joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416c80
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [esp + 0xc], 0
cmp esi, 0x4e
jne 0x416cb0
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x416e4d
cmp esi, 8
jne 0x416d9a
push 0
push str.SysMonthCal32
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x416d4b
xor eax, eax
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea edx, [esp + 0x1c]
push edx
push esi
call dword [sym.imp.USER32.dll_ScreenToClient]
lea eax, [esp + 0x18]
push eax
push 0
push 0x100e
push esi
mov dword [esp + 0x28], 0x20
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x24]
cmp eax, 0x1010003
je 0x416d3d
cmp eax, 0x2010003
jne 0x416e6a
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [edi + 4]
lea edx, [esp + 0x18]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x18]
jl 0x416d85
cmp eax, dword [esp + 0x20]
jg 0x416d85
cmp eax, dword [esp + 0x1c]
jl 0x416d85
cmp eax, dword [esp + 0x24]
jle 0x416e6a
mov eax, dword [ebp + 0x10]
push 8
mov ecx, ebx
call fcn.00416e80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp esi, 0x101
jne 0x416e39
cmp ebx, 0x2e
je 0x416db0
cmp ebx, 8
jne 0x416df6
mov ecx, dword [ebp + 0x10]
mov edx, dword [edi + 4]
push ecx
push ebx
push 0x101
push edx
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov ebx, eax
mov eax, dword [edi + 0x30]
mov dword [eax + 0x6d4], 2
mov esi, dword [edi + 0x30]
call fcn.00416fd0
mov ecx, dword [edi + 4]
push 0
push 0
push 0x10
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp ebx, 0x1b
jne 0x416e4d
mov edx, dword [ebp + 0x10]
mov eax, dword [edi + 4]
push edx
push ebx
push 0x101
push eax
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov ecx, dword [edi + 0x30]
push 0
push 0
mov dword [ecx + 0x6d4], 3
mov edx, dword [edi + 4]
push 0x10
push edx
mov esi, eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp esi, 0x113
jne 0x416e4d
mov eax, ebx
mov esi, edi
call fcn.0043a760
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov ecx, dword [edi + 4]
mov edx, dword [edi + 0xc]
push eax
push ebx
push esi
push ecx
push edx
call dword [sym.imp.USER32.dll_CallWindowProcW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x417c60
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x5ea2c4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [edi + 0x30], 0
push ebx
push esi
je 0x417ccc
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
inc esi
lea eax, [esi + esi]
call fcn.00539120
mov ebx, esp
test ebx, ebx
je 0x417ccc
mov ecx, dword [edi + 4]
push esi
push ebx
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov esi, dword [edi + 0x30]
push 0xffffffffffffffff
add esi, 0x2ec
push ebx
call fcn.004671e0
mov esi, dword [edi + 0x30]
mov edx, dword [esi]
mov eax, dword [edx + 0x1c]
push 0
push 0
push str.textchanged
mov ecx, esi
call eax
mov ecx, esi
mov edx, eax
call fcn.0044c050
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005273c3
mov esp, ebp
pop ebp
ret
Function at 0x429b90
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5887d3
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x5ea2c4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, dword [esp + 0x20]
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
xor ebx, ebx
mov dword [esi + 0xc], eax
xor eax, eax
mov dword [esi], vtable.UiLib::CWindowWnd.0
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov byte [esi + 0x10], bl
mov byte [esi + 0x11], bl
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], 0xa
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
lea ecx, [esi + 0x34]
mov dword [esp + 0x18], ebx
push ecx
mov dword [esi + 0x30], vtable.ReceiverImpl.0
call fcn.0048c030
mov edx, dword [esp + 0x24]
mov byte [esp + 0x18], 1
mov dword [esi + 0x4c], vtable.UiLib::INotifyUI.0
mov dword [esi + 0x50], vtable.UiLib::IDialogBuilderCallback.0
mov dword [esi], vtable.UiLib::CMenuWnd.0
mov dword [esi + 0x30], vtable.UiLib::CMenuWnd.1.0
mov dword [esi + 0x4c], vtable.UiLib::CMenuWnd.2.0
mov dword [esi + 0x50], vtable.UiLib::CMenuWnd.3.0
mov dword [esi + 0x54], edx
mov byte [esi + 0x60], bl
mov byte [esi + 0x61], bl
mov byte [esi + 0x62], bl
mov dword [esi + 0x64], ebx
lea edi, [esi + 0x6c]
mov dword [esi + 0x68], 0x59b2fc
call fcn.004485d0
mov dword [esi + 0x87c], ebx
mov dword [esi + 0x880], ebx
mov dword [esi + 0x884], ebx
mov dword [esi + 0x888], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 8

Function at 0x42a160
Capabilities:
Hide graphical window

Disassembly:
push ecx
mov al, 1
cmp byte [esi + 0x62], al
je 0x42a219
mov byte [esi + 0x62], al
mov dword [esi + 0x64], 0
mov eax, dword [esi + 0x6c]
mov dword [esi + 0x70], 0
test eax, eax
je 0x42a1f4
cmp byte [esi + 0x631], 0
je 0x42a19a
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x42a1f4
push edi
push str.User32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42a1be
push str.SetLayeredWindowAttributes
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x42a1f3
jmp 0x42a1c2
mov edi, dword [esp + 4]
mov eax, dword [esi + 0x6c]
push 0xffffffffffffffec
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, eax
or ecx, 0x80000
cmp eax, ecx
je 0x42a1e7
push ecx
mov ecx, dword [esi + 0x6c]
push 0xffffffffffffffec
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov edx, dword [esi + 0x6c]
push 2
push 0
push 0
push edx
call edi
pop edi
mov eax, dword [esi + 4]
push 4
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [esi + 0x62], 0
je 0x42a219
mov ecx, dword [esi + 4]
push 0
push 0x19
push 0x196e
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
pop ecx
ret
Function at 0x4307a0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x61c], 0
je 0x430824
push ebx
mov ebx, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
cmp edi, 0x100
jne 0x430802
cmp bx, 0xd
jne 0x430802
cmp byte [esi + 0x622], 0
je 0x4307e3
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x430802
cmp byte [esi + 0x623], 0
jne 0x430802
mov edx, dword [esi + 0x68]
test edx, edx
je 0x4307fa
push 0
push 0
push str.return
mov ecx, esi
call fcn.0044c050
pop edi
pop ebx
xor eax, eax
pop esi
ret 0x10
mov eax, dword [esi + 0x61c]
mov ecx, dword [eax + 0xc]
mov eax, dword [esp + 0x1c]
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
push eax
mov eax, dword [esp + 0x1c]
push eax
push ebx
push edi
call edx
pop edi
pop ebx
pop esi
ret 0x10
mov eax, 1
pop esi
ret 0x10
Function at 0x44b910
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esi]
cmp eax, ecx
je 0x44b93e
cmp edi, dword [esi + 0x564]
je 0x44b93e
cmp byte [esi + 0x5c9], 0
jne 0x44b93e
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esi + 0x564]
cmp edi, eax
je 0x44ba55
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
test eax, eax
je 0x44b9bb
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 8], 0x14
mov dword [esp + 0xc], edi
call ebx
mov ecx, dword [esi + 0x564]
mov dword [esp + 0x10], eax
mov eax, dword [ecx]
mov eax, dword [eax + 0x144]
lea edx, [esp + 8]
push edx
call eax
mov ecx, dword [esi + 0x564]
push 0
push 0
push str.killfocus
mov edx, esi
call fcn.0044c050
mov dword [esi + 0x564], 0
test edi, edi
je 0x44ba55
mov edx, dword [edi]
mov eax, dword [edx + 0x1c]
mov ecx, edi
call eax
cmp eax, esi
jne 0x44ba55
mov edx, dword [edi]
mov eax, dword [edx + 0xd4]
mov ecx, edi
call eax
test al, al
je 0x44ba55
mov edx, dword [edi]
mov eax, dword [edx + 0xe0]
mov ecx, edi
call eax
test al, al
je 0x44ba55
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esi + 0x564], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 8], 0x15
mov dword [esp + 0xc], edi
call ebx
mov ecx, dword [esi + 0x564]
mov dword [esp + 0x10], eax
mov edx, dword [ecx]
mov edx, dword [edx + 0x144]
lea eax, [esp + 8]
push eax
call edx
mov ecx, dword [esi + 0x564]
push 0
push 0
push str.setfocus
mov edx, esi
call fcn.0044c050
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44e050
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
xor esi, esi
call edi
test ax, ax
jge 0x44e068
mov esi, 8
push 2
call edi
test ax, ax
jge 0x44e074
or esi, 1
push 1
call edi
test ax, ax
jge 0x44e080
or esi, 2
push 0x10
call edi
test ax, ax
jge 0x44e08c
or esi, 4
push 0x12
call edi
test ax, ax
jge 0x44e098
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x45e7a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push esi
push edi
mov edi, eax
mov eax, dword [edi + 8]
mov esi, eax
and esi, 7
je 0x45e7c2
cmp eax, esi
jge 0x45e7ba
mov edx, edi
call fcn.0045e0b0
mov ecx, esi
shr dword [edi + 0xc], cl
sub dword [edi + 8], esi
xor eax, eax
cmp dword [edi + 8], eax
jle 0x45e7ea
lea ecx, [eax - 8]
lea esp, [esp]
mov dl, byte [edi + 0xc]
shr dword [edi + 0xc], 8
add dword [edi + 8], ecx
mov byte [esp + eax + 8], dl
inc eax
cmp dword [edi + 8], 0
jg 0x45e7d0
cmp eax, 4
jge 0x45e807
mov esi, dword [edi + 4]
mov edx, dword [edi]
nop
cmp edx, esi
jb 0x45e7f8
xor cl, cl
jmp 0x45e7fb
mov cl, byte [edx]
inc edx
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 4
jl 0x45e7f0
mov dword [edi], edx
mov eax, dword [esp + 8]
movzx ecx, byte [esp + 0xb]
movzx edx, byte [esp + 0xa]
movzx esi, ah
movzx eax, al
shl esi, 8
add esi, eax
shl ecx, 8
mov eax, esi
add ecx, edx
xor eax, 0xffff
cmp ecx, eax
je 0x45e840
mov dword [0x5ef60c], str.zlib_corrupt
pop edi
xor eax, eax
pop esi
pop ecx
ret
mov ecx, dword [edi]
add ecx, esi
cmp ecx, dword [edi + 4]
jbe 0x45e859
pop edi
mov dword [0x5ef60c], 0x5a97a4
xor eax, eax
pop esi
pop ecx
ret
mov eax, dword [edi + 0x10]
lea edx, [eax + esi]
cmp edx, dword [edi + 0x18]
jbe 0x45e871
push esi
call fcn.0045e1b0
add esp, 4
test eax, eax
je 0x45e83a
push ebx
mov ebx, dword [edi]
push ebp
mov ebp, dword [edi + 0x10]
push esi
push ebx
push ebp
call fcn.00530500
add esp, 0xc
add ebx, esi
add ebp, esi
mov dword [edi + 0x10], ebp
pop ebp
mov dword [edi], ebx
pop ebx
pop edi
mov eax, 1
pop esi
pop ecx
ret
Function at 0x463d20
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x58649b
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x5ea2c4]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push esi
mov eax, dword [0x5ea2c4]
xor eax, esp
push eax
lea eax, [esp + 0x98]
mov dword fs:[0], eax
mov edx, dword [0x5eccf0]
mov ebx, dword [esp + 0xa8]
push 0xffffffffffffffff
lea eax, [esp + 0x18]
xor ecx, ecx
push edx
lea esi, [esp + 0x18]
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], cx
call fcn.004671e0
mov dword [esp + 0xa0], 0
test ebx, ebx
je 0x463d99
push ebx
mov eax, esi
push eax
call fcn.004670a0
mov ecx, dword [esp + 0x10]
push 0
push 0x80
push 3
push 0
push 1
push accept
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x463e15
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [edi], eax
test eax, eax
jne 0x463dd8
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
cmp eax, ecx
jmp 0x463e1f
push eax
mov dword [esp + 0x10], 0
call fcn.0052680d
add esp, 4
push 0
mov ebx, eax
mov eax, dword [edi]
lea edx, [esp + 0x10]
push edx
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xc]
cmp ecx, dword [edi]
je 0x463e2e
push ebx
call fcn.0052744f
add esp, 4
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
cmp eax, edx
je 0x463e2a
push eax
call fcn.005282dc
add esp, 4
xor eax, eax
jmp 0x463e45
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
cmp eax, ecx
je 0x463e43
push eax
call fcn.005282dc
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x98]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.005273c3
add esp, 0x98
ret

Function at 0x464000
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [0x5f069c]
push ebp
mov ebp, dword [esp + 8]
push esi
test eax, eax
jne 0x464014
mov eax, dword [0x5f01bc]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x464026
pop esi
pop ebp
ret
mov eax, dword [0x5f069c]
test eax, eax
jne 0x464034
mov eax, dword [0x5f01bc]
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x464050
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop ebx
pop esi
xor eax, eax
pop ebp
ret
mov eax, dword [0x5f069c]
test eax, eax
jne 0x46405e
mov eax, dword [0x5f01bc]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp], eax
test eax, eax
je 0x46404a
push edi
push eax
call fcn.0052680d
add esp, 4
mov edi, eax
mov eax, dword [ebp]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push edi
call fcn.00530500
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, edi
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x4640a0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push 0
push 0x80
push 3
push 0
push 1
push accept
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4640cd
pop esi
xor eax, eax
pop ebx
pop ecx
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebx], eax
test eax, eax
je 0x4640c7
push edi
push eax
mov dword [esp + 0x10], 0
call fcn.0052680d
mov edx, dword [ebx]
add esp, 4
push 0
lea ecx, [esp + 0x10]
push ecx
push edx
mov edi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
cmp eax, dword [ebx]
je 0x46411c
push edi
call fcn.0052744f
add esp, 4
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x469ad0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 4]
test ecx, ecx
jne 0x469adb
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x469bb4
mov esi, edx
shr esi, 3
push edi
lea ecx, [ecx]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5a2a50]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x5a2a50]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x5a2a50]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5a2a50]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5a2a50]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5a2a50]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5a2a50]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5a2a50]
inc ecx
sub edx, 8
sub esi, 1
jne 0x469af0
pop edi
test edx, edx
je 0x469bdb
jmp 0x469bc0
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x5a2a50]
inc ecx
sub edx, 1
jne 0x469bc0
not eax
pop esi
ret

Function at 0x46a370
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ebx
imul esi, dword [esp + 0x10]
cmp byte [edi], 0
je 0x46a3a8
mov ecx, dword [edi + 4]
push 0
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x46a39d
mov byte [edi + 8], 1
mov eax, dword [esp + 0xc]
xor edx, edx
pop esi
div ebx
pop ebx
ret
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0x14]
push ebp
lea ebp, [ecx + esi]
cmp ebp, eax
pop ebp
jbe 0x46a3bb
sub eax, ecx
mov esi, eax
mov eax, dword [edi + 0x10]
push esi
add eax, ecx
push eax
push edx
call fcn.00530500
add dword [edi + 0x18], esi
add esp, 0xc
mov eax, esi
xor edx, edx
pop esi
div ebx
pop ebx
ret

Function at 0x46b430
Capabilities:
Get common file path

Disassembly:
push ecx
cmp dword [esi], 0
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x10]
push edi
jne 0x46b4c6
cmp dword [esi + 4], 0xffffffff
jne 0x46b4c6
lea edi, [esi + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x46b460
mov eax, dword [0x5a9d50]
mov dword [edi], eax
cmp ebx, 1
jne 0x46b48f
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, ebx
je 0x46b48f
mov eax, 0x2000000
pop edi
pop ebp
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push ecx
push edx
push ebp
mov edi, ebx
call fcn.0046a230
add esp, 0xc
test eax, eax
jne 0x46b4b3
mov eax, dword [esp + 0x1c]
pop edi
pop ebp
pop ebx
pop ecx
ret 0xc
call fcn.0046a750
mov dword [esi], eax
mov eax, dword [0x5f06bc]
pop edi
pop ebp
pop ebx
pop ecx
ret 0xc
pop edi
pop ebp
mov eax, 0x1000000
pop ebx
pop ecx
ret 0xc
Function at 0x4704c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
mov esi, eax
cmp edi, 0x202
ja 0x47050e
je 0x470504
cmp edi, 0xf
je 0x4704f7
cmp edi, 0x200
jne 0x470540
push 0x7f89
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x470540
lea eax, [esi + 4]
push eax
mov ecx, esi
call fcn.004707a0
jmp 0x470540
lea ecx, [ebp + 0xc]
call fcn.00470560
jmp 0x470540
cmp edi, 0x465
jne 0x470540
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x470540
mov edx, dword [esi + 4]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 4]
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov eax, dword [esi + 4]
push ecx
push edx
push edi
push eax
call dword [sym.imp.USER32.dll_DefWindowProcW]
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x470be0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x470c0a
mov ecx, dword [esi + 4]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi + 4]
push 0
push 0
push 0x10
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
ret

Function at 0x470c10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [0x5efb6c]
push edi
push 0x5aa4e8
push 0x83
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x470ce1
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test ebx, ebx
je 0x470ce1
test esi, esi
je 0x470ce1
lea eax, [esp + 0xc]
push eax
push 1
xor edi, edi
push edi
mov dword [esp + 0x18], 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x470ce1
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x18]
push esi
push ecx
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
push edi
push esi
push ebx
push eax
call edx
test eax, eax
jne 0x470cb9
push 0x10
call sub.gdiplus.dll_GdipAlloc
test eax, eax
je 0x470cb5
mov ecx, dword [esp + 0xc]
mov esi, eax
call fcn.00455920
jmp 0x470cb7
xor eax, eax
mov edi, eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
test edi, edi
je 0x470ce1
mov eax, dword [edi + 8]
mov dword [edi + 8], 0
test eax, eax
je 0x470ce8
mov eax, dword [edi]
mov edx, dword [eax]
push 1
mov ecx, edi
call edx
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
ret
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret