joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435a60
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x28
mov eax, dword [0x4c9070]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
push edi
mov edi, ecx
mov esi, edi
neg esi
lea eax, [edi - 0x74c]
sbb esi, esi
and esi, eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x435b67
push dword [edi + 8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x435b67
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x435b5c
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsZoomed]
test eax, eax
jne 0x435b5c
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x435b5c
lea eax, [esp + 0x10]
mov ecx, edi
push eax
call fcn.00435ee0
push 1
push 0xffffffffffffffeb
push dword [edi + 8]
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x1c], xmm0
call dword [sym.imp.USER32.dll_SetWindowLongW]
cmp dword [ebp + 8], 0
lea eax, [esp + 0x10]
lea ecx, [edi + 8]
je 0x435b31
push 1
push eax
call fcn.0040cea0
push 0
push 0xffffffffffffffeb
push dword [edi + 8]
call dword [sym.imp.USER32.dll_SetWindowLongW]
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0046be2f
mov esp, ebp
pop ebp
ret 4
push 0x50
push eax
push dword [esi + 4]
call fcn.0040ced0
push 0
push 0xffffffffffffffeb
push dword [edi + 8]
call dword [sym.imp.USER32.dll_SetWindowLongW]
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0046be2f
mov esp, ebp
pop ebp
ret 4
push 0
push dword [edi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
xor ecx, esp
call fcn.0046be2f
mov esp, ebp
pop ebp
ret 4
Function at 0x435b80
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x28
mov eax, dword [0x4c9070]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
push edi
mov edi, ecx
mov esi, edi
neg esi
lea eax, [edi - 0x3b8]
sbb esi, esi
and esi, eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x435c87
push dword [edi + 0x14]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x435c87
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x435c7c
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsZoomed]
test eax, eax
jne 0x435c7c
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x435c7c
lea eax, [esp + 0x10]
mov ecx, edi
push eax
call fcn.00435f80
push 1
push 0xffffffffffffffeb
push dword [edi + 0x14]
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x1c], xmm0
call dword [sym.imp.USER32.dll_SetWindowLongW]
cmp dword [ebp + 8], 0
lea eax, [esp + 0x10]
lea ecx, [edi + 0x14]
je 0x435c51
push 1
push eax
call fcn.0040cea0
push 0
push 0xffffffffffffffeb
push dword [edi + 0x14]
call dword [sym.imp.USER32.dll_SetWindowLongW]
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0046be2f
mov esp, ebp
pop ebp
ret 4
push 0x10
push eax
push dword [esi + 4]
call fcn.0040ced0
push 0
push 0xffffffffffffffeb
push dword [edi + 0x14]
call dword [sym.imp.USER32.dll_SetWindowLongW]
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0046be2f
mov esp, ebp
pop ebp
ret 4
push 0
push dword [edi + 0x14]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
xor ecx, esp
call fcn.0046be2f
mov esp, ebp
pop ebp
ret 4
Function at 0x435ca0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x28
mov eax, dword [0x4c9070]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
push edi
mov edi, ecx
mov esi, edi
neg esi
lea eax, [edi - 0x748]
sbb esi, esi
and esi, eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x435da7
push dword [edi + 0x14]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x435da7
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x435d9c
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsZoomed]
test eax, eax
jne 0x435d9c
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x435d9c
lea eax, [esp + 0x10]
mov ecx, edi
push eax
call fcn.0041ea70
push 1
push 0xffffffffffffffeb
push dword [edi + 0x14]
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x1c], xmm0
call dword [sym.imp.USER32.dll_SetWindowLongW]
cmp dword [ebp + 8], 0
lea eax, [esp + 0x10]
lea ecx, [edi + 0x14]
je 0x435d71
push 1
push eax
call fcn.0040cea0
push 0
push 0xffffffffffffffeb
push dword [edi + 0x14]
call dword [sym.imp.USER32.dll_SetWindowLongW]
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0046be2f
mov esp, ebp
pop ebp
ret 4
push 0x10
push eax
push dword [esi + 4]
call fcn.0040ced0
push 0
push 0xffffffffffffffeb
push dword [edi + 0x14]
call dword [sym.imp.USER32.dll_SetWindowLongW]
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0046be2f
mov esp, ebp
pop ebp
ret 4
push 0
push dword [edi + 0x14]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
xor ecx, esp
call fcn.0046be2f
mov esp, ebp
pop ebp
ret 4
Function at 0x435dc0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x28
mov eax, dword [0x4c9070]
xor eax, esp
mov dword [esp + 0x24], eax
push esi
push edi
mov edi, ecx
mov esi, edi
neg esi
lea eax, [edi - 0x3c0]
sbb esi, esi
and esi, eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x435ec7
push dword [edi + 8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x435ec7
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x435ebc
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsZoomed]
test eax, eax
jne 0x435ebc
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x435ebc
lea eax, [esp + 0x10]
mov ecx, edi
push eax
call fcn.0041eb10
push 1
push 0xffffffffffffffeb
push dword [edi + 8]
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x1c], xmm0
call dword [sym.imp.USER32.dll_SetWindowLongW]
cmp dword [ebp + 8], 0
lea eax, [esp + 0x10]
lea ecx, [edi + 8]
je 0x435e91
push 1
push eax
call fcn.0040cea0
push 0
push 0xffffffffffffffeb
push dword [edi + 8]
call dword [sym.imp.USER32.dll_SetWindowLongW]
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0046be2f
mov esp, ebp
pop ebp
ret 4
push 0x50
push eax
push dword [esi + 4]
call fcn.0040ced0
push 0
push 0xffffffffffffffeb
push dword [edi + 8]
call dword [sym.imp.USER32.dll_SetWindowLongW]
pop edi
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0046be2f
mov esp, ebp
pop ebp
ret 4
push 0
push dword [edi + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
xor ecx, esp
call fcn.0046be2f
mov esp, ebp
pop ebp
ret 4
Function at 0x4386b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x491da6
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4c9070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [0x4d138c]
test eax, eax
jne 0x438702
push str.Wow64DisableWow64FsRedirection
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4d138c], eax
test eax, eax
je 0x43870e
lea ecx, [ebp - 0x10]
push ecx
call eax
neg eax
sbb eax, eax
neg eax
push edi
mov dword [ebp - 0x14], eax
mov esi, 2
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x438736
mov ecx, edi
xor esi, esi
call fcn.00454800
test al, al
je 0x438740
mov esi, 3
jmp 0x438740
test al, 0x10
mov eax, 1
cmovne esi, eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0
je 0x43877c
mov eax, dword [0x4d1388]
mov edi, dword [ebp - 0x10]
test eax, eax
jne 0x438779
push str.Wow64RevertWow64FsRedirection
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4d1388], eax
test eax, eax
je 0x43877c
push edi
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4395d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48eb1c
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x4c9070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi + 0xc]
push dword [edi + 0x18]
add ecx, 0x30
call dword [sym.imp.DuiLib.dll_public:_class_DuiLib::CControlUI____thiscall_DuiLib::CPaintManagerUI::FindControl_wchar_t_const__const]
mov esi, eax
test esi, esi
je 0x439690
mov edx, dword [esi]
mov ecx, esi
mov edx, dword [edx + 0xc8]
call edx
mov ebx, dword [ebp + 8]
cmp al, bl
je 0x439690
mov eax, dword [esi]
mov ecx, esi
push ebx
call dword [eax + 0xcc]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xc]
test bl, bl
je 0x439690
mov edi, dword [edi + 0x14]
test edi, edi
jne 0x439652
mov eax, dword [esi]
mov ecx, esi
push edi
call dword [eax + 0xcc]
jmp 0x439690
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xf0]
mov eax, dword [edi]
lea ecx, [ebp - 0x94]
push ecx
mov ecx, edi
call dword [eax + 0x28]
push 0xffffffffffffffff
mov ecx, eax
mov dword [ebp - 4], 0
call dword [sym.imp.DuiLib.dll_public:_int___thiscall_DuiLib::CDuiString::GetLength_void_const]
push eax
mov ecx, edi
call dword [sym.imp.DuiLib.dll_public:_void___thiscall_DuiLib::CEditUI::SetSel_long_int__long_int_]
lea ecx, [ebp - 0x94]
call dword [sym.imp.DuiLib.dll_public:_void___thiscall_DuiLib::CDuiString::destructor_void_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046be2f
mov esp, ebp
pop ebp
ret 4
Function at 0x4396b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x491fbc
mov eax, dword fs:[0]
push eax
sub esp, 0x90
mov eax, dword [0x4c9070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [edi + 0xc]
mov esi, dword [sym.imp.DuiLib.dll_public:_class_DuiLib::CControlUI____thiscall_DuiLib::CPaintManagerUI::FindControl_wchar_t_const__const]
add ecx, 0x30
push 0
push 0x4cc608
push 0x4cc648
push 0
push dword [edi + 0x1c]
call esi
push eax
call fcn.0048e49a
mov ecx, dword [edi + 0xc]
add esp, 0x14
mov ebx, eax
add ecx, 0x30
mov dword [ebp - 0x98], ebx
push 0
push 0x4cc608
push 0x4cc648
push 0
push dword [edi + 0x20]
call esi
push eax
call fcn.0048e49a
mov ecx, dword [edi + 0x14]
add esp, 0x14
mov esi, eax
test ebx, ebx
je 0x4397a0
test esi, esi
je 0x4397a0
test ecx, ecx
je 0x4397a0
mov eax, dword [ecx]
lea edx, [ebp - 0x94]
push edx
call dword [eax + 0x28]
mov ecx, eax
mov dword [ebp - 4], 0
call dword [sym.imp.DuiLib.dll_public:_bool___thiscall_DuiLib::CDuiString::IsEmpty_void_const]
mov bl, al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
mov byte [ebp - 0x9c], bl
call dword [sym.imp.DuiLib.dll_public:_void___thiscall_DuiLib::CDuiString::destructor_void_]
mov ecx, dword [ebp - 0x98]
test bl, bl
sete al
movzx eax, al
mov edx, dword [ecx]
push eax
call dword [edx + 0xcc]
mov eax, dword [esi]
mov ecx, esi
push dword [ebp - 0x9c]
call dword [eax + 0xcc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046be2f
mov esp, ebp
pop ebp
ret
Function at 0x43d5c0
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [sym.imp.DuiLib.dll_public:_class_DuiLib::CControlUI____thiscall_DuiLib::CPaintManagerUI::FindControl_wchar_t_const__const]
push esi
push edi
mov edi, ecx
push str.btn_sys_restore
lea ecx, [edi + 0x30]
call ebx
test eax, eax
je 0x43d5e5
mov edx, dword [eax]
mov ecx, eax
push 0
call dword [edx + 0xcc]
push str.btn_sys_max
lea ecx, [edi + 0x30]
call ebx
test eax, eax
je 0x43d5ff
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx + 0xcc]
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi + 0xf14]
lea esi, [edi + 0xf00]
test ecx, ecx
je 0x43d665
mov eax, dword [ecx]
push 0x4a32ec
call dword [eax + 0x2c]
mov ecx, esi
call fcn.004396b0
mov ecx, dword [esi + 0xc]
push dword [esi + 0x18]
add ecx, 0x30
call ebx
mov ebx, eax
test ebx, ebx
je 0x43d65f
mov edx, dword [ebx]
mov ecx, ebx
mov edx, dword [edx + 0xc8]
call edx
test al, al
je 0x43d65f
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax + 0xcc]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
mov ebx, dword [sym.imp.DuiLib.dll_public:_class_DuiLib::CControlUI____thiscall_DuiLib::CPaintManagerUI::FindControl_wchar_t_const__const]
mov ecx, dword [edi + 0xf50]
lea esi, [edi + 0xf3c]
test ecx, ecx
je 0x43d6bd
mov eax, dword [ecx]
push 0x4a32ec
call dword [eax + 0x2c]
mov ecx, esi
call fcn.004396b0
mov ecx, dword [esi + 0xc]
push dword [esi + 0x18]
add ecx, 0x30
call ebx
mov edi, eax
test edi, edi
je 0x43d6bd
mov edx, dword [edi]
mov ecx, edi
mov edx, dword [edx + 0xc8]
call edx
test al, al
je 0x43d6bd
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 0xcc]
mov eax, dword [esi]
mov ecx, esi
pop edi
pop esi
pop ebx
jmp dword [eax + 0xc]
pop edi
pop esi
pop ebx
ret

Function at 0x444c00
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48f918
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4c9070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
push 0x5c
push dword [ebx + 0xae0]
call fcn.0046e615
add esp, 8
test eax, eax
jne 0x444c41
or eax, 0xffffffff
jmp 0x444c49
sub eax, dword [ebx + 0xae0]
sar eax, 1
inc eax
lea ecx, [ebx + 0xae0]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00425700
mov edi, dword [ebp + 8]
mov ecx, edi
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x10]
push esi
push 0
call fcn.00435580
push dword [edi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x444c88
mov ecx, ebx
call fcn.00444b20
xor bl, bl
jmp 0x444c8a
mov bl, 1
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [esi + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x444ca9
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x446ba0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push esi
push dword [ebp + 8]
mov esi, ecx
call fcn.00446f10
mov ecx, dword [esi + 4]
test ecx, ecx
jne 0x446bc4
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
push 8
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
push 0xb
push 0
push str.password
push ecx
mov dword [esp + 0x24], edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
pop esi
sbb eax, eax
inc eax
mov esp, ebp
pop ebp
ret 4

Function at 0x446bf0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ecx + 4]
sub esp, 0x10
test eax, eax
je 0x446c67
lea ecx, [esp]
mov dword [esp], 8
push ecx
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0xc]
push ecx
push 0
push str.password
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
test ecx, ecx
jne 0x446c36
cmp dword [esp + 4], 0xb
mov eax, 0xd
cmovne ecx, eax
xor eax, eax
test ecx, ecx
sete al
test eax, eax
je 0x446c67
mov eax, dword [esp + 8]
or eax, dword [esp + 0xc]
je 0x446c67
push dword [ebp + 8]
call fcn.00446f10
cmp eax, dword [esp + 8]
jne 0x446c5f
cmp edx, dword [esp + 0xc]
je 0x446c67
xor eax, eax
mov esp, ebp
pop ebp
ret 4
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x448a10
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push edi
push eax
push esi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push eax
push dword [ebp - 4]
mov dword [ebp - 8], eax
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ecx, eax
mov dword [edi + 8], ecx
test ecx, ecx
jne 0x448a52
call fcn.00404b90
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [ebp - 8]
push 0
push eax
mov dword [edi + 0x10], 0
push dword [edi + 0x10]
mov dword [edi + 0x14], 0
push dword [edi + 0x14]
mov dword [edi + 4], eax
push 4
push ecx
mov dword [edi + 0x18], 4
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov dword [edi], eax
test eax, eax
jne 0x448aa6
call fcn.00404b90
push dword [edi + 8]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 8], 0
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x18
Function at 0x44e130
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x492418
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4c9070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.00404a20
mov ecx, eax
test ecx, ecx
jne 0x44e16f
push 0x80004005
call fcn.00404ad0
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
cmp dword [ebx], 0xa
jne 0x44e1e3
push 0xa
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [edi + 0xa8c], 0
jne 0x44e1e3
push dword [ebx + 8]
lea eax, [ebp - 0x10]
push str.HipsMain.exe___s_
push eax
call fcn.00409370
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x14]
add esp, 0xc
push eax
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
test ebx, ebx
je 0x44e1dc
push ebx
push dword [ebp - 0x14]
call fcn.00453bc0
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, edi
call fcn.0044d850
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x44e202
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x44e460
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 1
push esi
mov esi, ecx
jne 0x44e565
cmp dword [ebp + 0x10], 0xffffffff
jne 0x44e4d4
mov ecx, 0x4d1720
call fcn.00458cd0
test eax, eax
je 0x44e4c1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4d1720]
mov ecx, 0xbb8
cmp ecx, eax
sbb ecx, ecx
inc ecx
cmp eax, 0xbb8
jbe 0x44e4b9
mov ecx, dword [0x4d229c]
xor eax, eax
cmp dword [0x4d2298], eax
cmove ecx, eax
mov dword [0x4d229c], ecx
test ecx, ecx
jne 0x44e595
lea ecx, [esi + 0xaa8]
call fcn.00464350
xor eax, eax
pop esi
pop ecx
pop ebp
ret 0x10
lea ecx, [esi + 0xaa8]
call fcn.00466130
mov ecx, 0x4d1720
call fcn.00458cd0
test eax, eax
je 0x44e545
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4d1720]
mov ecx, 0xbb8
cmp ecx, eax
sbb ecx, ecx
inc ecx
cmp eax, 0xbb8
jbe 0x44e521
mov ecx, dword [0x4d229c]
xor eax, eax
cmp dword [0x4d2298], eax
cmove ecx, eax
mov dword [0x4d229c], ecx
test ecx, ecx
je 0x44e545
mov ecx, esi
mov dword [esi + 0x19dc], 1
call fcn.0044cce0
or dword [esi + 0xa90], 2
xor eax, eax
pop esi
pop ecx
pop ebp
ret 0x10
mov ecx, esi
mov dword [esi + 0x19dc], 4
call fcn.0044cce0
or dword [esi + 0xa90], 2
xor eax, eax
pop esi
pop ecx
pop ebp
ret 0x10
push 0
push 0
push 0x601
push dword [0x4d22fc]
mov dword [0x4d22e8], 0
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, esi
mov dword [0x4d22ec], 0
call fcn.0044cce0
xor eax, eax
pop esi
pop ecx
pop ebp
ret 0x10
Function at 0x44e5a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49391c
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x4c9070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x238], eax
mov ebx, dword [ebp + 0xc]
lea ecx, [ebp - 0x228]
push ecx
push dword [eax + 4]
mov dword [ebp - 0x230], ebx
call dword [sym.imp.USER32.dll_GetClientRect]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0046ea70
add esp, 0xc
call fcn.00404a20
mov ecx, eax
test ecx, ecx
jne 0x44e61a
push 0x80004005
call fcn.00404ad0
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x22c], esi
mov dword [ebp - 4], 0
test byte [0x4d5b90], 0xd
jne 0x44e78b
push 0
push 0
push 0xffffffffffffffff
push ebx
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
xor edi, edi
mov dword [ebp - 0x234], eax
test eax, eax
je 0x44e75d
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
push 0x104
lea eax, [ebp - 0x218]
push eax
push edi
push dword [ebp - 0x230]
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
mov eax, dword [0x4d138c]
test eax, eax
jne 0x44e69e
push str.Wow64DisableWow64FsRedirection
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call ebx
mov dword [0x4d138c], eax
test eax, eax
je 0x44e6ad
lea ecx, [ebp - 0x23c]
push ecx
call eax
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x240], eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 1
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44e705
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44e6d1
sub eax, edx
lea ecx, [ebp - 0x22c]
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00403730
push 1
push 0x4a6f60
lea ecx, [ebp - 0x22c]
call fcn.00403730
mov byte [ebp - 4], 2
cmp dword [ebp - 0x240], 0
je 0x44e740
mov eax, dword [0x4d1388]
mov esi, dword [ebp - 0x23c]
test eax, eax
jne 0x44e73d
push str.Wow64RevertWow64FsRedirection
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call ebx
mov dword [0x4d1388], eax
test eax, eax
je 0x44e740
push esi
call eax
inc edi
mov byte [ebp - 4], 0
cmp edi, dword [ebp - 0x234]
jb 0x44e660
mov esi, dword [ebp - 0x22c]
mov ebx, dword [ebp - 0x230]
push ebx
call dword [sym.imp.SHELL32.dll_DragFinish]
cmp dword [esi - 0xc], 0
je 0x44e78b
mov edi, dword [ebp - 0x238]
push esi
push 2
lea ecx, [edi + 0xaa8]
call fcn.004638a0
test eax, eax
jne 0x44e78b
push 2
mov ecx, edi
call fcn.0044c840
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x44e7aa
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046be2f
mov esp, ebp
pop ebp
ret 0x10