joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b35a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xa0
mov esi, dword [ebp + 0xc]
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [esp + 0x98], eax
xor ebx, ebx
lea edi, [esp + 0x18]
mov dword [edi + 4], ebx
mov dword [edi], ebx
push edi
push esi
call fcn.0041b628
add esp, 8
mov ecx, dword [edi]
mov edi, dword [edi + 4]
mov eax, ecx
neg eax
sbb ebx, edi
jge 0x41b4eb
mov dword [esp + 0xc], ecx
push ecx
call fcn.00494263
add esp, 4
mov dword [esp + 8], eax
cmp byte [esi + 0xb], 0
jns 0x41b3b9
mov esi, dword [esi]
sub esp, 0x1c
xor ebx, ebx
mov dword [esp + 0x18], ebx
movdqa xmm0, xmmword [0x4d42d0]
movdqu xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x14], 0x8000000
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea esi, [esp + 0x14]
mov dword [esi], ebx
mov ecx, esi
push eax
call fcn.0041b852
mov eax, dword [esi]
test eax, eax
je 0x41b4ff
lea ecx, [esp + 0x10]
mov dword [ecx], 0xffffffff
push ebx
push ecx
mov esi, dword [esp + 0x14]
push esi
push dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea ecx, [esp + 0x10]
mov ecx, dword [ecx]
mov edx, ecx
sar edx, 0x1f
xor edi, edx
xor esi, ecx
or edi, esi
cmove ebx, ecx
test eax, eax
cmove ebx, eax
pcmpeqd xmm0, xmm0
lea eax, [esp + 0x30]
movdqu xmmword [eax + 0x4c], xmm0
movdqa xmmword [eax + 0x40], xmm0
movdqa xmmword [eax + 0x30], xmm0
movdqa xmmword [eax + 0x20], xmm0
movdqa xmmword [eax + 0x10], xmm0
movdqa xmmword [eax], xmm0
push eax
call fcn.0044a730
add esp, 4
lea ecx, [esp + 0x20]
test ebx, ebx
jle 0x41b4a1
xor edi, edi
mov dword [esp + 0xc], ebx
mov esi, ebx
sub esi, edi
mov eax, 0x1001
cmp esi, eax
cmovge esi, eax
mov eax, dword [esp + 8]
add eax, edi
mov ebx, ecx
push esi
push eax
call fcn.0041255c
push ebx
lea eax, [esp + 0x34]
push eax
call fcn.0044a740
mov ecx, ebx
mov ebx, dword [esp + 0x14]
add esp, 8
add edi, esi
cmp edi, ebx
jl 0x41b46a
lea ebx, [esp + 0x30]
mov edx, dword [ebp + 0x10]
movzx eax, byte [edx + 0xb]
test al, al
jns 0x41b4b5
mov eax, dword [edx + 4]
mov edx, dword [edx]
mov esi, dword [ebp + 8]
mov edi, ecx
push eax
push edx
call fcn.0041255c
push edi
push ebx
call fcn.0044a740
add esp, 8
pcmpeqd xmm0, xmm0
movdqa xmmword [esp + 0x20], xmm0
push ebx
push edi
call fcn.0044a760
add esp, 8
push edi
push esi
call fcn.0044a770
add esp, 8
jmp 0x41b511
pxor xmm0, xmm0
mov esi, dword [ebp + 8]
movq qword [esi], xmm0
mov dword [esi + 8], 0
jmp 0x41b52d
pxor xmm0, xmm0
mov esi, dword [ebp + 8]
movq qword [esi], xmm0
mov dword [esi + 8], 0
lea ecx, [esp + 0x14]
call fcn.0041b890
cmp dword [esp + 8], 0
je 0x41b52d
push dword [esp + 8]
call fcn.0049426c
add esp, 4
mov ecx, dword [esp + 0x98]
xor ecx, ebp
call fcn.004961ed
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41b546
Capabilities:
Get common file path
Get program files directory

Disassembly:
cmp word [0x4f16d4], 0
jne 0x41b576
push ebp
mov ebp, esp
push esi
xor eax, eax
mov esi, 0x4f16d4
push eax
push 0x26
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.internet_exploreriexplore.exe
push esi
call fcn.004b89f8
add esp, 8
pop esi
pop ebp
mov eax, 0x4f16d4
ret

Function at 0x41b57c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x10004
call fcn.0049af20
mov esi, dword [ebp + 8]
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ecx, esi
call fcn.0045b8e0
test al, al
jne 0x41b602
cmp byte [esi + 0xb], 0
jns 0x41b5ac
mov esi, dword [esi]
push 0x40
push 0x4d4d94
push esi
call fcn.004b3e53
add esp, 0xc
test eax, eax
je 0x41b602
mov esi, eax
mov edi, dword [ebp + 0xc]
lea ebx, [ebp - 0x10010]
push 0x10000
push 0xff
push ebx
call fcn.0049dcc0
add esp, 0xc
push esi
push 0x10000
push 1
push ebx
call fcn.004b5b3c
add esp, 0x10
test eax, eax
je 0x41b606
test edi, edi
je 0x41b5de
mov ecx, edi
push eax
push ebx
call fcn.00442030
jmp 0x41b5de
xor ebx, ebx
jmp 0x41b611
push esi
call fcn.004b53b5
add esp, 4
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004961ed
mov eax, ebx
add esp, 0x10004
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x41b852
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
cmp dword [ecx], ebx
je 0x41b886
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, esi
call fcn.0041b890
lea eax, [ebx + 1]
cmp eax, 2
jb 0x41b87f
mov dword [esi], ebx
call fcn.0045a4c0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x41be0c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [ebp + 8]
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edx, dword [0x4ea418]
xor edx, ebp
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x18], 0
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x20], 0
test eax, eax
je 0x41bf24
mov esi, eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x41bf24
mov ebx, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x41bf24
mov esi, eax
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
je 0x41bf24
mov edi, eax
push ebx
push esi
push eax
call fcn.0049d740
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0x1c]
mov dword [ecx], eax
push ecx
push eax
mov dword [ebp - 0x20], edi
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x41bf15
mov esi, dword [ebp - 0x1c]
push 0x10
call sub.gdiplus.dll_GdipAlloc
mov edi, eax
mov dword [eax], fcn.0041bf40
lea ebx, [ebp - 0x14]
mov dword [ebx], 0
push ebx
push esi
call sub.gdiplus.dll_GdipCreateBitmapFromStream
mov dword [edi + 8], eax
mov eax, dword [ebx]
mov dword [edi + 4], eax
mov esi, dword [ebp - 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax + 8]
call dword [0x4e4884]
push esi
call ecx
test edi, edi
je 0x41bf15
cmp dword [edi + 8], 0
mov dword [edi + 8], 0
jne 0x41bf0c
lea eax, [ebp - 0x18]
push 0
push eax
push dword [edi + 4]
call sub.gdiplus.dll_GdipCreateHBITMAPFromBitmap
test eax, eax
je 0x41bf0c
mov dword [edi + 8], eax
mov ecx, edi
push 1
call fcn.0041bf40
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004961ed
mov eax, dword [ebp - 0x20]
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x41d4de
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
mov edi, dword [sym.imp.USER32.dll_KillTimer]
push 5
push dword [ecx + 4]
call edi
push 4
push dword [esi + 4]
call edi
push 0
push dword [esi + 0x344]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop edi
pop ebp
ret
Function at 0x41d50c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp + 0xc]
xorps xmm0, xmm0
lea eax, [ebp - 0x20]
movups xmmword [eax], xmm0
push eax
push dword [ecx + 0x344]
call dword [sym.imp.USER32.dll_GetWindowRect]
cmp dword [edi + 0x1c], 0
je 0x41d54e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [edi + 0x10]
ja 0x41d5b2
lea eax, [esi + 0x3a8]
mov dword [esi + 0x3bc], 0x3fdccccc
mov dword [esi + 0x3b8], 0xcccccccd
mov dword [edi + 0x28], eax
mov eax, dword [edi + 0x2c]
and eax, 0xfffffff4
mov dword [edi + 0x38], 0
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x20]
or eax, 3
mov dword [edi + 0x2c], eax
mov dword [edi + 0x3c], ecx
mov dword [edi + 8], 0x7d0
test ebx, ebx
je 0x41d598
mov dword [edi + 0x20], esi
mov dword [edi + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, dword [edi + 4]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 0
mov dword [edi + 0x1c], 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004961ed
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0xc

Function at 0x41d6b0
Capabilities:
Create thread
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov esi, ecx
mov ebx, dword [ebp + 0x14]
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
push eax
push eax
push eax
push 0x412e90
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x660], eax
test eax, eax
jne 0x41d75c
xor edi, edi
dec edi
lea eax, [ebp - 0x1c]
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
push 0x879
push eax
call fcn.00417c5c
add esp, 8
lea ebx, [ebp - 0x28]
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
push 0xadc
push ebx
call fcn.00417c5c
add esp, 8
mov ecx, esi
call fcn.0041d4de
push 5
push dword [esi + 0x30]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
lea eax, [ebp - 0x1c]
push eax
push ebx
call fcn.0041d77a
cmp byte [ebx + 0xb], 0
jns 0x41d748
push dword [ebp - 0x28]
call fcn.00494236
add esp, 4
cmp byte [ebp - 0x11], 0
jns 0x41d759
push dword [ebp - 0x1c]
call fcn.00494236
add esp, 4
mov ebx, dword [ebp + 0x14]
xor edi, edi
inc edi
mov dword [ebx], edi
mov dword [esi + 0x24], edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004961ed
mov eax, edi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x41d77a
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov esi, ecx
mov edi, dword [ebp + 0xc]
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [ebp - 0x10], eax
add ecx, 0x654
push edi
call fcn.00417daa
xor eax, eax
dec eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
cmp byte [edi + 0xb], 0
js 0x41d7c1
mov eax, dword [edi + 8]
mov dword [ebp - 0x14], eax
movsd xmm0, qword [edi]
movsd qword [ebp - 0x1c], xmm0
jmp 0x41d7ce
lea ecx, [ebp - 0x1c]
push dword [edi + 4]
push dword [edi]
call fcn.00442a00
cmp byte [esi + 0x664], 0
je 0x41d812
call fcn.0041e55f
test al, al
je 0x41d812
lea eax, [ebp - 0x28]
push 0x87e
push eax
call fcn.00417c5c
add esp, 8
cmp byte [ebp - 0x11], 0
jns 0x41d802
push dword [ebp - 0x1c]
call fcn.00494236
add esp, 4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
movsd xmm0, qword [ebp - 0x28]
movsd qword [ebp - 0x1c], xmm0
mov edi, dword [ebp + 8]
cmp byte [ebp - 0x11], 0
jns 0x41d820
mov eax, dword [ebp - 0x1c]
jmp 0x41d823
lea eax, [ebp - 0x1c]
mov ebx, dword [sym.imp.USER32.dll_SetWindowTextW]
push eax
push dword [esi + 0x258]
call ebx
cmp byte [edi + 0xb], 0
jns 0x41d83a
mov edi, dword [edi]
push edi
push dword [esi + 0x1b0]
call ebx
cmp byte [esi + 0x31c], 0
je 0x41d86a
call fcn.0041c2f8
mov ecx, eax
call fcn.0041c3ea
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov byte [esi + 0x31c], 0
cmp byte [esi + 0x650], 0
je 0x41d8a6
lea ecx, [esi + 0x630]
lea eax, [ebp - 0x1c]
push eax
call fcn.0041de1e
call fcn.0041ea4d
test eax, eax
je 0x41d8c5
push 0
push 0x927c0
push 3
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
mov byte [esi + 0x665], 1
jmp 0x41d8cc
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push 0xb00
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x41d8cc
mov ecx, esi
call fcn.0041e45a
push 1
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
cmp byte [ebp - 0x11], 0
jns 0x41d8ea
push dword [ebp - 0x1c]
call fcn.00494236
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004961ed
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x41f402
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 8]
mov edx, dword [0x4ea418]
xor edx, ebp
mov dword [ebp - 0x10], edx
add eax, 0xfffffffe
cmp eax, 3
ja case.default.0x41f428
mov dword [ebp - 0x24], ecx
jmp dword [eax*4 + 0x4d5134]
push 2
push dword [ecx + 4]
mov esi, ecx
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, esi
call fcn.0041e45a
jmp case.default.0x41f428
lea edi, [ecx + 0x340]
lea ebx, [ecx + 0x3d0]
xor esi, esi
cmp dword [ebx + 0x1c], 0
je 0x41f47d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x24]
cmp eax, dword [ebx + 0x10]
jbe 0x41f47d
mov ecx, ebx
call fcn.0041f59a
mov ecx, edi
push esi
push eax
call fcn.0042246c
mov ecx, dword [ebp - 0x24]
cmp dword [ebx + 0x14c], 0
je 0x41f4ae
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x24]
cmp eax, dword [ebx + 0x140]
jbe 0x41f4ae
lea ecx, [ebx + 0x130]
call fcn.0041f59a
mov ecx, edi
push esi
push eax
call fcn.00422482
mov ecx, dword [ebp - 0x24]
inc esi
add ebx, 0x4c
cmp esi, 4
jne 0x41f456
push 1
push 0
push dword [ecx + 0x344]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp case.default.0x41f428
cmp dword [ecx + 0x4d0], 0
je 0x41f4ea
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x24]
cmp eax, dword [ecx + 0x4c4]
ja case.default.0x41f428
xor esi, esi
mov edi, 0x3e0
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [ecx + edi + 0xc], 0
je 0x41f538
call ebx
mov ecx, dword [ebp - 0x24]
cmp eax, dword [ecx + edi]
jbe 0x41f538
add esi, 0xffffffb4
add edi, 0x4c
cmp esi, 0xfffffed0
jne 0x41f4f7
jmp case.default.0x41f428
call fcn.0041ea4d
mov ecx, dword [ebp - 0x24]
test eax, eax
jne case.default.0x41f428
push 0
push 0x1388
push 2
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_SetTimer]
jmp case.default.0x41f428
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov edi, ecx
sub edi, esi
lea eax, [edi + 0x3d0]
sub esp, 0xc
movsd xmm0, qword [ebp - 0x18]
movsd qword [esp + 4], xmm0
mov dword [esp], eax
mov esi, ecx
call fcn.0041d50c
add edi, 0x500
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
sub esp, 0xc
movsd xmm0, qword [ebp - 0x20]
movsd qword [esp + 4], xmm0
mov dword [esp], edi
mov ecx, esi
call fcn.0041d5c6
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004961ed
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x41f66c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.0041c2f8
mov ecx, eax
call fcn.0041c3ea
mov ecx, eax
call fcn.00420730
xor eax, eax
pop ebp
ret 0x10
Function at 0x41f964
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov esi, esp
mov edi, ecx
lea ebx, [ebp + 8]
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [esi + 0x28], eax
pcmpeqd xmm0, xmm0
lea eax, [esi + 0x10]
movdqa xmmword [eax], xmm0
push eax
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
push 1
push dword [ebx]
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [edi + 0x84]
cmp eax, 0xffffffff
jne 0x41f9b3
push 9
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
push dword [ebx]
call dword [sym.imp.GDI32.dll_SetTextColor]
push dword [edi + 0x24]
push dword [ebx]
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esi + 0xc], eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jle 0x41fa60
lea ecx, [eax + 1]
mov dword [esi + 8], ecx
lea ecx, [eax*2 + 2]
lea eax, [eax*2 + 5]
and eax, 0xfffffffc
call fcn.0049af20
mov ebx, esp
and ebx, 0xfffffff0
mov esp, ebx
push ecx
push 0xff
push ebx
call fcn.0049dcc0
add esp, 0xc
push dword [esi + 8]
push ebx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x41fa60
push 0xfffffffffffffff0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, eax
and ecx, 2
xor edx, edx
inc edx
test al, 1
cmove edx, ecx
lea ecx, [edx + 0x24]
test al, 0xb
cmove ecx, edx
shl eax, 0xd
and eax, 0x100000
add eax, ecx
add eax, 0x200
push eax
lea eax, [esi + 0x10]
push eax
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 8]
push dword [eax]
call dword [sym.imp.USER32.dll_DrawTextW]
push dword [esi + 0xc]
lea eax, [ebp + 8]
push dword [eax]
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [esi + 0x28]
xor ecx, ebp
call fcn.004961ed
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x421ae0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, ecx
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [ebp - 0x10], eax
push dword [ecx + 0x2c]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
xor esi, esi
inc esi
test eax, eax
je 0x421be2
cmp byte [edi + 0x370], 0
je 0x421bc2
mov ecx, 0x4ee65c
call fcn.0041260e
lea ebx, [ebp - 0x1c]
push 0x8f0
push ebx
call fcn.00417c5c
add esp, 8
cmp byte [ebx + 0xb], 0
jns 0x421b3a
mov ebx, dword [ebp - 0x1c]
lea esi, [ebp - 0x28]
push 0x8ef
push esi
call fcn.00417c5c
add esp, 8
cmp byte [esi + 0xb], 0
jns 0x421b54
mov esi, dword [ebp - 0x28]
push 0x40044
push ebx
push esi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ebx, eax
cmp byte [ebp - 0x1d], 0
jns 0x421b77
push dword [ebp - 0x28]
call fcn.00494236
add esp, 4
cmp byte [ebp - 0x11], 0
mov esi, 1
jns 0x421b8d
push dword [ebp - 0x1c]
call fcn.00494236
add esp, 4
cmp ebx, 6
jne 0x421bce
mov dword [edi + 0x380], 1
mov ecx, 0x4ee65c
call fcn.004125fc
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xa
call fcn.004126f0
add esp, 4
call fcn.004126c7
jmp 0x421be2
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
xor esi, esi
jmp 0x421be2
mov dword [edi + 0x380], 0
mov ecx, 0x4ee65c
call fcn.004125fc
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004961ed
mov eax, esi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x421f1c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor edi, edi
cmp dword [ebp + 0x1c], 0
jne 0x42206d
mov esi, ecx
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
cmp ecx, 0x10f
jg 0x421f9a
cmp ecx, 0x10
je 0x421fc8
cmp ecx, 0x14
je 0x422035
cmp ecx, 0x84
jne 0x42200d
xorps xmm0, xmm0
lea edi, [ebp - 0x20]
movups xmmword [edi], xmm0
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
shr ebx, 0x10
mov eax, dword [edi + 4]
add eax, 0x37
mov ecx, dword [ebp + 0x18]
mov dword [ecx], 2
cmp ebx, eax
jl 0x422066
jmp 0x42206b
cmp ecx, 0x138
je 0x421feb
cmp ecx, 0x113
je 0x422048
cmp ecx, 0x110
jne 0x42200d
xor edi, edi
inc edi
mov dword [esi + 0x24], edi
sub esp, 8
mov ecx, esi
call fcn.00420db0
jmp 0x42203b
mov dword [esi + 0x24], 1
xor edi, edi
push edi
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [ebp + 0x18]
mov dword [eax], edi
cmp dword [esi + 0x24], edi
jne 0x422066
jmp 0x42206b
mov edi, esp
mov dword [esi + 0x24], 1
push eax
push eax
mov ecx, esp
mov dword [ecx + 4], ebx
mov dword [ecx], eax
mov ecx, esi
call fcn.004216c8
mov esp, edi
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
jmp 0x422060
movzx edx, ax
cmp ecx, 0x111
jne 0x422083
cmp edx, 0x8ce
jne 0x422083
sub esp, 8
xor edi, edi
mov ecx, esi
push edi
push edi
call fcn.004219f4
mov eax, dword [ebp + 0x18]
mov dword [eax], edi
jmp 0x422066
xor edi, edi
inc edi
mov dword [esi + 0x24], edi
mov eax, dword [ebp + 0x18]
mov dword [eax], edi
cmp dword [esi + 0x24], 0
jne 0x42206d
jmp 0x42206b
mov dword [esi + 0x24], 1
mov ecx, esi
push eax
call fcn.00421c44
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
cmp dword [esi + 0x24], 0
je 0x42206b
xor edi, edi
inc edi
jmp 0x42206d
xor edi, edi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004961ed
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
cmp ecx, 0x111
jne 0x4220a8
cmp edx, 0x8cc
jne 0x4220a8
sub esp, 8
xor eax, eax
mov ecx, esi
push eax
push eax
call fcn.00421ae0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
jmp 0x422066
cmp ecx, 0x111
jne 0x4220ce
cmp edx, 0x8cd
jne 0x4220ce
push 6
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
jmp 0x422066
cmp ecx, 0x900
jg 0x4220f3
cmp ecx, 0xf
je 0x422113
cmp ecx, 0x900
jne 0x42206d
sub esp, 0x10
mov dword [esp + 4], eax
mov ecx, esi
call fcn.00421bf8
jmp 0x4220a1
cmp ecx, 0x901
je 0x42211f
cmp ecx, 0xb00
jne 0x42206d
sub esp, 0x10
mov ecx, esi
call fcn.0042198c
jmp 0x422129
sub esp, 0x10
mov ecx, esi
call fcn.00421700
jmp 0x422129
sub esp, 0x10
mov ecx, esi
call fcn.00421c78
mov eax, dword [ebp + 0x18]
mov dword [eax], 1
jmp 0x422066
Function at 0x422616
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x448
mov eax, dword [0x4ea418]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [0x4f1c64], 0
je 0x42263c
xor ebx, ebx
jmp 0x422737
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.UpdateLayeredWindow
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4f1c64], eax
xor ebx, ebx
test eax, eax
je 0x422737
mov eax, 0x20a
lea edi, [ebp - 0x21a]
push eax
push ebx
push edi
call fcn.0049dcc0
add esp, 0xc
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea esi, [ebp - 0x424]
mov eax, 0x20a
push eax
push ebx
push esi
call fcn.0049dcc0
add esp, 0xc
push 0xffffffffffffffff
push str.dwmapi.dll
push edi
push 0x4d4ed0
push 0x209
push esi
call fcn.0042274e
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x4226d8
mov byte [0x4f1c68], 1
push str.DwmIsCompositionEnabled
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4f1c6c], eax
mov ecx, dword [ebp + 8]
mov dword [0x4eb124], ecx
lea edi, [ebp - 0x454]
mov dword [edi], 0x30
mov dword [edi + 4], 3
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [edi + 8], eax
xor esi, esi
mov dword [edi + 0xc], esi
mov dword [edi + 0x10], esi
mov dword [edi + 0x14], ecx
mov dword [edi + 0x18], esi
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], 6
mov dword [edi + 0x24], esi
mov eax, dword [str.PerryShadowWnd]
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], esi
push edi
call dword [sym.imp.USER32.dll_RegisterClassExW]
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004961ed
mov eax, ebx
add esp, 0x448
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x422894
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [ebp + 8]
mov dl, byte [ecx + 0xc]
mov ecx, edx
and cl, 9
mov byte [esi + 0xc], cl
test dl, 1
je 0x4228db
cmp cl, 7
ja 0x4228db
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x1c
mov dl, byte [esi + 0xc]
jae 0x4228d9
mov ecx, edx
or cl, 4
mov byte [esi + 0xc], cl
test eax, 0x21000000
jne 0x4228db
or dl, 6
mov byte [esi + 0xc], dl
mov ecx, edx
mov eax, dword [esi + 4]
test cl, 2
jne 0x4228f1
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 4
push 8
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
pop esi
pop ebp
jmp fcn.00422b90