joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428194
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x4f51d0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [esi + 0x28], 0
mov eax, dword [ebp + 8]
push edi
je 0x428208
cmp eax, 0x30
jb 0x4281b8
cmp eax, 0x39
jbe 0x4281c7
cmp eax, 0x2e
je 0x4281c7
cmp eax, 8
je 0x4281c7
cmp eax, 0xd
jne 0x42821c
xor edi, edi
inc edi
cmp eax, 0x2e
jne 0x428223
xor eax, eax
push 0x62
push eax
mov word [ebp - 0x68], ax
lea eax, [ebp - 0x66]
push eax
call fcn.00492200
add esp, 0xc
push 0x31
lea eax, [ebp - 0x68]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x4daccc
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
je 0x428223
jmp 0x42821c
cmp eax, 0x30
jb 0x428212
cmp eax, 0x39
jbe 0x428220
cmp eax, 8
je 0x428220
cmp eax, 0xd
je 0x428220
xor edi, edi
jmp 0x428223
xor edi, edi
inc edi
mov ecx, dword [ebp - 4]
xor eax, eax
test edi, edi
sete al
xor ecx, ebp
pop edi
mov dword [ebx], eax
xor eax, eax
call fcn.0048c64c
leave
ret 4

Function at 0x4292e7
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov esi, ecx
push 4
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindow]
push 1
push dword [esi + 4]
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push 0
push dword [ebp - 4]
call ebx
and dword [ebp - 0x20], 0
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.USER32.dll_IsWindow]
jmp 0x429389
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x429392
cmp dword [ebp - 0x1c], 0x10
jne 0x429360
push 1
push dword [ebp - 4]
call ebx
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SetFocus]
lea ecx, [esi + 0x24]
mov eax, dword [ecx]
lea edx, [ebp - 0x20]
push edx
call dword [eax]
test eax, eax
jne 0x429383
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp - 0x1c], 0x12
je 0x429392
push dword [esi + 4]
call edi
test eax, eax
jne 0x429337
push 1
push dword [ebp - 4]
call ebx
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SetFocus]
cmp dword [ebp - 0x1c], 0x12
jne 0x4293b1
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [esi + 0x32c]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42f8e5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c4d6f
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push esi
push edi
mov eax, dword [0x4f51d0]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
push dword [ebp + 0xc]
lea esi, [esp + 0x30]
call fcn.00404bbf
and dword [esp + 0x70], 0
mov eax, esi
push eax
lea ebx, [esp + 0x20]
call fcn.004488be
or dword [esp + 0x70], 0xffffffff
push 0
push 1
mov ecx, esi
call fcn.00405380
mov eax, dword [0x5146a0]
mov dword [esp + 0x28], eax
mov eax, dword [0x514688]
lea edi, [esp + 0x24]
mov esi, ebx
mov dword [esp + 0x24], eax
call fcn.0044c231
test al, al
jne 0x42f96c
call fcn.0044ebd3
mov eax, dword [eax + 0x1c]
jmp 0x42fab0
movzx eax, word [ebp + 0x10]
push eax
push dword [ebp + 0xc]
xor edi, edi
push dword [ebp + 8]
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
mov dword [esp + 0x1c], esi
cmp esi, edi
je 0x42f9f5
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [esp + 0x14], eax
cmp eax, edi
je 0x42f9f5
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
cmp esi, edi
ja 0x42f9b4
xor eax, eax
jmp 0x42fab0
push esi
push 0x22
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [esp + 0x14]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp ebx, edi
je 0x42f9e7
cmp eax, edi
je 0x42f9e7
push esi
push eax
push ebx
call fcn.00492530
add esp, 0xc
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ebx, dword [esp + 0x24]
xor esi, esi
cmp ebx, edi
je 0x42f9ad
lea eax, [esp + 0x14]
push eax
push 1
push ebx
mov dword [esp + 0x20], edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
cmp eax, edi
jne 0x42fa34
cmp dword [esp + 0x14], edi
je 0x42fa34
push 0x10
call sub.gdiplus.dll_GdipAlloc
cmp eax, edi
je 0x42fa30
push edi
push dword [esp + 0x18]
mov ecx, eax
call fcn.00453fe9
jmp 0x42fa32
xor eax, eax
mov esi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x42fa50
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp esi, edi
je 0x42f9ad
mov dword [esp + 0x18], edi
mov eax, dword [esi + 8]
mov dword [esi + 8], edi
cmp eax, edi
jne 0x42fa7b
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x28]
push eax
mov ecx, esi
mov dword [esp + 0x2c], edi
call fcn.00453f90
mov eax, dword [esi]
xor ebx, ebx
inc ebx
push ebx
mov ecx, esi
call dword [eax]
push dword [ebp + 0xc]
lea esi, [esp + 0x4c]
call fcn.00404bbf
mov eax, esi
push eax
mov dword [esp + 0x74], ebx
call fcn.004487ae
mov ecx, dword [esp + 0x18]
push edi
mov dword [eax], ecx
push ebx
mov ecx, esi
call fcn.00405380
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x42fac5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, word [ebp + 0x10]
push ebx
push esi
push edi
push eax
push dword [ebp + 0xc]
xor ebx, ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
mov dword [ebp + 0xc], esi
cmp esi, ebx
je 0x42fb45
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
cmp edi, ebx
je 0x42fb45
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
push esi
push 0x22
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test ebx, ebx
je 0x42fb3a
test eax, eax
je 0x42fb3a
test esi, esi
jbe 0x42fb3a
push esi
push eax
push ebx
call fcn.00492530
add esp, 0xc
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor ebx, ebx
mov edi, dword [ebp - 4]
xor esi, esi
cmp edi, ebx
je 0x42fba2
lea eax, [ebp + 8]
push eax
push 1
push edi
mov dword [ebp + 8], ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x42fb83
cmp dword [ebp + 8], ebx
je 0x42fb83
push 0x10
call sub.gdiplus.dll_GdipAlloc
cmp eax, ebx
je 0x42fb7f
push ebx
push dword [ebp + 8]
mov ecx, eax
call fcn.00453fe9
jmp 0x42fb81
xor eax, eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x42fb9e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp esi, ebx
jne 0x42fba6
xor eax, eax
jmp 0x42fbd0
mov dword [ebp + 0x10], ebx
mov eax, dword [esi + 8]
mov dword [esi + 8], ebx
cmp eax, ebx
jne 0x42fbc5
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp + 0xc]
push eax
mov ecx, esi
mov dword [ebp + 0xc], ebx
call fcn.00453f90
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x42fc29
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c4d44
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebx
push esi
push edi
mov eax, dword [0x4f51d0]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
push dword [ebp + 0xc]
lea esi, [esp + 0x28]
call fcn.00404bbf
and dword [esp + 0x68], 0
mov eax, esi
push eax
lea ebx, [esp + 0x14]
call fcn.004488be
or dword [esp + 0x68], 0xffffffff
push 0
push 1
mov ecx, esi
call fcn.00405380
mov eax, dword [0x5146a0]
mov dword [esp + 0x20], eax
mov eax, dword [0x514688]
lea edi, [esp + 0x1c]
mov esi, ebx
mov dword [esp + 0x1c], eax
call fcn.0044c231
test al, al
jne 0x42fcb0
call fcn.0044ebd3
mov eax, dword [eax + 0x1c]
jmp 0x42fdea
push dword [ebp + 0x10]
and dword [esp + 0x20], 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x42fd29
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x42fd29
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
push esi
push 0x22
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp dword [esp + 0x10], 0
je 0x42fd22
test eax, eax
je 0x42fd22
test esi, esi
jbe 0x42fd22
push esi
push eax
push dword [esp + 0x18]
call fcn.00492530
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ebx, dword [esp + 0x1c]
xor edi, edi
xor esi, esi
cmp ebx, edi
je 0x42fd8e
lea eax, [esp + 0x10]
push eax
push 1
push ebx
mov dword [esp + 0x1c], edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
cmp eax, edi
jne 0x42fd6e
cmp dword [esp + 0x10], edi
je 0x42fd6e
push 0x10
call sub.gdiplus.dll_GdipAlloc
cmp eax, edi
je 0x42fd6a
push edi
push dword [esp + 0x14]
mov ecx, eax
call fcn.00453fe9
jmp 0x42fd6c
xor eax, eax
mov esi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x42fd8a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp esi, edi
jne 0x42fd92
xor eax, eax
jmp 0x42fdea
mov dword [esp + 0x18], edi
mov eax, dword [esi + 8]
mov dword [esi + 8], edi
cmp eax, edi
jne 0x42fdb5
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x20]
push eax
mov ecx, esi
mov dword [esp + 0x24], edi
call fcn.00453f90
mov eax, dword [esi]
xor ebx, ebx
inc ebx
push ebx
mov ecx, esi
call dword [eax]
push dword [ebp + 0xc]
lea esi, [esp + 0x44]
call fcn.00404bbf
mov eax, esi
push eax
mov dword [esp + 0x6c], ebx
call fcn.004487ae
mov ecx, dword [esp + 0x18]
push edi
mov dword [eax], ecx
push ebx
mov ecx, esi
call fcn.00405380
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x43691b
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x240], 3
je 0x43699c
mov eax, dword [esi]
call dword [eax + 0x58]
test eax, eax
je 0x43699c
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call edi
xor ecx, ecx
test ax, ax
setl cl
push 0x10
mov dword [esi + 0x220], ecx
call edi
xor ecx, ecx
test ax, ax
setl cl
push 0x12
mov dword [esi + 0x224], ecx
call edi
xor ecx, ecx
test ax, ax
mov eax, dword [esp + 0xc]
setl cl
pop edi
mov dword [esi + 0x228], ecx
cmp eax, 0x11
je 0x436989
cmp eax, 0x10
je 0x436989
cmp eax, 0x12
je 0x436989
mov dword [esi + 0x22c], eax
jmp 0x436990
and dword [esi + 0x22c], 0
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0xa0]
pop esi
ret 4
Function at 0x43c5c9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c6dbf
mov eax, dword fs:[0]
push eax
sub esp, 0x68
push ebx
push esi
push edi
mov eax, dword [0x4f51d0]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
push str.panel
push edi
call fcn.0042d4a5
lea eax, [edi + 4]
call fcn.0045593a
mov edi, eax
mov dword [esp + 0x10], edi
call fcn.0040c77a
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push dword [esi + 0x258]
call fcn.00430d47
and dword [esp + 0x9c], 0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x54], esp
push str.background
call fcn.00404b88
or dword [esp + 0xb8], 0xffffffff
mov ecx, edi
call fcn.00446cb6
sub esp, 0x1c
mov eax, esp
mov dword [esp + 0x38], esp
push dword [esi + 0x25c]
push eax
call fcn.00432250
sub esp, 0x1c
mov dword [esp + 0xb8], 1
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.backcolor
call fcn.00404b88
or dword [esp + 0xb8], 0xffffffff
mov ecx, edi
call fcn.00446cb6
sub esp, 0x1c
mov eax, esp
mov dword [esp + 0x38], esp
push dword [esi + 0x260]
push eax
call fcn.00432250
sub esp, 0x1c
mov dword [esp + 0xb8], 2
mov ecx, esp
mov dword [esp + 0x4c], esp
push str.bordercolor
call fcn.00404b88
or dword [esp + 0xb8], 0xffffffff
mov ecx, edi
call fcn.00446cb6
push dword [esi + 0x264]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.border
call fcn.00404b88
push edi
call fcn.00446d2d
lea ebx, [esi + 0x220]
test ebx, ebx
je 0x43c796
mov eax, dword [ebx + 0x14]
mov eax, dword [eax]
mov dword [esp + 0x20], eax
mov eax, dword [ebx]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x14]
mov dword [esp + 0x18], eax
mov eax, dword [ebx]
lea edi, [esp + 0x14]
lea esi, [esp + 0x1c]
mov dword [esp + 0x14], eax
call fcn.0044abdb
test al, al
jne 0x43c796
call fcn.0044ab9a
mov edi, dword [eax]
lea esi, [esp + 0x24]
call fcn.00446437
push 0
mov ecx, esi
mov dword [esp + 0x84], 3
mov eax, dword [edi]
push ecx
mov ecx, edi
call dword [eax + 0x124]
lea eax, [esp + 0x28]
call fcn.0045593a
push dword [esp + 0x10]
mov ecx, eax
call fcn.004555f8
lea esi, [esp + 0x1c]
call fcn.0044d1a2
or dword [esp + 0x80], 0xffffffff
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], vtable.CXmlHelper.0
call fcn.00427541
jmp 0x43c716
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x446692
Capabilities:
Delete file
Extract resource via kernel32 functions
Get common file path
Set file attributes
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a4]
sub esp, 0x424
mov eax, dword [0x4f51d0]
xor eax, ebp
mov dword [ebp + 0x3a0], eax
mov eax, dword [ebp + 0x3ac]
push ebx
push esi
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0x3b0]
push ecx
push eax
mov dword [ebp - 0x78], ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
xor esi, esi
cmp ebx, esi
je 0x4467ba
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x74], eax
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x70], ax
lea eax, [ebp - 0x6e]
push esi
push eax
call fcn.00492200
xor eax, eax
push edi
mov word [ebp + 0x198], ax
lea eax, [ebp + 0x19a]
push esi
push eax
call fcn.00492200
add esp, 0x18
lea eax, [ebp - 0x70]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp + 0x198]
push eax
push esi
push 0x4dce14
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push esi
push esi
push 2
push esi
push esi
push 0x40000000
lea eax, [ebp + 0x198]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x80], esi
cmp edi, 0xffffffff
je 0x44677e
push esi
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 0x78]
push dword [0x512ed4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push dword [ebp - 0x74]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
lea eax, [ebp + 0x198]
push eax
push dword [ebp - 0x7c]
call fcn.0044662d
mov esi, eax
push 0x80
lea eax, [ebp + 0x198]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp + 0x198]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, esi
pop edi
jmp 0x4467bc
xor eax, eax
mov ecx, dword [ebp + 0x3a0]
pop esi
xor ecx, ebp
pop ebx
call fcn.0048c64c
add ebp, 0x3a4
leave
ret 8
Function at 0x454bf6
Capabilities:
Get graphical window text

Disassembly:
push ebp
sub esp, 0x84
lea ebp, [esp - 4]
mov eax, dword [0x4f51d0]
xor eax, ebp
mov dword [ebp + 0x84], eax
push 0x14
mov eax, 0x4c359b
call fcn.00492e1e
mov esi, ecx
mov edi, edx
xor ebx, ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
push dword [edi]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], ebx
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
and dword [ebp], 0
mov ebx, eax
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 4], 1
test ebx, ebx
jle 0x454cae
lea eax, [ebx + 1]
push 2
push eax
mov byte [ebp - 4], 2
call fcn.0040f9ee
pop ecx
pop ecx
push eax
lea esi, [ebp]
call fcn.00454bbc
jmp 0x454c77
cmp dword [ebp], 0
jne 0x454c90
lea eax, [ebp + 4]
test eax, eax
je 0x454c8c
lea eax, [ebp]
call fcn.00454b85
xor eax, eax
jmp 0x454cdd
lea eax, [ebx + 1]
push eax
push dword [ebp]
mov eax, dword [ebp - 0x14]
push dword [eax]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x454cae
lea eax, [ebp + 4]
cmp dword [ebp], eax
jmp 0x454c82
push dword [ebp]
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test ebx, ebx
jne 0x454cc2
xor esi, esi
inc esi
jmp 0x454ccb
xor ecx, ecx
test eax, eax
setne cl
mov esi, ecx
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x454cdb
lea eax, [ebp]
call fcn.00454b85
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x84]
xor ecx, ebp
call fcn.0048c64c
add ebp, 0x88
leave
ret

Function at 0x456183
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push edi
mov edi, eax
cmp dword [ebp + 8], ebx
jne 0x4561a5
push ebx
push ebx
push 2
xor ecx, ecx
pop eax
call fcn.0045785c
xor al, al
jmp 0x456261
push esi
call fcn.00455587
or dword [edi + 8], 0xffffffff
or dword [edi + 4], 0xffffffff
push 2
push ebx
push dword [ebp + 8]
call fcn.0048d676
push dword [ebp + 8]
call fcn.0048d898
push ebx
push ebx
push dword [ebp + 8]
mov esi, eax
mov dword [ebp - 4], esi
call fcn.0048d676
add esp, 0x1c
cmp esi, ebx
jg 0x4561e2
push ebx
push ebx
push 0xc
jmp 0x45620e
inc esi
push esi
call fcn.0048ccce
push dword [ebp + 8]
mov esi, eax
push 1
push dword [ebp - 4]
mov byte [esi], bl
push esi
call fcn.0048dd56
add esp, 0x14
cmp eax, 1
je 0x45621a
push esi
call fcn.0048c641
pop ecx
push ebx
push ebx
push 2
xor ecx, ecx
pop eax
call fcn.0045785c
xor al, al
jmp 0x456260
mov edx, dword [ebp - 4]
mov byte [esi + edx], bl
mov ecx, esi
mov eax, esi
cmp byte [esi], bl
je 0x456243
mov dl, byte [ecx]
cmp dl, 0xd
jne 0x45623b
mov byte [eax], 0xa
inc eax
inc ecx
cmp byte [ecx], 0xa
jne 0x45623f
jmp 0x45623e
mov byte [eax], dl
inc eax
inc ecx
cmp byte [ecx], bl
jne 0x456228
push dword [ebp + 0xc]
mov byte [eax], bl
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 8]
push esi
call fcn.0048c641
xor eax, eax
cmp byte [edi + 0x2c], bl
pop ecx
sete al
pop esi
pop edi
pop ebx
leave
ret 8
Function at 0x458b02
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x458ba5
push 0x4e07e4
push str.APPHTML
push dword [0x512ed4]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 4], eax
cmp eax, esi
je 0x458ba5
push eax
push dword [0x512ed4]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
cmp eax, esi
je 0x458ba5
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
cmp ebx, esi
je 0x458b9b
push edi
push esi
push esi
push 2
push esi
push esi
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x458b9a
push esi
lea eax, [ebp + 8]
push eax
push dword [ebp - 4]
push dword [0x512ed4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
neg esi
sbb esi, esi
push edi
neg esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop ebx
mov eax, esi
pop esi
leave
ret
Function at 0x458df9
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x48
mov eax, 0x4c7a7e
call fcn.00492deb
xor edi, edi
push edi
push 0x80
push 3
push edi
push edi
push SysReAllocString
push dword [ebp + 0xc]
mov dword [ebp - 0x1c], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10], eax
cmp eax, edi
je 0x458f40
cmp eax, 0xffffffff
je 0x458f40
mov ecx, 0x50f384
lea esi, [ebp - 0x14]
call fcn.004080cd
push str.360GameCenter_zhaoxiaoyong
mov eax, esi
push eax
mov dword [ebp - 4], edi
call fcn.004085de
mov esi, dword [ebp - 0x14]
mov eax, dword [esi - 0xc]
push edi
push dword [ebp - 0x10]
lea ebx, [eax + eax]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x458e90
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4d84dc
push dword [ebp + 8]
call fcn.00408620
lea eax, [esi - 0x10]
call fcn.00408396
jmp 0x458f4d
lea eax, [edi + ebx]
push eax
mov dword [ebp - 0x18], eax
call fcn.0048bc2e
push dword [ebp - 0x18]
mov esi, eax
push 0
push esi
call fcn.00492200
and dword [ebp - 0x1c], 0
add esp, 0x10
push 0
lea eax, [ebp - 0x1c]
push eax
push edi
push esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push dword [ebp - 0x14]
add edi, esi
push edi
call fcn.00492530
push dword [ebp - 0x18]
mov ebx, esi
lea edi, [ebp - 0x54]
call fcn.0045e89a
add esp, 0x10
mov byte [ebp - 4], 1
cmp dword [eax + 0x18], 0x10
jb 0x458ef5
mov eax, dword [eax + 4]
jmp 0x458ef8
add eax, 4
mov edx, eax
lea ecx, [ebp - 0x38]
call fcn.004624fc
mov byte [ebp - 4], 2
cmp dword [eax + 0x18], 8
jb 0x458f11
mov eax, dword [eax + 4]
jmp 0x458f14
add eax, 4
push eax
push dword [ebp + 8]
call fcn.00408620
push 0
push 1
lea ecx, [ebp - 0x38]
call fcn.00405380
push 0
push 1
lea ecx, [ebp - 0x54]
call fcn.00408b2a
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
jmp 0x458e86
push 0x4d84dc
push dword [ebp + 8]
call fcn.00408620
mov eax, dword [ebp + 8]
call fcn.00492ec3
ret
Function at 0x459229
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x3cc]
sub esp, 0x44c
mov eax, dword [0x4f51d0]
xor eax, ebp
mov dword [ebp + 0x3c8], eax
mov eax, dword [ebp + 0x3d4]
push ebx
push edi
push 2
xor ebx, ebx
push ebx
push eax
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x78], 1
call fcn.0041bb4d
mov edi, eax
add esp, 0xc
cmp edi, ebx
jne 0x459271
xor eax, eax
jmp 0x459353
push 0x22c
lea eax, [ebp - 0x6c]
push ebx
push eax
mov dword [ebp - 0x70], ebx
call fcn.00492200
push 0xffffffffffffffff
push edi
lea ecx, [ebp - 0x70]
call fcn.0041bbde
add esp, 0x14
test eax, eax
jne 0x45934b
mov eax, dword [ebp - 0x70]
cmp eax, ebx
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x74], ebx
jle 0x45934b
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp - 0x74]
lea ecx, [ebp - 0x70]
push edi
call fcn.0041bbde
xor eax, eax
push 0x206
mov word [ebp + 0x1c0], ax
lea eax, [ebp + 0x1c2]
push ebx
push eax
call fcn.00492200
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x7c]
lea eax, [ebp + 0x1c0]
push 0x4d8598
push 0xffffffffffffffff
push 0x104
push eax
call fcn.004900ff
add esp, 0x2c
push 0x80
lea eax, [ebp + 0x1c0]
push eax
call esi
lea eax, [ebp + 0x1c0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x20
lea eax, [ebp - 0x6c]
push eax
call esi
push 2
push ebx
lea eax, [ebp + 0x1c0]
push eax
push dword [ebp - 0x74]
mov eax, edi
call fcn.0041bdce
add esp, 0x10
test eax, eax
je 0x45933b
mov dword [ebp - 0x78], ebx
inc dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x80]
jl 0x4592b1
pop esi
call fcn.0041be07
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp + 0x3c8]
pop edi
xor ecx, ebp
pop ebx
call fcn.0048c64c
add ebp, 0x3cc
leave
ret