joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4359a0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x1684]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4359de
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
push ecx
push 0xfffffffffffffff8
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x1684]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongW]
jmp 0x435a1b
push 0
push ecx
mov ecx, esp
push 0
call fcn.00416280
push 0x8000080
push 0x90000000
push 0x5bba88
push ecx
mov ecx, esp
push 0x5e01a8
call fcn.0042c490
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx + 0x1684]
call fcn.0042e560
mov edx, dword [ebp - 0xc]
add edx, 0x9d4
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x1684]
call fcn.00437e10
push 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1684]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4388f0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
mov eax, dword [0x5deba8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x5b3bc0]
mov dword [ebp - 0x418], eax
push 0x204
push 0
lea ecx, [ebp - 0x414]
push ecx
call fcn.005533a0
add esp, 0xc
mov edx, dword [0x5b3bc4]
mov dword [ebp - 0x210], edx
push 0x204
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.005533a0
add esp, 0xc
lea ecx, [ebp - 0x418]
push ecx
call fcn.004011a0
add esp, 4
push 0x5c
mov edx, dword [ebp + 8]
push edx
call fcn.00426b40
add esp, 8
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
je 0x438a92
mov eax, dword [ebp - 0x41c]
add eax, 2
mov dword [ebp - 0x41c], eax
mov ecx, dword [ebp - 0x41c]
push ecx
lea edx, [ebp - 0x418]
push edx
push str._sdataicon_s
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0
lea ecx, [ebp - 0x210]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0x424], eax
mov ecx, dword [ebp - 0x424]
add ecx, 2
mov dword [ebp - 0x428], ecx
mov edx, dword [ebp - 0x424]
mov ax, word [edx]
mov word [ebp - 0x42a], ax
add dword [ebp - 0x424], 2
cmp word [ebp - 0x42a], 0
jne 0x4389d6
mov ecx, dword [ebp - 0x424]
sub ecx, dword [ebp - 0x428]
sar ecx, 1
mov dword [ebp - 0x430], ecx
mov edx, dword [ebp - 0x430]
mov dword [ebp - 0x420], edx
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0x434], eax
mov ecx, dword [ebp - 0x434]
add ecx, 2
mov dword [ebp - 0x438], ecx
mov edx, dword [ebp - 0x434]
mov ax, word [edx]
mov word [ebp - 0x43a], ax
add dword [ebp - 0x434], 2
cmp word [ebp - 0x43a], 0
jne 0x438a32
mov ecx, dword [ebp - 0x434]
sub ecx, dword [ebp - 0x438]
sar ecx, 1
mov dword [ebp - 0x440], ecx
mov edx, dword [ebp - 0x440]
shl edx, 1
push edx
mov eax, dword [ebp - 0x41c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00554120
add esp, 0xc
xor edx, edx
mov eax, dword [ebp - 0x420]
mov ecx, dword [ebp + 8]
mov word [ecx + eax*2], dx
mov eax, dword [ebp - 0x41c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055338c
mov esp, ebp
pop ebp
ret
Function at 0x43e770
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x1684]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x43e7ae
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
push ecx
push 0xfffffffffffffff8
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x1684]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongW]
jmp 0x43e7eb
push 0
push ecx
mov ecx, esp
push 0
call fcn.00416280
push 0x8000080
push 0x90000000
push 0x5bba88
push ecx
mov ecx, esp
push 0x5e01a8
call fcn.0042c490
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx + 0x1684]
call fcn.0042e560
mov edx, dword [ebp - 0xc]
add edx, 0x9d4
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x1684]
call fcn.00437e10
push 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1684]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x43f700
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x1684]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x43f73e
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
push ecx
push 0xfffffffffffffff8
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x1684]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongW]
jmp 0x43f77b
push 0
push ecx
mov ecx, esp
push 0
call fcn.00416280
push 0x8000080
push 0x90000000
push 0x5bba88
push ecx
mov ecx, esp
push 0x5e01a8
call fcn.0042c490
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx + 0x1684]
call fcn.0042e560
mov edx, dword [ebp - 0xc]
add edx, 0x9d4
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x1684]
call fcn.00437e10
push 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1684]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x43fa60
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov ecx, dword [ebp - 0x38]
movzx edx, byte [ecx + 0x168a]
test edx, edx
je 0x43facb
mov eax, dword [ebp - 0x38]
movzx ecx, byte [eax + 0x1689]
test ecx, ecx
jne 0x43facb
mov edx, dword [ebp - 0x38]
movzx eax, byte [edx + 0x159d]
test eax, eax
jne 0x43facb
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x38]
sub eax, dword [ecx + 0x168c]
cmp eax, 0x96
jbe 0x43facb
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 0x38]
mov dword [edx + 0x168c], eax
mov eax, dword [ebp - 0x38]
mov byte [eax + 0x168a], 0
mov ecx, dword [ebp - 0x38]
movzx edx, byte [ecx + 0x168a]
test edx, edx
jne 0x43fb1a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x38]
mov dword [ecx + 0x168c], eax
mov edx, dword [ebp - 0x38]
mov byte [edx + 0x168a], 1
mov dword [ebp - 0x10], 0x10
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 4]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0xa
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.COMCTL32.dll__TrackMouseEvent]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x16bc]
call fcn.00431150
test eax, eax
jne 0x43fbab
mov ecx, dword [ebp - 0x38]
movzx edx, byte [ecx + 0x159d]
test edx, edx
je 0x43fbab
push 0
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 0x38]
add edx, 0x9d4
push ecx
mov ecx, esp
push edx
call fcn.004310b0
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x16bc]
call fcn.00434730
push 1
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ecx + 0x16bc]
call fcn.00434670
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 4]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
lea edx, [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x16bc]
call fcn.00434700
push 0
push 0
push 0x200
lea ecx, [ebp - 0x34]
push ecx
mov ecx, dword [ebp - 0x38]
add ecx, 4
call fcn.0042c560
mov ecx, eax
call fcn.00401050
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x443660
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.0042c560
mov ecx, eax
call fcn.00401050
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0x10
call fcn.00553a71
add esp, 4
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x1774]
mov dword [edx], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x16f8]
mov dword [edx + 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x16fc]
mov dword [edx + 0xc], ecx
push 0
push 0
mov edx, dword [ebp - 4]
push edx
push 0x442df0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x443810
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 8
call fcn.00553a71
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x16fc]
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x443700
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x443a80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
push 0x4439b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x44ac60
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
mov ecx, dword [ebp - 0x38]
movzx edx, byte [ecx + 0x168a]
test edx, edx
je 0x44accb
mov eax, dword [ebp - 0x38]
movzx ecx, byte [eax + 0x1689]
test ecx, ecx
jne 0x44accb
mov edx, dword [ebp - 0x38]
movzx eax, byte [edx + 0x159d]
test eax, eax
jne 0x44accb
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x38]
sub eax, dword [ecx + 0x168c]
cmp eax, 0x96
jbe 0x44accb
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 0x38]
mov dword [edx + 0x168c], eax
mov eax, dword [ebp - 0x38]
mov byte [eax + 0x168a], 0
mov ecx, dword [ebp - 0x38]
movzx edx, byte [ecx + 0x168a]
test edx, edx
jne 0x44ad1a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x38]
mov dword [ecx + 0x168c], eax
mov edx, dword [ebp - 0x38]
mov byte [edx + 0x168a], 1
mov dword [ebp - 0x10], 0x10
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 4]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0xa
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.COMCTL32.dll__TrackMouseEvent]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x16bc]
call fcn.00431150
test eax, eax
jne 0x44adab
mov ecx, dword [ebp - 0x38]
movzx edx, byte [ecx + 0x159d]
test edx, edx
je 0x44adab
push 0
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 0x38]
add edx, 0x9d4
push ecx
mov ecx, esp
push edx
call fcn.004310b0
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x16bc]
call fcn.00434730
push 1
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ecx + 0x16bc]
call fcn.00434670
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 4]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
lea edx, [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x16bc]
call fcn.00434700
push 0
push 0
push 0x200
lea ecx, [ebp - 0x34]
push ecx
mov ecx, dword [ebp - 0x38]
add ecx, 4
call fcn.0042c560
mov ecx, eax
call fcn.00401050
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x450f60
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x5deba8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x3c], ecx
push 0
mov ecx, dword [ebp - 0x3c]
call fcn.0042e6e0
mov eax, dword [ebp - 0x3c]
movzx ecx, byte [eax + 0x168a]
test ecx, ecx
jne 0x450f9d
mov edx, dword [ebp - 0x3c]
movzx eax, byte [edx + 0x16d1]
test eax, eax
je 0x45108e
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x3c]
call fcn.00436260
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x14]
je 0x450fc0
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
jne 0x451014
mov dword [ebp - 0x24], 0
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
lea edx, [ebp - 0x24]
push edx
mov ecx, dword [ebp - 0x3c]
call fcn.00435cf0
sub esp, 0x10
mov eax, esp
mov ecx, dword [ebp - 0x24]
mov dword [eax], ecx
mov edx, dword [ebp - 0x20]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x18]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax + 0x16cc]
mov edx, dword [ebp - 0x3c]
mov eax, dword [edx + 0x16cc]
mov ecx, dword [ecx]
push eax
mov edx, dword [ecx + 0x50]
call edx
mov ecx, dword [ebp - 0x3c]
call fcn.00436260
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x451049
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
je 0x451049
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
je 0x451049
cmp dword [ebp - 0x14], 0xffffec78
je 0x451049
cmp dword [ebp - 0x10], 0xffffec78
jne 0x45108e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [ebp - 0x3c]
sub eax, dword [edx + 0x168c]
cmp eax, 0x96
jbe 0x45108e
mov eax, dword [0x5e24a8]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x3c]
mov dword [ecx + 0x168c], eax
mov edx, dword [ebp - 0x3c]
mov byte [edx + 0x168a], 0
mov eax, dword [ebp - 0x3c]
mov byte [eax + 0x16d1], 0
mov ecx, dword [ebp - 0x3c]
movzx edx, byte [ecx + 0x168a]
test edx, edx
jne 0x451105
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x3c]
mov dword [ecx + 0x168c], eax
mov edx, dword [ebp - 0x3c]
mov byte [edx + 0x168a], 1
mov dword [ebp - 0x34], 0x10
mov dword [ebp - 0x30], 1
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], 0x14
lea edx, [ebp - 0x34]
push edx
call dword [sym.imp.COMCTL32.dll__TrackMouseEvent]
push 0
push 0xa
push 0x3e9
mov ecx, dword [ebp - 0x3c]
add ecx, 4
call fcn.0042c510
push 0
push 0xa
push 0x3e8
mov ecx, dword [ebp - 0x3c]
add ecx, 4
call fcn.0042c510
push 0
push 0
push 0x200
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x3c]
add ecx, 4
call fcn.0042c560
mov ecx, eax
call fcn.00401050
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055338c
mov esp, ebp
pop ebp
ret 0x10
Function at 0x452850
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x728
mov eax, dword [0x5deba8]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x4b8], ax
push 0x256
push 0
lea ecx, [ebp - 0x4b6]
push ecx
call fcn.005533a0
add esp, 0xc
xor edx, edx
mov word [ebp - 0x260], dx
push 0x256
push 0
lea eax, [ebp - 0x25e]
push eax
call fcn.005533a0
add esp, 0xc
lea ecx, [ebp - 0x260]
push ecx
call fcn.004011a0
add esp, 4
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x16b8]
add eax, 0x30
push eax
lea ecx, [ebp - 0x260]
push ecx
push str._sData_Skins__s_RectSkin.ini
lea edx, [ebp - 0x4b8]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
xor eax, eax
mov word [ebp - 0x710], ax
push 0x256
push 0
lea ecx, [ebp - 0x70e]
push ecx
call fcn.005533a0
add esp, 0xc
mov edx, dword [ebp + 8]
cmp dword [edx + 0x16d0], 0
jne 0x452910
mov dword [ebp - 0x714], str.SeparatorLeftPngPath
jmp 0x45293e
mov eax, dword [ebp + 8]
cmp dword [eax + 0x16d0], 1
jne 0x452928
mov dword [ebp - 0x718], str.SeparatorMiddlePngPath
jmp 0x452932
mov dword [ebp - 0x718], str.SeparatorRightPngPath
mov ecx, dword [ebp - 0x718]
mov dword [ebp - 0x714], ecx
lea edx, [ebp - 0x4b8]
push edx
push 0x12c
lea eax, [ebp - 0x710]
push eax
push 0x5b26a8
mov ecx, dword [ebp - 0x714]
push ecx
push str.Separator
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [ebp - 0x710]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x452a14
lea eax, [ebp - 0x260]
mov dword [ebp - 0x71c], eax
mov ecx, dword [ebp - 0x71c]
add ecx, 2
mov dword [ebp - 0x720], ecx
mov edx, dword [ebp - 0x71c]
mov ax, word [edx]
mov word [ebp - 0x722], ax
add dword [ebp - 0x71c], 2
cmp word [ebp - 0x722], 0
jne 0x452998
mov ecx, dword [ebp - 0x71c]
sub ecx, dword [ebp - 0x720]
sar ecx, 1
mov dword [ebp - 0x728], ecx
lea edx, [ebp - 0x710]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x16b8]
add ecx, 0x30
push ecx
push str.DataSkins_s_s
mov edx, dword [ebp - 0x728]
lea eax, [ebp + edx*2 - 0x260]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0x260]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00428410
mov ecx, dword [ebp + 8]
call fcn.00429090
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0055338c
mov esp, ebp
pop ebp
ret 4
Function at 0x455420
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x5deba8]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x2c], ecx
push 0
mov ecx, dword [ebp - 0x2c]
call fcn.00438520
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x20]
push edx
mov ecx, dword [ebp - 0x2c]
add ecx, 4
call fcn.0042c560
mov ecx, eax
call fcn.00401050
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x2c]
add edx, 0xa94
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x455552
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0xaa4], 2
je 0x455518
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 0xaa4], 2
lea edx, [ebp - 0x1c]
push edx
mov ecx, dword [ebp - 0x2c]
add ecx, 4
call fcn.00453190
push 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x24]
push ecx
mov ecx, dword [ebp - 0x2c]
add ecx, 4
call fcn.0042c560
mov ecx, eax
call fcn.00401050
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edx, dword [ebp - 0x2c]
mov byte [edx + 0xab5], 1
mov eax, dword [ebp - 0x2c]
add eax, 0xab8
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [ebp - 0x2c]
add ecx, 0xa94
mov edx, dword [ebp - 0x2c]
add edx, 0xac0
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov ecx, dword [ecx + 0xc]
mov dword [edx + 0xc], ecx
push 0
push 3
push 0x3e9
mov ecx, dword [ebp - 0x2c]
add ecx, 4
call fcn.0042c510
push 0
push 0
push 0x817
lea edx, [ebp - 0x28]
push edx
mov ecx, dword [ebp - 0x2c]
add ecx, 4
call fcn.0042c560
mov ecx, eax
call fcn.00401050
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0055338c
mov esp, ebp
pop ebp
ret 0x10

Function at 0x456240
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
lea eax, [ebp - 8]
push eax
push 2
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x456265
or eax, 0xffffffff
jmp 0x4562e3
cmp dword [ebp - 8], 2
je 0x456270
or eax, 0xffffffff
jmp 0x4562e3
movzx eax, word [ebp - 4]
test eax, eax
je 0x45627d
or eax, 0xffffffff
jmp 0x4562e3
push 0
lea ecx, [ebp - 8]
push ecx
push 2
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x45629c
or eax, 0xffffffff
jmp 0x4562e3
cmp dword [ebp - 8], 2
je 0x4562a7
or eax, 0xffffffff
jmp 0x4562e3
movzx ecx, word [ebp - 4]
cmp ecx, 1
je 0x4562b5
or eax, 0xffffffff
jmp 0x4562e3
push 0
lea edx, [ebp - 8]
push edx
push 2
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4562d4
or eax, 0xffffffff
jmp 0x4562e3
cmp dword [ebp - 8], 2
je 0x4562df
or eax, 0xffffffff
jmp 0x4562e3
movzx eax, word [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x45c2e0
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
cmp dword [ebp + 8], 0
jne 0x45c2f3
xor eax, eax
jmp 0x45c49e
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x45c308
xor eax, eax
jmp 0x45c49e
push 0
push 0x80
push 3
push 0
push 1
push SHChangeNotifyDeregister
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x45c334
xor eax, eax
jmp 0x45c49e
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x1c], 0
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
ja 0x45c36a
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x45c49e
mov edx, dword [ebp - 0x10]
push edx
call fcn.00553501
add esp, 4
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
push 0
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 0x10]
je 0x45c3c2
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
push ecx
call fcn.00552dca
add esp, 4
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x45c49e
mov eax, dword [ebp - 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x45c3e8
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x45c49e
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x45c416
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x45c49e
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.005544b0
add esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
lea edx, [ebp - 4]
push edx
push 0
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x45c46b
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.00456110
add esp, 8
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [eax + 8]
call edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.00552dca
add esp, 4
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x45cbb0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x10
jne 0x45cbcb
mov al, 1
jmp 0x45cbcd
xor al, al
mov esp, ebp
pop ebp
ret