joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b6b0
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
sub esp, 0x20c
mov eax, dword [0x9c48d0]
xor eax, esp
mov dword [esp + 0x208], eax
cmp byte [0x9f5c67], 0
jne 0x42b75d
push esi
push edi
push 0x104
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.UxTheme.dll
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.OpenThemeData
push esi
call edi
push str.CloseThemeData
push esi
mov dword [0x9f45b4], eax
call edi
push str.DrawThemeBackground
push esi
mov dword [0x9f45b8], eax
call edi
push str.IsThemeActive
push esi
mov dword [0x9f45bc], eax
call edi
push str.IsThemeBackgroundPartiallyTransparent
push esi
mov dword [0x9f45c0], eax
call edi
push str.GetThemeColor
push esi
mov dword [0x9f45c4], eax
call edi
pop edi
mov dword [0x9f45c8], eax
mov byte [0x9f5c67], 1
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0065865c
add esp, 0x20c
ret

Function at 0x42b780
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x9c48d0]
xor eax, esp
mov dword [esp + 0x208], eax
cmp byte [0x9f5c68], 0
jne 0x42b80f
push esi
push edi
push 0x104
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.Dwmapi.dll
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.DwmIsCompositionEnabled
push esi
call edi
push str.DwmExtendFrameIntoClientArea
push esi
mov dword [0x9f45cc], eax
call edi
push str.DwmDefWindowProc
push esi
mov dword [0x9f45d0], eax
call edi
push str.DwmGetWindowAttribute
push esi
mov dword [0x9f45d4], eax
call edi
pop edi
mov dword [0x9f45d8], eax
mov byte [0x9f5c68], 1
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0065865c
add esp, 0x20c
ret
Function at 0x42c760
Capabilities:
Open clipboard

Disassembly:
sub esp, 0x60
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x74]
mov eax, dword [edi + 0x174]
test eax, eax
je 0x42c8e7
cmp dword [eax], 0
je 0x42c8e7
cmp dword [edi + 4], 0
je 0x42c8e7
mov ecx, dword [edi + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 0x78]
call edx
test eax, eax
je 0x42c8e7
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x42c8e7
call dword [sym.imp.USER32.dll_EmptyClipboard]
cmp dword [edi + 4], 0
je 0x42c7c8
mov ecx, dword [edi + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 0x78]
call edx
mov ebp, eax
jmp 0x42c7ca
xor ebp, ebp
mov ecx, dword [ebp + 0x28]
mov eax, dword [ecx]
mov edx, dword [eax + 0x54]
call edx
test al, al
jne 0x42c7f4
push 1
push 0
push 1
mov eax, str.Copying_text_was_denied__copying_as_image_only_
call fcn.0044a3e0
push eax
push edi
call fcn.0043dca0
jmp 0x42c8f8
mov ecx, dword [ebp + 0x28]
mov eax, dword [ecx]
mov edx, dword [eax + 0x40]
call edx
test al, al
jne 0x42c8f8
mov ebx, dword [ebp + 0x1c]
cmp dword [ebx], 0
setg al
mov byte [esp + 0x13], al
test al, al
je 0x42c832
push 0x92395c
call fcn.00435fe0
push 0
mov esi, eax
call fcn.00658a01
add esp, 4
jmp 0x42c8b9
lea esi, [esp + 0x18]
call fcn.00449340
mov eax, dword [edi + 0x174]
xor ebx, ebx
mov dword [esp + 0x14], ebx
cmp dword [eax], ebx
jbe 0x42c898
jmp 0x42c850
mov eax, dword [eax + 0xc]
sub esp, 0x20
lea esi, [eax + ebx + 8]
mov eax, dword [eax + ebx]
mov edi, esp
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
push eax
mov ecx, ebp
call fcn.00444770
test eax, eax
je 0x42c87c
push eax
lea eax, [esp + 0x1c]
call fcn.004404d0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x74]
mov eax, dword [edx + 0x174]
inc ecx
add ebx, 0x28
mov dword [esp + 0x14], ecx
cmp ecx, dword [eax]
jb 0x42c850
mov edi, edx
lea eax, [esp + 0x18]
push eax
xor ecx, ecx
call fcn.0042b890
push 0
mov esi, eax
call fcn.00658a01
add esp, 4
lea eax, [esp + 0x18]
call fcn.00401170
test esi, esi
je 0x42c8d1
xor ecx, ecx
cmp cx, word [esi]
je 0x42c8d1
mov bl, 1
mov edi, esi
call fcn.00451f80
mov edi, dword [esp + 0x74]
cmp byte [esp + 0x13], 0
je 0x42c8ef
call dword [sym.imp.USER32.dll_CloseClipboard]
push esi
call fcn.00658a01
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
ret
push esi
call fcn.00658a01
add esp, 4
mov edx, dword [edi + 0x174]
fld dword [ebp + 0x70]
mov eax, dword [edx + 0xc]
fstp dword [esp + 0x74]
mov edx, dword [ebp + 0x78]
fld dword [esp + 0x74]
mov ecx, dword [ebp + 0x28]
mov esi, dword [ecx]
push 0
push 2
lea edi, [eax + 8]
mov eax, dword [eax]
push edi
push edx
mov edx, dword [esi + 0x18]
push ecx
fstp dword [esp]
push eax
call edx
mov esi, eax
test esi, esi
je 0x42c940
mov eax, dword [esi]
push 1
call fcn.00452000
add esp, 4
call fcn.00401900
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x60
jmp dword [sym.imp.USER32.dll_CloseClipboard]
Function at 0x42e910
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40
mov eax, dword [0x9c48d0]
xor eax, esp
mov dword [esp + 0x3c], eax
mov edx, dword [0x9e86c0]
push esi
xor eax, eax
push edi
mov edi, ecx
test edx, edx
je 0x42ea7e
mov ecx, dword [0x9e86cc]
mov edi, edi
mov esi, dword [ecx + eax*4]
cmp dword [esi + 0x58], edi
je 0x42e95e
inc eax
cmp eax, edx
jb 0x42e940
pop edi
pop esi
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.0065865c
mov esp, ebp
pop ebp
ret
xor eax, eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0x100
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0xf
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
xor edi, edi
cmp dword [esi], eax
jbe 0x42e9de
mov eax, dword [esi + 0xc]
mov eax, dword [eax + edi*4]
mov ecx, dword [eax + 4]
mov edx, dword [eax]
push ecx
push edx
lea eax, [esp + 0x14]
push str._s__s_r_n
push eax
call fcn.00412600
inc edi
add esp, 0x10
cmp edi, dword [esi]
jb 0x42e9b6
mov ecx, dword [esp + 0x18]
mov edi, ecx
test ecx, ecx
je 0x42ea4b
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x42ea47
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, edi
lea edx, [eax + 2]
jmp 0x42ea00
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x42ea00
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
push ecx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x42ea41
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x1c]
cmp ecx, edx
je 0x42ea7e
mov eax, dword [esp + 0x3c]
push ecx
test eax, eax
jne 0x42ea75
call fcn.00658a01
add esp, 4
pop edi
pop esi
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.0065865c
mov esp, ebp
pop ebp
ret
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
mov ecx, dword [esp + 0x44]
pop edi
pop esi
xor ecx, esp
call fcn.0065865c
mov esp, ebp
pop ebp
ret
Function at 0x433400
Capabilities:
Get graphical window text

Disassembly:
push ecx
push ebp
push esi
lea ebp, [ebx + 0x44]
lea esi, [edi + 8]
cmp esi, ebp
je 0x433451
mov ecx, dword [ebp + 4]
call fcn.0044f630
test al, al
jne 0x43341d
xor eax, eax
mov byte [eax], al
mov eax, dword [ebp]
mov edx, dword [esi + 0xc]
mov dword [esi], eax
mov ecx, dword [ebp + 0xc]
add eax, eax
add eax, eax
push eax
push ecx
push edx
call fcn.0065b3c0
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0xc]
sub ecx, eax
add ecx, ecx
add ecx, ecx
push ecx
lea eax, [edx + eax*4]
push 0
push eax
call fcn.0065b340
add esp, 0x18
cmp byte [ebx + 0x324], 0
jne 0x433468
cmp dword [ebx + 0x328], 0
jne 0x433468
mov al, byte [ebx + 0x41]
jmp 0x43346e
mov al, byte [ebx + 0x32c]
mov edx, dword [edi + 0x60]
mov byte [edi + 4], al
mov ecx, dword [ebx + 4]
push edx
mov dword [edi], ecx
call fcn.00658a01
mov ebp, dword [ebx + 8]
add esp, 4
push 0
push 0
push 0xe
push ebp
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 8], eax
inc eax
push 2
push eax
call fcn.00658a3b
mov esi, eax
add esp, 8
test esi, esi
je 0x4334c2
mov eax, dword [esp + 8]
push esi
inc eax
push eax
push 0xd
push ebp
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 8]
xor eax, eax
mov word [esi + ecx*2], ax
mov dword [edi + 0x60], esi
mov edx, dword [edi + 0x64]
mov esi, dword [ebx]
push edx
call fcn.00658a01
add esp, 4
test esi, esi
je 0x4334e2
push esi
call fcn.00661039
add esp, 4
jmp 0x4334e4
xor eax, eax
mov dword [edi + 0x64], eax
mov eax, dword [ebx + 0x350]
mov dword [edi + 0x68], eax
mov ecx, dword [ebx + 0x354]
mov dword [edi + 0x6c], ecx
mov edx, dword [ebx + 0x358]
mov dword [edi + 0x70], edx
mov eax, dword [ebx + 0x35c]
mov dword [edi + 0x74], eax
mov ecx, dword [ebx + 0x320]
pop esi
mov dword [edi + 0x78], ecx
pop ebp
pop ecx
ret
Function at 0x433e80
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x20
mov eax, dword [0x9c48d0]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push ebp
push edi
test esi, esi
jne 0x433e9f
mov dword [esp + 0x10], 0xffffffff
jmp 0x433eb9
mov eax, dword [esi + 0x10c]
push 0
push 0
push 0x1304
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 0x10], eax
mov edx, dword [0x9f48bc]
cmp byte [edx + 0xed], 0
mov cl, 1
jne 0x433ed7
cmp byte [esi + 0x111], 0
jne 0x433ed7
xor al, al
jmp 0x433ed9
mov al, cl
xor edx, edx
test al, al
sete dl
cmp dword [esp + 0x10], edx
jle 0x433fb6
mov ebp, dword [sym.imp.USER32.dll_GetClientRect]
cmp byte [esi + 0x110], cl
je 0x433f4a
mov eax, dword [esi + 0x10c]
push 5
push eax
mov byte [esi + 0x110], cl
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 8]
lea ecx, [esp + 0x14]
push ecx
push eax
xor edi, edi
xor ebx, ebx
call ebp
test eax, eax
je 0x433f30
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
sub edi, dword [esp + 0x14]
sub ebx, dword [esp + 0x18]
mov ecx, dword [esi + 8]
movzx edx, bx
movzx eax, di
shl edx, 0x10
or edx, eax
push edx
push 0
push 5
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esi + 0x10c]
lea edx, [esp + 0x14]
push edx
push eax
xor ebx, ebx
call ebp
test eax, eax
je 0x433f66
mov ebx, dword [esp + 0x1c]
sub ebx, dword [esp + 0x14]
fld dword [esi + 0x138]
fmul qword [0x9adb38]
call fcn.0065d070
fld dword [esi + 0x138]
fmul qword [0x9ad8e0]
mov edi, eax
call fcn.0065d070
mov ecx, eax
lea eax, [ebx - 3]
cdq
idiv dword [esp + 0x10]
cmp edi, eax
jle 0x433f9a
mov edi, eax
mov edx, dword [esi + 0x10c]
movzx eax, cx
movzx ecx, di
shl eax, 0x10
or eax, ecx
push eax
push 0
push 0x1329
push edx
jmp 0x434010
cmp byte [esi + 0x110], 0
je 0x434016
mov eax, dword [esi + 0x10c]
push 0
push eax
mov byte [esi + 0x110], 0
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 8]
lea ecx, [esp + 0x14]
push ecx
push eax
xor edi, edi
xor ebx, ebx
call dword [sym.imp.USER32.dll_GetClientRect]
test eax, eax
je 0x433ffc
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
sub edi, dword [esp + 0x14]
sub ebx, dword [esp + 0x18]
mov ecx, dword [esi + 8]
movzx edx, bx
movzx eax, di
shl edx, 0x10
or edx, eax
push edx
push 0
push 5
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x24]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.0065865c
add esp, 0x20
ret
Function at 0x435020
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x40
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 8]
push edi
mov ebx, ecx
cmp eax, 0xfffffff4
ja 0x435104
je 0x4350fb
cmp eax, 0xfffffe3d
je 0x4350c9
cmp eax, 0xfffffe62
je 0x4350b8
cmp eax, 0xfffffe64
jne 0x435227
mov eax, 9
cmp ax, word [esi + 0xc]
jne 0x435227
cmp byte [ebx + 0x110], 0
je 0x4350a5
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call esi
shr eax, 0xf
test al, 1
je 0x4350a5
push 0x10
call esi
shr eax, 0xf
and al, 1
movzx ecx, al
push ecx
mov eax, ebx
call fcn.00434220
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x40
ret
mov ecx, ebx
call fcn.0040a860
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x40
ret
mov ecx, esi
call fcn.00434560
or eax, 0xffffffff
pop edi
pop esi
pop ebx
add esp, 0x40
ret
mov eax, dword [esi + 0xc]
cmp eax, 2
je 0x4350da
cmp eax, 1
jne 0x435227
mov ecx, dword [esi]
cmp eax, 1
sete dl
movzx eax, dl
push eax
mov eax, dword [esi + 0x3c]
call fcn.00434840
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
add esp, 0x40
ret
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x40
ret
cmp eax, 0xfffffffc
je 0x4351a9
cmp eax, 0xfffffffe
jne 0x435227
xor eax, eax
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_GetMessagePos]
movsx ecx, ax
shr eax, 0x10
movsx edx, ax
push 1
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ecx
mov ecx, dword [esi]
push eax
push ecx
push 0
mov dword [esp + 0x24], edx
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [esi]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
lea edx, [esp + 0x10]
push edx
push 0
push 0x1111
push eax
call edi
test byte [esp + 0x18], 0x46
je 0x435227
mov ecx, dword [esi]
push 0
push 9
push 0x110a
push ecx
call edi
mov ecx, dword [esp + 0x1c]
cmp eax, ecx
jne 0x435227
mov eax, ecx
mov ecx, dword [esi]
push 1
call fcn.00434840
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
add esp, 0x40
ret
mov esi, dword [esi]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 9
push 0x110a
push esi
call edi
lea edx, [esp + 0x20]
push edx
push 0
push 0x113e
push esi
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], 4
call edi
mov eax, dword [esp + 0x44]
mov esi, eax
test eax, eax
je 0x435227
cmp dword [ebx + 4], 0
je 0x435227
push 0x14
call fcn.00659e93
add esp, 4
test eax, eax
je 0x435211
mov ecx, dword [ebx + 4]
mov dword [eax + 4], str.UITask
mov dword [eax], 0x9279c0
mov dword [eax + 8], esi
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ecx
jmp 0x435213
xor eax, eax
push eax
mov eax, dword [0x9f4d14]
push 0
push 0x401
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x40
ret
Function at 0x436710
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push ebp
mov ebp, dword [esp + 0x20]
xor eax, eax
push esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
push edi
lea eax, [esp + 0x10]
push eax
call ebx
mov edx, dword [ebp]
mov edi, dword [esp + 0x2c]
mov eax, dword [edx + 0x88]
push edi
mov ecx, ebp
call eax
lea ecx, [esp + 0x18]
push ecx
mov byte [esp + 0x2c], al
call ebx
lea esi, [esp + 0x10]
call fcn.00401b30
fstp st(0)
cmp byte [esp + 0x28], 0
jne 0x43677d
push edi
mov edi, dword [0x9eef28]
push str.Error:_failed_to_load_page__d
call fcn.00436340
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
lea esi, [esp + 0x10]
call fcn.00401b30
sub esp, 8
fstp qword [esp]
push edi
mov edi, dword [0x9eef28]
push str.pageload____3d:__.2f_ms
call fcn.00436340
add esp, 0x10
lea edx, [esp + 0x10]
xor esi, esi
push edx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
call ebx
fld1
mov eax, dword [ebp]
mov edi, dword [esp + 0x2c]
mov edx, dword [eax + 0x18]
push esi
push esi
push esi
push esi
push ecx
fstp dword [esp]
push edi
mov ecx, ebp
call edx
mov ebp, eax
lea eax, [esp + 0x18]
push eax
call ebx
lea esi, [esp + 0x10]
call fcn.00401b30
fstp st(0)
test ebp, ebp
jne 0x4367fe
push edi
mov edi, dword [0x9eef28]
push str.Error:_failed_to_render_page__d
call fcn.00436340
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov ecx, dword [ebp]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call fcn.006590fa
add esp, 4
lea esi, [esp + 0x10]
call fcn.00401b30
sub esp, 8
fstp qword [esp]
push edi
mov edi, dword [0x9eef28]
push str.pagerender__3d:__.2f_ms
call fcn.00436340
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x436aa0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x18
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push edi
mov dword [0x9e7590], eax
xor eax, eax
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call esi
mov eax, dword [esp + 0x28]
call fcn.00436900
lea edx, [esp + 0x18]
push edx
mov ebx, eax
call esi
lea esi, [esp + 0x10]
call fcn.00401b30
mov eax, dword [esp + 0x2c]
mov edi, dword [0x9eef28]
sub esp, 8
fstp qword [esp]
push eax
push str._s:__.2f_ms
call fcn.00436340
add esp, 0x10
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x18
ret
Function at 0x436b10
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x50
mov eax, dword [0x9c48d0]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push esi
push edi
mov edi, dword [0x9eef28]
xor ebx, ebx
mov esi, ecx
mov byte [esp + 0xf], bl
cmp edi, ebx
jne 0x436b58
push 4
call fcn.00659e93
add esp, 4
cmp eax, ebx
je 0x436b4b
mov dword [eax], 0x928020
mov edi, eax
jmp 0x436b4d
xor edi, edi
mov dword [0x9eef28], edi
mov byte [esp + 0xf], 1
push esi
push str.Starting:__s
call fcn.00436340
add esp, 8
cmp esi, ebx
je 0x436b82
lea eax, [esp + 0x30]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x436b82
test byte [esp + 0x30], 0x10
je 0x436ba7
mov edi, dword [0x9eef28]
push str.Error:_file_doesnt_exist
call fcn.00436340
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0065865c
add esp, 0x50
ret
push ebx
mov eax, esi
call fcn.00440b20
add esp, 4
test al, al
jne 0x436bdb
mov edi, dword [0x9eef28]
push str.Error:_not_an_ebook_file
call fcn.00436340
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0065865c
add esp, 0x50
ret
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call edi
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.004408a0
add esp, 4
cmp dword [esp + 0x14], ebx
je 0x436c2b
mov edi, dword [0x9eef28]
push str.Error:_failed_to_load_the_file_as_doc
call fcn.00436340
add esp, 4
lea ebx, [esp + 0x10]
call fcn.00440670
mov eax, dword [esp + 0x18]
push eax
jmp 0x436d06
lea ecx, [esp + 0x28]
push ecx
call edi
lea esi, [esp + 0x20]
call fcn.00401b30
mov edi, dword [0x9eef28]
sub esp, 8
fstp qword [esp]
push str.load:__.2f_ms
call fcn.00436340
add esp, 0xc
lea edx, [esp + 0x10]
push 0x927bd8
push edx
mov eax, 2
call fcn.00436aa0
mov esi, eax
lea eax, [esp + 0x18]
push str.gdi
push eax
xor eax, eax
call fcn.00436aa0
lea ecx, [esp + 0x20]
push str.gdi_quick
push ecx
mov eax, 1
call fcn.00436aa0
lea edx, [esp + 0x28]
push 0x927bd8
push edx
mov eax, 2
call fcn.00436aa0
lea eax, [esp + 0x30]
push str.gdi
push eax
xor eax, eax
call fcn.00436aa0
lea ecx, [esp + 0x38]
push str.gdi_quick
push ecx
mov eax, 1
call fcn.00436aa0
add esp, 0x30
lea ebx, [esp + 0x10]
call fcn.00440670
mov edi, dword [0x9eef28]
push esi
push str.pages:__d
call fcn.00436340
add esp, 8
cmp byte [esp + 0xf], 0
je 0x436d01
mov ecx, dword [0x9eef28]
test ecx, ecx
je 0x436d01
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00658a01
mov ecx, dword [esp + 0x58]
add esp, 4
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0065865c
add esp, 0x50
ret
Function at 0x436d20
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub esp, 0x20
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push esi
push edi
lea eax, [esp + 0x10]
xor esi, esi
push eax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
call ebp
mov ecx, dword [esp + 0x34]
mov edi, dword [0x9eef28]
push ecx
push str.Starting:__s
call fcn.00436340
add esp, 8
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
call ebp
push 0x150
call fcn.00659e93
mov edi, eax
add esp, 4
cmp edi, esi
je 0x436d83
xor eax, eax
call fcn.00447b00
mov ebx, eax
jmp 0x436d85
xor ebx, ebx
mov eax, dword [esp + 0x34]
mov edi, ebx
call fcn.004484d0
test al, al
jne 0x436da4
cmp ebx, esi
je 0x436da8
mov eax, dword [ebx]
mov edx, dword [eax]
push 1
mov ecx, ebx
call edx
jmp 0x436da8
cmp ebx, esi
jne 0x436dc8
mov eax, dword [esp + 0x34]
mov edi, dword [0x9eef28]
push eax
push str.Error:_failed_to_load__s
call fcn.00436340
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
lea ecx, [esp + 0x28]
push ecx
call ebp
lea esi, [esp + 0x20]
call fcn.00401b30
mov edi, dword [0x9eef28]
sub esp, 8
fstp qword [esp]
push str.load:__.2f_ms
call fcn.00436340
mov edx, dword [ebx]
mov eax, dword [edx]
add esp, 0xc
push 1
mov ecx, ebx
call eax
lea ecx, [esp + 0x18]
push ecx
call ebp
lea esi, [esp + 0x10]
call fcn.00401b30
fstp st(0)
mov edx, dword [esp + 0x34]
push edx
push ecx
call fcn.00401b30
mov edi, dword [0x9eef28]
push ecx
fstp qword [esp]
push str.Finished__in__.2f_ms_:__s
call fcn.00436340
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x439830
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x439842
pop esi
ret
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push edi
call fcn.00658d9b
mov esi, eax
add esp, 4
test esi, esi
je 0x439872
push edi
push ebx
push esi
call fcn.0065b3c0
add esp, 0xc
cmp dword [esi], 0xffff0001
pop edi
pop ebx
jne 0x439887
or dword [esi + 8], 0x400000
mov eax, esi
pop esi
ret
or dword [esi + 4], 0x400000
mov eax, esi
pop esi
ret

Function at 0x43a620
Capabilities:
Get graphical window text

Disassembly:
push ecx
fld dword [esp + 0xc]
push ebx
push esi
fstp dword [esp + 0x14]
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
push 0x147
mov esi, eax
push 0x401
push esi
call edi
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call ebx
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x43a71b
push ebp
push 0x401
push esi
call edi
push 0
push 0
mov edi, eax
push 0xe
push edi
call ebx
mov ebx, eax
lea ebp, [ebx + 1]
push 2
push ebp
call fcn.00658a3b
mov esi, eax
add esp, 8
test esi, esi
je 0x43a694
push esi
push ebp
push 0xd
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov word [esi + ebx*2], ax
push esi
call fcn.0065ed99
fstp dword [esp + 0x14]
fldz
add esp, 4
fld dword [esp + 0x10]
pop ebp
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 0x41
jne 0x43a707
fld dword [0x9adb18]
fcom st(1)
fnstsw ax
test ah, 0x41
jne 0x43a6da
fstp st(1)
push esi
fstp dword [esp + 0x1c]
call fcn.00658a01
fld dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebx
pop ecx
ret
fstp st(0)
fcom qword [0x9adb10]
fnstsw ax
test ah, 0x41
jne 0x43a6c4
fstp st(0)
push esi
fld dword [0x9adb08]
fstp dword [esp + 0x1c]
call fcn.00658a01
fld dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebx
pop ecx
ret
push esi
fstp st(0)
call fcn.00658a01
fld dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebx
pop ecx
ret
cmp byte [esp + 0x14], 0
je 0x43a725
add ecx, 7
fld dword [ecx*4 + 0x9e7b08]
fldz
fucompp
fnstsw ax
test ah, 0x44
jnp 0x43a742
fld dword [ecx*4 + 0x9e7b08]
fstp dword [esp + 0x18]
fld dword [esp + 0x18]
pop edi
pop esi
pop ebx
pop ecx
ret