ch.tag
lea eax, [ebp - 0x10]
call fcn.00415c78
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43a8c0
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x43a8c0
mov dword [0x61d8ec], 0x12
jmp 0x43a8cf
mov dword [0x61d8ec], 0x65
jmp 0x43a8cf
mov esi, dword [ebp - 0x10]
lea eax, [esi - 0x10]
call fcn.004011c0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, ebx
mov dword fs:[0], ecx
pop ebx
leave
ret 4