joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ed52
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push ebx
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x42ed8d
xor eax, eax
jmp 0x42ee44
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x40], eax
inc eax
push eax
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
mov edi, eax
pop ecx
test edi, edi
jne 0x42edb5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x42ee43
push ebx
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x3c], ebx
push eax
push dword [ebp - 0x40]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42ee33
mov eax, dword [ebp - 0x3c]
mov byte [eax + edi], bl
call fcn.0042f162
test al, al
je 0x42ee33
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0xc], ebx
push edi
mov dword [ebp - 8], 0xf
mov byte [ebp - 0x1c], bl
call fcn.004062bc
push ebx
lea eax, [ebp - 0x1c]
push eax
push str.http:__pcwiz.feedback.360.cn_feedback.php
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x35]
call fcn.0042f111
lea ecx, [ebp - 0x1c]
call fcn.004061d7
cmp dword [ebp - 0x24], ebx
je 0x42ee2b
push 0x52f954
lea ecx, [ebp - 0x34]
call fcn.0042f0e3
test eax, eax
je 0x42ee2b
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x34]
call fcn.004061d7
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
mov eax, ebx
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00522d04
leave
ret 4
Function at 0x42f505
Capabilities:
Check if file exists
Get file attributes
Query environment variable
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x527fb4
lea ecx, [ebp + 8]
call fcn.00419990
test al, al
je 0x42f531
xor esi, esi
jmp 0x42f6c5
xor eax, eax
cmp dword [ebp + 0x1c], 8
push ebx
push edi
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp + 8]
jb 0x42f548
mov eax, dword [ebp + 8]
push 0x3200000
xor esi, esi
lea ecx, [ebp - 0x14]
push esi
push ecx
push eax
call fcn.00430113
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24c]
push eax
call fcn.0043102d
xor eax, eax
mov dword [ebp - 0x224], esi
push 0x10000
mov dword [ebp - 0x220], 7
mov word [ebp - 0x234], ax
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
mov edi, eax
xor eax, eax
mov word [edi], ax
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp - 0x264]
push str._AppData_360DiagnoseScan_
push eax
call fcn.0042ba61
add esp, 0x28
cmp dword [eax + 0x14], 8
jb 0x42f5b4
mov eax, dword [eax]
push 0x8000
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ebp - 0x264]
mov ebx, eax
call fcn.00410d88
test ebx, ebx
je 0x42f6ad
cmp ebx, 0x8000
jae 0x42f6ad
xor eax, eax
push edi
mov word [edi + ebx*2], ax
call sub.msvcrt.dll_wcslen
pop ecx
push eax
push edi
lea ecx, [ebp - 0x234]
call fcn.00410dd4
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
cmp dword [ebp - 0x220], 8
lea edi, [ebp - 0x234]
pop ecx
jb 0x42f618
mov edi, dword [ebp - 0x234]
mov ebx, 0x527fb4
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x42f6ad
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42f6ad
test al, 0x10
jne 0x42f6ad
push 0x208
lea eax, [ebp - 0x21c]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x234]
cmp dword [ebp - 0x220], 8
jb 0x42f667
mov ecx, dword [ebp - 0x234]
cmp dword [ebp - 0x238], 8
lea eax, [ebp - 0x24c]
jb 0x42f67c
mov eax, dword [ebp - 0x24c]
push ecx
push 0x104
lea ecx, [ebp - 0x21c]
push ecx
push ebx
push 0x52f998
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x21c]
push ebx
push eax
call sub.msvcrt.dll_wcscmp
mov esi, eax
neg esi
pop ecx
sbb esi, esi
pop ecx
neg esi
lea ecx, [ebp - 0x234]
call fcn.00410d88
lea ecx, [ebp - 0x24c]
call fcn.00410d88
pop edi
pop ebx
lea ecx, [ebp + 8]
call fcn.00410d88
lea ecx, [ebp + 0x20]
call fcn.00410d88
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00522d04
leave
ret
Function at 0x430113
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x14]
xor ebx, ebx
push edi
push ebx
push ebx
push 3
push ebx
push 1
push SysReAllocStringLen
push eax
mov dword [ebp - 0x7c], ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x430155
xor eax, eax
jmp 0x430210
lea eax, [ebp - 0x70]
mov dword [ebp - 0x70], ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test esi, esi
je 0x430176
cmp esi, eax
jb 0x430178
lea eax, [ebp - 0x70]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp dword [ebp - 0x70], ebx
jne 0x430207
cmp dword [ebp + 0x10], ebx
je 0x430192
push ebx
push ebx
push dword [ebp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esi + 1]
push 0x577e22
push eax
call fcn.004f4050
mov dword [ebp - 0x78], eax
pop ecx
pop ecx
test eax, eax
je 0x430207
push ebx
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x74], ebx
push ecx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4301fe
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x78]
push ebx
mov byte [eax + ecx], bl
lea eax, [ebp - 0x6c]
mov esi, dword [ebp - 0x74]
push eax
call fcn.004054d3
push esi
push dword [ebp - 0x78]
lea eax, [ebp - 0x6c]
push eax
call fcn.00405511
lea eax, [ebp - 0x6c]
push eax
call fcn.0040541b
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x7c]
call sub.msvcrt.dll_memcpy
xor ebx, ebx
add esp, 0x24
inc ebx
push dword [ebp - 0x78]
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00522d04
leave
ret
Function at 0x43143d
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push edi
push 0x5c
pop eax
push eax
push dword [ebp + 8]
jmp 0x431475
push dword [ebp + 8]
xor eax, eax
mov word [edi], ax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x43146a
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x431490
push 0x5c
pop eax
push eax
mov word [edi], ax
lea eax, [edi + 2]
push eax
call sub.msvcrt.dll_wcschr
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x43144a
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
pop ebp
ret
xor eax, eax
jmp 0x43148d

Function at 0x431c8c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
push edi
lea esi, [ebx + 0xd0]
cmp dword [esi + 0x14], 8
mov edi, esi
jb 0x431cb1
mov edi, dword [esi]
push 0x527fb4
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x431d79
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x431d79
test al, 0x10
jne 0x431d79
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
push 8
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
cmp dword [esi + 0x14], edi
jb 0x431cf0
mov esi, dword [esi]
push 0x3200000
push 0
lea eax, [ebp - 0x14]
push eax
push esi
call fcn.00430113
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0043102d
add esp, 0x18
lea edx, [ebp - 0x2c]
cmp dword [ebp - 0x18], edi
jb 0x431d1c
mov edx, dword [ebp - 0x2c]
lea ecx, [ebp - 0x2c]
jb 0x431d24
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x2c]
jb 0x431d32
mov ecx, dword [ebp - 0x2c]
push sub.msvcrt.dll_towlower
push edx
push eax
push ecx
lea eax, [ebp - 0x30]
push eax
call fcn.004311ac
lea eax, [ebx + 0xa0]
add esp, 0x14
cmp dword [eax + 0x14], edi
jb 0x431d53
mov eax, dword [eax]
lea ecx, [ebp - 0x2c]
cmp dword [ebp - 0x18], edi
jb 0x431d5e
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call sub.msvcrt.dll_wcscmp
pop ecx
neg eax
pop ecx
sbb esi, esi
lea ecx, [ebp - 0x2c]
neg esi
call fcn.00410d88
mov eax, esi
jmp 0x431d7c
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00522d04
leave
ret
Function at 0x432152
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
lea ecx, [ebp - 0x84]
call fcn.00428599
lea eax, [esi + 0x88]
push eax
lea ecx, [ebp - 0x80]
call fcn.004286b9
lea eax, [esi + 0xa0]
push eax
lea ecx, [ebp - 0x68]
call fcn.004286b9
lea eax, [esi + 0xb8]
push eax
lea ecx, [ebp - 0x50]
call fcn.004286b9
lea eax, [esi + 0x100]
push eax
lea ecx, [ebp - 0x38]
call fcn.004286b9
lea eax, [esi + 0x118]
push eax
lea ecx, [ebp - 0x20]
call fcn.004286b9
cmp dword [ebp + 0xc], 0
jne 0x4321e1
xor eax, eax
push eax
push eax
push esi
push 0x432976
push eax
push eax
call sub.msvcrt.dll__beginthreadex
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4321f6
mov ecx, dword [esi + 0x28]
lea edx, [ebp - 0x84]
push 0
push edx
push 0x59
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea ecx, [ebp - 0x84]
call fcn.0042868d
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.00522d04
leave
ret 0x10

Function at 0x43268a
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x145c
call fcn.00522d80
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
mov eax, dword [edi + 0x7c]
test eax, eax
jne 0x4326bb
call fcn.00431c47
mov eax, dword [edi + 0x7c]
test eax, eax
je 0x432796
push ebx
push esi
lea ecx, [edi + 0x30]
call fcn.00467bbb
push 0x1450
lea eax, [ebp - 0x1454]
push 0
push eax
call sub.msvcrt.dll_memset
lea eax, [edi + 0x88]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x4326e9
mov eax, dword [eax]
push eax
push str.PDown:___sh330
lea eax, [ebp - 0x1454]
push 0xa28
push eax
call fcn.004329e6
lea esi, [edi + 0xe8]
add esp, 0x10
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x432713
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43272f
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x432728
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esi + 0x14], 8
jb 0x432737
mov esi, dword [esi]
push edi
push esi
lea ecx, [ebp - 0x145c]
call fcn.00402af5
push eax
lea eax, [ebp - 0x1454]
push eax
lea ecx, [ebp - 0x1458]
call fcn.00402af5
push eax
lea ecx, [edi + 0x30]
call fcn.00467b14
mov ecx, dword [ebp - 0x1458]
mov esi, eax
lea ecx, [ecx - 0x10]
call fcn.004042e9
mov ecx, dword [ebp - 0x145c]
lea ecx, [ecx - 0x10]
call fcn.004042e9
test esi, esi
pop esi
pop ebx
jne 0x432796
push 0
push 1
push 0x464
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
inc eax
pop edi
call fcn.00522d04
leave
ret
Function at 0x4327d3
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x60], esi
lea ebx, [esi + 0xd0]
cmp dword [ebx + 0x14], 8
mov eax, ebx
jb 0x4327fa
mov eax, dword [ebx]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x43281d
push eax
push 1
push 0x465
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
jmp 0x432968
push edi
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
push 8
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, ebx
pop edi
cmp dword [ebx + 0x14], edi
jb 0x432833
mov eax, dword [ebx]
push 0x3200000
xor esi, esi
lea ecx, [ebp - 0x14]
push esi
push ecx
push eax
call fcn.00430113
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0043102d
add esp, 0x18
lea edx, [ebp - 0x2c]
cmp dword [ebp - 0x18], edi
jb 0x432860
mov edx, dword [ebp - 0x2c]
lea ecx, [ebp - 0x2c]
jb 0x432868
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x2c]
jb 0x432876
mov ecx, dword [ebp - 0x2c]
push sub.msvcrt.dll_towlower
push edx
push eax
push ecx
lea eax, [ebp - 0x64]
push eax
call fcn.004311ac
mov edi, dword [ebp - 0x60]
add esp, 0x14
lea eax, [edi + 0xa0]
cmp dword [eax + 0x14], 8
jb 0x43289b
mov eax, dword [eax]
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x2c]
jb 0x4328a7
mov ecx, dword [ebp - 0x2c]
push eax
push ecx
call sub.msvcrt.dll_wcscmp
pop ecx
pop ecx
test eax, eax
jne 0x432929
push str.main
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x60], esi
call fcn.00404eab
cmp dword [ebx + 0x14], 8
jb 0x4328cc
mov ebx, dword [ebx]
push ebx
lea ecx, [ebp - 0x44]
call fcn.004108e3
lea eax, [ebp - 0x60]
push eax
push dword [edi + 4]
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.004a0c8b
add esp, 0x10
lea ecx, [ebp - 0x44]
mov bl, al
call fcn.00410d88
lea ecx, [ebp - 0x5c]
call fcn.004061d7
test bl, bl
je 0x432929
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x64
push 0x568
push dword [edi + 4]
call esi
push 0xffffffffffffffff
push dword [edi + 0x134]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 0
jmp 0x432952
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push str.ck_Wzf
push 0x64
push 0x568
push dword [edi + 4]
call esi
push 0xffffffffffffffff
push dword [edi + 0x134]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 1
push 0x465
push dword [edi + 4]
call esi
lea ecx, [ebp - 0x2c]
call fcn.00410d88
xor eax, eax
inc eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00522d04
leave
ret
Function at 0x4343b7
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, ecx
push 0x4fd
push dword [ebx + 4]
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call esi
push 0
push 0x4fb
push dword [ebx + 4]
lea ecx, [ebx + 0x20]
call fcn.004b542f
push 0x43e
push dword [ebx + 4]
call edi
push 0
push eax
call esi
push 0x4f9
push dword [ebx + 4]
call edi
push 0
push eax
call esi
push 0x4fc
push dword [ebx + 4]
call edi
push 0
push eax
call esi
push 0x40d
push dword [ebx + 4]
call edi
push 0
push eax
call esi
push 0x50e
push dword [ebx + 4]
call edi
push 0
push eax
call esi
push 0x40e
push dword [ebx + 4]
call edi
push 0
push eax
call esi
push 0x512
push dword [ebx + 4]
call edi
push 0
push eax
call esi
push 0x40f
push dword [ebx + 4]
call edi
xor edi, edi
push edi
push eax
call esi
push edi
push edi
push 0x402
push dword [ebx + 0x48]
call dword [sym.imp.USER32.dll_SendMessageW]
push str._._colorrgb_51_51_51___._0___0KB_s
push 0x4f9
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
pop edi
pop esi
pop ebx
ret
Function at 0x434c32
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
push 3
mov esi, ecx
call fcn.00435610
mov ecx, esi
call fcn.00434489
cmp dword [esi + 0x64], 0
je 0x434c58
push 1
push dword [esi + 0x64]
lea ecx, [esi + 0x68]
call fcn.00467c75
lea ebx, [esi + 0x60]
mov edi, dword [ebx]
push 0x527fb4
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x434c91
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x434c91
test al, 0x10
jne 0x434c91
push 0
push 1
push 0x7a8
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x434ca2
push esi
push ebx
lea eax, [esi + 0x5c]
push eax
lea ecx, [esi + 0x68]
call fcn.00467b14
mov dword [esi + 0x64], eax
pop edi
pop esi
pop ebx
ret

Function at 0x435045
Capabilities:
Create thread

Disassembly:
push esi
push 6
mov esi, ecx
call fcn.00435610
xor eax, eax
push eax
push eax
push esi
push 0x435ab0
push eax
push eax
call sub.msvcrt.dll__beginthreadex
add esp, 0x18
pop esi
ret

Function at 0x4352aa
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
push edi
cmp eax, 1
jne 0x435371
xor edi, edi
cmp dword [esi + 0x42cc], edi
jne 0x435351
cmp dword [esi + 0x44c], 2
je 0x4352ed
lea eax, [esi + 0x2ac8]
push eax
lea eax, [esi + 0xaa8]
push eax
call fcn.00435cea
pop ecx
pop ecx
test eax, eax
jle 0x435351
call fcn.00403a64
push eax
lea ecx, [ebp + 0xc]
call fcn.00402a6b
lea ecx, [esi + 0x3c8]
cmp dword [ecx + 0x14], 8
jb 0x435309
mov ecx, dword [ecx]
lea eax, [esi + 0x6a8]
push eax
lea eax, [esi + 0x4a8]
push eax
push 0x527fb4
push ecx
lea eax, [ebp + 0xc]
push str._s__s__s__s
push eax
call fcn.00415254
mov ecx, dword [esi + 0x28]
add esp, 0x18
xor eax, eax
cmp dword [esi + 0x44c], 2
sete al
mov edx, dword [ecx]
push eax
lea eax, [esi + 0xcc]
push eax
push 0x43
call dword [edx + 0xc]
jmp 0x43542b
push 6
mov ecx, esi
call fcn.00435610
push edi
push edi
push esi
push 0x435ab0
push edi
push edi
call sub.msvcrt.dll__beginthreadex
add esp, 0x18
jmp 0x435436
test eax, eax
jne 0x435381
push 4
call fcn.00435610
jmp 0x435436
cmp eax, 2
jne 0x4353de
push 8
call fcn.00435610
push dword [esi + 0x60]
call fcn.0041420e
sub esp, 0x18
mov ecx, esp
push str.DumpFile.dat
call fcn.004108e3
sub esp, 0x18
lea eax, [esi + 0x3f8]
mov ecx, esp
xor edi, edi
push eax
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
call fcn.0041992a
sub esp, 0x18
lea eax, [esi + 0x380]
mov ecx, esp
push eax
mov dword [ecx + 0x10], edi
mov dword [ecx + 0x14], edi
call fcn.0041992a
call fcn.0042a0b7
add esp, 0x48
jmp 0x435436
cmp eax, 3
jne 0x435436
push 7
call fcn.00435610
call fcn.00403a64
push eax
lea ecx, [ebp + 0xc]
call fcn.00402a6b
lea ecx, [esi + 0x3c8]
cmp dword [ecx + 0x14], 8
jb 0x435406
mov ecx, dword [ecx]
lea eax, [esi + 0x6a8]
push eax
lea eax, [esi + 0x4a8]
push eax
push 0x527fb4
push ecx
lea eax, [ebp + 0xc]
push str._s__s__s__s
push eax
call fcn.00415254
add esp, 0x18
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.004042e9
pop edi
xor eax, eax
pop esi
pop ebp
ret 0x10
Function at 0x435f70
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x474
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x3ea
push edi
mov edi, ecx
jne 0x4360a8
push ebx
push esi
mov esi, 0x208
lea eax, [ebp - 0x20c]
push esi
xor ebx, ebx
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x554
push dword [edi - 0x1c]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
lea eax, [ebp - 0x414]
push ebx
push eax
call sub.msvcrt.dll_memset
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
add esp, 0xc
push ebx
push ebx
push 0x147
push dword [edi + 0x18]
call esi
lea ecx, [ebp - 0x414]
push ecx
push eax
push 0x148
push dword [edi + 0x18]
call esi
push 0x527fb4
lea ecx, [ebp - 0x42c]
call fcn.004108e3
lea eax, [ebp - 0x20c]
push eax
push 0x530d48
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x474]
push eax
call fcn.00435df3
add esp, 0xc
push eax
lea eax, [ebp - 0x45c]
push eax
call fcn.00424243
add esp, 0xc
push eax
lea eax, [ebp - 0x444]
push eax
call fcn.00424243
add esp, 0xc
lea ecx, [ebp - 0x42c]
push eax
call fcn.004132cc
lea ecx, [ebp - 0x444]
call fcn.00410d88
lea ecx, [ebp - 0x45c]
call fcn.00410d88
lea ecx, [ebp - 0x474]
call fcn.00410d88
mov ecx, dword [edi + 8]
lea edx, [ebp - 0x42c]
push ebx
push edx
push 0x41
mov eax, dword [ecx]
call dword [eax + 0xc]
lea ecx, [ebp - 0x42c]
call fcn.00410d88
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
inc eax
pop edi
call fcn.00522d04
leave
ret 4

Function at 0x436326
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x554
push edi
mov edi, ecx
jne 0x4363e2
cmp dword [ebp + 8], 0x300
jne 0x4363e2
push ebx
push esi
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetParent]
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3ea
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
push 0x208
mov esi, eax
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x554
push dword [edi + 4]
call ebx
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x210], eax
cmp esi, eax
je 0x4363e0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetParent]
push dword [ebp - 0x210]
push 0x3ea
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00522d04
leave
ret 0xc
Function at 0x436feb
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, ecx
push 0x518
xor ebx, ebx
push dword [esi - 0x1c]
mov dword [esi + 0x34], ebx
call edi
push 0x42
push 0x23
push 0x1f4
push ebx
push ebx
push ebx
mov ebx, dword [sym.imp.USER32.dll_SetWindowPos]
push eax
call ebx
cmp dword [ebp + 8], 0
je 0x43702e
push dword [ebp + 8]
lea ecx, [esi + 0x14]
call fcn.004286b9
xor ecx, ecx
lea eax, [esi - 0x20]
push ecx
push ecx
push eax
push 0x437a84
push ecx
push ecx
call sub.msvcrt.dll__beginthreadex
add esp, 0x18
mov dword [esi + 0x10], eax
push 0x4f4
push dword [esi - 0x1c]
call edi
push 1
xor ecx, ecx
push ecx
push ecx
push 0xd7
push 0x11d
push ecx
push eax
call ebx
push 0x451
push dword [esi - 0x1c]
call edi
push 1
xor ecx, ecx
push ecx
push ecx
push 0xdc
push 0x145
push ecx
push eax
call ebx
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
pop ebp
ret 8
Function at 0x43b806
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x56afe8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x224], eax
test esi, esi
jne 0x43b831
xor eax, eax
jmp 0x43b927
push ebx
push edi
lea eax, [ebp - 0x220]
xor ebx, ebx
push eax
push str.Q360DownloadMain
mov dword [esi], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x218], ebx
call fcn.0043b7d0
mov edi, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x220]
sub edi, eax
sar edi, 2
test edi, edi
jle 0x43b911
mov eax, dword [eax + ebx*4]
push 0x208
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [ebp - 0x214]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jle 0x43b8f9
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp - 0x224]
push dword [eax]
call sub.msvcrt.dll__wcsicmp
pop ecx
pop ecx
test eax, eax
jne 0x43b8f9
and dword [ebp - 0x210], eax
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x214]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [ebp - 0x210], 0
jbe 0x43b8f9
push dword [ebp - 0x210]
call fcn.0043bc6f
test eax, eax
jne 0x43b909
inc ebx
cmp ebx, edi
jge 0x43b911
mov eax, dword [ebp - 0x220]
jmp 0x43b873
mov eax, dword [ebp - 0x214]
mov dword [esi], eax
xor ebx, ebx
lea ecx, [ebp - 0x220]
cmp dword [esi], ebx
setne bl
call fcn.0041b815
pop edi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00522d04
leave
ret 8