joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4728a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov al, byte [esp + 0xc]
sub esp, 0x210
test al, al
jne 0x4728b6
mov byte [esp + 0x21c], 0x5f
push ebx
push ebp
push esi
mov esi, dword [esp + 0x220]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x118]
push esi
push eax
call edi
lea ecx, [esp + 0x118]
push 0x5c
push ecx
call fcn.004a7c73
add esp, 8
test eax, eax
jne 0x4728fe
lea edx, [esp + 0x118]
push 0x3a
push edx
call fcn.004a7c73
add esp, 8
test eax, eax
je 0x472909
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov ebx, eax
jmp 0x472910
lea ebx, [esp + 0x118]
lea eax, [esp + 0x10]
push ebx
push eax
call edi
push 0x2e
push esi
call fcn.004a7c73
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x47292e
mov ebp, 0x4f55a8
lea ecx, [esp + 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4729f3
lea edx, [esp + 0x10]
push 0x2e
push edx
call fcn.004a7c73
mov edi, eax
add esp, 8
test edi, edi
jne 0x472969
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [esp + eax + 0x10]
lea esi, [edi - 1]
lea ecx, [esp + 0x10]
cmp esi, ecx
jbe 0x47298d
movsx edx, byte [esi]
push edx
call fcn.004a9696
add esp, 4
test eax, eax
je 0x47298d
dec esi
lea eax, [esp + 0x10]
cmp esi, eax
ja 0x472974
mov cl, byte [esi]
mov dl, byte [esp + 0x22c]
cmp cl, dl
mov eax, 1
jne 0x4729ad
lea edx, [esi + 1]
push edx
call fcn.004a95fb
add esp, 4
jmp 0x4729af
mov esi, edi
inc eax
push ebp
push eax
movsx eax, byte [esp + 0x234]
push eax
push str._c_d_s
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea ecx, [esp + 0x10]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x472945
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [esp + 0x228]
lea eax, [esp + 0x118]
push eax
push ecx
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret

Function at 0x472f00
Capabilities:
Get geographical location

Disassembly:
sub esp, 0xc
lea eax, [esp]
push esi
push 0xa
push eax
push 0xe
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
movsx ecx, byte [esp + 4]
mov esi, dword [esp + 0x14]
push ecx
push esi
call fcn.004a8857
add esp, 8
test eax, eax
je 0x472f32
mov byte [eax], 0x2e
push esi
call fcn.004a963f
add esp, 4
pop esi
add esp, 0xc
ret
Function at 0x472f40
Capabilities:
Get graphical window text
Set registry value

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x118
test eax, eax
push ebx
mov ebx, dword [esp + 0x120]
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push esi
push edi
je 0x472fd0
push 0
push 0
push 0x147
push ebx
call ebp
test eax, eax
jle 0x472f7f
lea ecx, [esp + 0x24]
push ecx
push eax
push 0x148
push ebx
call ebp
jmp 0x472f90
lea edx, [esp + 0x24]
push 0x104
push edx
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov al, byte [esp + 0x24]
test al, al
je 0x472fd0
lea eax, [esp + 0x24]
push eax
push 0xffffffffffffffff
push 0x158
push ebx
call ebp
test eax, eax
jl 0x472fb6
push 0
push eax
push 0x144
push ebx
call ebp
lea ecx, [esp + 0x24]
push ecx
push 0
push 0x14a
push ebx
call ebp
push 0
push eax
push 0x14e
push ebx
call ebp
push 0
push 0
push 0x146
push ebx
call ebp
mov ecx, dword [esp + 0x134]
mov dword [esp + 0x10], eax
test ecx, ecx
je 0x472ff5
cmp eax, ecx
jle 0x472ff5
mov dword [esp + 0x10], ecx
mov eax, ecx
mov edi, 1
xor esi, esi
test eax, eax
mov dword [esp + 0x14], edi
jle 0x47303b
push 0
push esi
push 0x149
push ebx
call ebp
mov ecx, dword [esp + 0x138]
inc eax
test ecx, ecx
je 0x473022
lea edx, [eax + edi]
cmp edx, ecx
jg 0x473033
add edi, eax
mov eax, dword [esp + 0x10]
inc esi
cmp esi, eax
jl 0x473004
mov dword [esp + 0x14], edi
jmp 0x47303b
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], esi
push edi
call fcn.004bd49b
mov dword [esp + 0x20], eax
mov esi, eax
mov eax, dword [esp + 0x14]
add esp, 4
xor edi, edi
test eax, eax
jle 0x473072
push esi
push edi
push 0x148
push ebx
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esi + eax + 1]
mov eax, dword [esp + 0x10]
inc edi
cmp edi, eax
jl 0x473054
mov edx, dword [esp + 0x13c]
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push 0x20006
push 0
push 0x4f55a8
push 0
push edx
push DrawStatusTextA
mov byte [esi], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x4730b3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x118
ret
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x140]
mov edx, dword [esp + 0x18]
push eax
push edi
push 3
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.004bd4c4
add esp, 4
xor eax, eax
test esi, esi
pop edi
pop esi
pop ebp
pop ebx
sete al
add esp, 0x118
ret
Function at 0x473100
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 8
lea eax, [esp]
push eax
push 0x20019
push 0
push ecx
push DrawStatusTextA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x473129
xor eax, eax
add esp, 8
ret
mov ecx, dword [esp]
push ebx
mov ebx, dword [esp + 0x18]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x18]
push esi
push edx
lea eax, [esp + 0x14]
push 0
push eax
push 0
push ebx
push ecx
mov dword [esp + 0x34], 0
call ebp
mov esi, eax
test esi, esi
jne 0x4731ca
mov edx, dword [esp + 0x1c]
push edi
inc edx
push edx
call fcn.004bd49b
mov edx, dword [esp + 0x14]
add esp, 4
mov edi, eax
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x18]
push edi
push ecx
push esi
push ebx
push edx
call ebp
test eax, eax
mov dword [esp + 0x24], eax
jne 0x4731bc
mov eax, dword [esp + 0x20]
mov esi, edi
mov byte [edi + eax], 0
mov al, byte [edi]
test al, al
je 0x4731bc
mov ebx, dword [esp + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push esi
push 0
push 0x143
push ebx
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esi + eax + 1]
cmp byte [esi], 0
jne 0x4731a1
push edi
call fcn.004bd4c4
mov esi, dword [esp + 0x28]
add esp, 4
pop edi
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop esi
pop ebp
sete al
pop ebx
add esp, 8
ret
Function at 0x4735c0
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x1000
call fcn.004a9610
push esi
mov esi, dword [esp + 0x1008]
push edi
mov edi, dword [esp + 0x1010]
push esi
push edi
lea eax, [esp + 0x10]
push str._dbg_printf__s:_d__:
push eax
call fcn.004a8cca
mov edx, dword [esp + 0x1024]
lea ecx, [esp + 0x1028]
push ecx
lea eax, [esp + eax + 0x1c]
push edx
push eax
call fcn.004aa74f
add esp, 0x1c
test eax, eax
jge 0x473620
push edi
push esi
lea ecx, [esp + 0x10]
push str._dbg_printf__s:_d__:__vsprintf_error_
push ecx
call fcn.004a8cca
add esp, 0x10
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
add esp, 0x1000
ret

Function at 0x473640
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x1000
call fcn.004a9610
mov ecx, dword [esp + 0x1004]
lea eax, [esp + 0x1008]
push eax
lea edx, [esp + 4]
push ecx
push edx
call fcn.004aa74f
add esp, 0xc
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x1000
ret

Function at 0x4736b0
Capabilities:
Delete file
Get common file path

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x104
lea eax, [esp]
push eax
push 0
push 0x4eea8c
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x4736d8
add esp, 0x104
ret
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
add esp, 0x104
ret

Function at 0x473730
Capabilities:
Create process on windows

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f02
push 0
call edi
mov ebx, dword [sym.imp.USER32.dll_SetCursor]
push eax
call ebx
mov ecx, dword [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x18]
push 1
push 0
push 0
push eax
push 0
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor edx, edx
cmp eax, 0x1f
setg dl
test esi, esi
mov ebp, edx
je 0x473780
mov eax, esi
push eax
call ebx
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret
push 0x7f00
push 0
call edi
push eax
call ebx
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret

Function at 0x4737e0
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x419
push esi
call edi
lea ecx, [esp + 0x10]
push ecx
push eax
push 0x41d
push esi
call edi
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
add eax, edx
cdq
sub eax, edx
mov edx, dword [esp + 0x1c]
sar eax, 1
mov dword [esp + 8], eax
lea eax, [edx + ecx]
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0xc], eax
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.USER32.dll_ClientToScreen]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push ecx
push edx
call dword [sym.imp.USER32.dll_SetCursorPos]
pop edi
pop esi
add esp, 0x18
ret
Function at 0x473860
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x18
lea eax, [esp]
push esi
push edi
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov esi, dword [esp + 0x24]
lea ecx, [esp + 8]
push ecx
push esi
call dword [sym.imp.USER32.dll_ScreenToClient]
mov edx, dword [esp + 0x28]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push edx
push 0x419
push esi
call edi
lea ecx, [esp + 0x10]
push ecx
push eax
push 0x41d
push esi
call edi
pop edi
pop esi
test eax, eax
jne 0x4738ad
add esp, 0x18
ret
mov edx, dword [esp + 4]
mov eax, dword [esp]
push edx
lea ecx, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
add esp, 0x18
ret

Function at 0x473fa0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
mov eax, dword [esi + 0xc]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, dword [esi + 8]
push 1
push ecx
call dword [sym.imp.USER32.dll_EnableWindow]
mov edx, dword [esi + 0xc]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret

Function at 0x473fd0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
mov eax, dword [esi + 0xc]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, dword [esi + 0xc]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi + 8]
push 0
push edx
call dword [sym.imp.USER32.dll_EnableWindow]
pop esi
ret

Function at 0x4746d0
Capabilities:
Get common file path

Disassembly:
sub esp, 8
lea eax, [esp]
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
test eax, eax
jne 0x4747bd
mov eax, dword [esp + 4]
mov esi, dword [esp + 0x10]
lea edx, [esp + 0x10]
mov ecx, dword [eax]
push edx
push 0x4deb30
push 0
push esi
push eax
call dword [ecx + 0x14]
test eax, eax
jl 0x474719
mov eax, dword [esp + 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x10]
pop esi
add esp, 8
ret
push ebx
lea edx, [esp + 0xc]
push edi
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov ebx, dword [esp + 0x10]
test esi, esi
je 0x474789
test ebx, ebx
je 0x474789
mov ax, word [esi]
mov edx, esi
test ax, ax
mov ecx, 2
je 0x474756
and eax, 0xffff
add edx, eax
add ecx, eax
mov ax, word [edx]
test ax, ax
jne 0x474745
mov ax, word [ebx]
mov edx, ebx
test ax, ax
mov edi, 2
je 0x474776
and eax, 0xffff
add edx, eax
add edi, eax
mov ax, word [edx]
test ax, ax
jne 0x474765
cmp ecx, edi
jne 0x474789
mov edi, ebx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
mov edx, eax
sete dl
mov esi, edx
jmp 0x47478b
xor esi, esi
mov eax, dword [0x4f6114]
mov edi, ebx
test eax, eax
jne 0x4747a6
push 0x4f6114
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov eax, dword [0x4f6114]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x14]
mov eax, dword [esp + 0xc]
pop edi
test esi, esi
pop ebx
jne 0x4747bf
mov edx, dword [eax]
push eax
call dword [edx + 8]
xor eax, eax
pop esi
add esp, 8
ret
Function at 0x4747d0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x224
lea eax, [esp + 8]
push ebp
push esi
push edi
mov edi, dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
push eax
call edi
test eax, eax
jne 0x474962
mov edx, dword [esp + 0x234]
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x24]
push 0x104
push ecx
push 0xffffffffffffffff
push edx
push 1
push eax
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esi]
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x28]
lea ecx, [esp + 0x2c]
push edx
push ecx
push 0
push 0
push esi
call dword [eax + 0xc]
mov esi, dword [esp + 0x10]
xor edx, edx
test eax, eax
mov eax, dword [esp + 0x14]
setl dl
mov ecx, dword [eax]
dec edx
and edx, esi
push eax
mov ebp, edx
call dword [ecx + 8]
test ebp, ebp
je 0x474962
lea edx, [esp + 0xc]
push edx
call edi
test eax, eax
jne 0x474934
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push edx
push 0x4deb30
mov ecx, dword [eax]
push 0
push ebp
push eax
call dword [ecx + 0x14]
test eax, eax
jl 0x47488d
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov esi, dword [esp + 0x18]
jmp 0x474936
lea edx, [esp + 0x1c]
push ebx
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x4748fb
mov ax, word [ebp]
mov edx, ebp
test ax, ax
mov ecx, 2
je 0x4748c6
and eax, 0xffff
add edx, eax
add ecx, eax
mov ax, word [edx]
test ax, ax
jne 0x4748b5
mov ax, word [ebx]
mov edx, ebx
test ax, ax
mov esi, 2
je 0x4748e6
and eax, 0xffff
add edx, eax
add esi, eax
mov ax, word [edx]
test ax, ax
jne 0x4748d5
cmp ecx, esi
jne 0x4748fb
mov edi, ebx
mov esi, ebp
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
mov edx, eax
sete dl
mov esi, edx
jmp 0x4748fd
xor esi, esi
mov eax, dword [0x4f6114]
mov edi, ebx
test eax, eax
pop ebx
jne 0x474919
push 0x4f6114
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov eax, dword [0x4f6114]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x14]
test esi, esi
je 0x47492a
mov esi, dword [esp + 0xc]
jmp 0x474936
mov eax, dword [esp + 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
xor esi, esi
mov eax, dword [0x4f6114]
test eax, eax
jne 0x47494f
push 0x4f6114
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov eax, dword [0x4f6114]
mov ecx, dword [eax]
push ebp
push eax
call dword [ecx + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
add esp, 0x224
ret
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x224
ret
Function at 0x474970
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 0x210
lea eax, [esp]
push eax
push 0x4deb20
push 1
push 0
push 0x4deb50
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x474a21
mov eax, dword [esp]
mov edx, dword [esp + 0x214]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [esp + 0x21c]
test eax, eax
je 0x4749bf
mov ecx, dword [esp]
push eax
push ecx
mov edx, dword [ecx]
call dword [edx + 0x1c]
mov eax, dword [esp]
lea edx, [esp + 4]
push esi
push edx
mov ecx, dword [eax]
push 0x4deb80
push eax
call dword [ecx]
mov esi, eax
test esi, esi
jl 0x474a14
mov ecx, dword [esp + 0x21c]
lea eax, [esp + 0xc]
push 0x104
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
push 1
push ecx
mov edx, dword [eax]
push eax
call dword [edx + 0x18]
mov esi, eax
mov eax, dword [esp + 8]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, esi
pop esi
add esp, 0x210
ret
Function at 0x476270
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x20
fld dword [esp + 0x30]
fmul dword [0x4daa48]
mov ax, word [0x4edf14]
xor ecx, ecx
push ebx
push ebp
mov dword [esp + 0xa], ecx
push esi
push edi
mov word [esp + 0x10], ax
mov dword [esp + 0x16], ecx
call fcn.004a7d38
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x34]
and edx, 0xffff
mov esi, eax
push edx
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
fld dword [esp + 0x44]
fmul dword [0x4daa44]
mov edi, eax
call fcn.004a7d38
fld dword [esp + 0x48]
fmul dword [0x4daa44]
mov bp, ax
and ebp, 0xffff
shl ebp, 0x10
call fcn.004a7d38
and eax, 0xffff
or ebp, eax
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0x465
push edi
call ebp
mov eax, 0x66666667
imul esi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
and edx, 0xffff
push edx
push 0
push 0x467
push edi
call ebp
lea ecx, [esp + 0x10]
push 0xa
push ecx
push 0xe
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov eax, esi
mov ecx, 0x64
cdq
idiv ecx
mov eax, 0x51eb851f
lea ecx, [esp + 0x1c]
push edx
lea edx, [esp + 0x14]
push edx
imul esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
push edx
push str._0d_s_02d
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [esp + 0x50]
add esp, 0x14
lea edx, [esp + 0x1c]
and eax, 0xffff
push edx
push eax
push ebx
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x477220
Capabilities:
Create thread
Resume thread

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
xor ebp, ebp
push edi
cmp dword [esi + 0x84], ebp
jne 0x47723d
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret
mov eax, dword [esi + 0x74]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, ebp
je 0x477298
push 0xbb8
push eax
mov dword [esi + 0x78], 1
call edi
cmp eax, 0x102
jne 0x477278
push 0x20
call dword [sym.imp.USER32.dll_MessageBeep]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret
mov eax, dword [esi + 0x74]
push eax
call ebx
mov ecx, dword [esi + 0x60]
push ebp
push 0x244
push ecx
mov dword [esi + 0x74], ebp
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x7c]
cmp eax, ebp
je 0x4772d3
push 0xbb8
push eax
mov dword [esi + 0x80], 1
call edi
cmp eax, 0x102
jne 0x4772ca
push 0x40
call dword [sym.imp.USER32.dll_MessageBeep]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret
mov edx, dword [esi + 0x7c]
push edx
call ebx
mov dword [esi + 0x7c], ebp
cmp dword [esi + 0x74], ebp
je 0x4772e2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20
ret
mov eax, dword [esi + 0x60]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
push ebp
mov ecx, esi
mov dword [esi + 0x78], ebp
call fcn.00478270
cmp dword [esi + 0xf8], ebp
je 0x47733b
mov eax, dword [esi + 0xf0]
xor edi, edi
cmp eax, ebp
jle 0x47733b
cmp edi, eax
jge 0x477330
cmp edi, ebp
jl 0x477330
mov ecx, dword [esi + 0xec]
mov ebx, dword [ecx + edi*4]
cmp ebx, ebp
je 0x477330
mov ecx, ebx
call fcn.0047b360
push ebx
call fcn.004bd4c4
add esp, 4
mov eax, dword [esi + 0xf0]
inc edi
cmp edi, eax
jl 0x47730f
mov edx, dword [esi + 0xec]
push edx
call fcn.004bd4c4
push 0x80
call fcn.004bd49b
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
add esp, 8
mov dword [esi + 0xec], eax
mov dword [esi + 0xf0], ebp
mov dword [esi + 0xf4], 0x1f
mov dword [esi + 0xfc], 0x40
mov eax, dword [esi + 0x60]
push 1
push 0x403
push 0x403
lea ecx, [esp + 0x20]
push eax
push ecx
call edi
test eax, eax
je 0x4773b0
mov edx, dword [esi + 0x60]
push 1
push 0x403
push 0x403
lea eax, [esp + 0x20]
push edx
push eax
call edi
test eax, eax
jne 0x477395
lea ecx, [esp + 0x10]
push ecx
push 4
push esi
push 0x475c10
push ebp
push ebp
call fcn.004a899b
add esp, 0x18
mov dword [esi + 0x74], eax
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [esi + 0x74]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esi + 0x60]
push 5
push 0x244
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20
ret
Function at 0x479b90
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
cmp word [esp + 0x14], 0x220
push esi
mov esi, ecx
jne 0x479d6b
mov ecx, dword [esi + 0x60]
mov eax, dword [esi + 0x84]
push ebx
push ebp
push edi
push 0
push 0
push 0x147
push 0x220
push ecx
mov dword [esp + 0x30], eax
mov dword [esi + 0x84], 0
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
xor ebx, ebx
cmp eax, 2
mov edx, dword [esi + 0x60]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
setl bl
dec ebx
mov dword [esp + 0x24], eax
and ebx, 5
push ebx
push 0x221
push edx
call edi
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebp
mov eax, dword [esi + 0x60]
push ebx
push 0x222
push eax
call edi
push eax
call ebp
mov ecx, dword [esi + 0x60]
push ebx
push 0x21b
push ecx
call edi
push eax
call ebp
mov edx, dword [esi + 0x60]
push ebx
push 0x224
push edx
call edi
push eax
call ebp
mov eax, dword [esi + 0x60]
push ebx
push 0x22f
push eax
call edi
push eax
call ebp
mov ecx, dword [esi + 0x60]
push ebx
push 0x230
push ecx
call edi
push eax
call ebp
mov edx, dword [esi + 0x60]
push ebx
push 0x22d
push edx
call edi
push eax
call ebp
mov eax, dword [esi + 0x60]
push ebx
push 0x22e
push eax
call edi
push eax
call ebp
mov ebx, dword [esp + 0x24]
mov ecx, ebx
neg ecx
sbb ecx, ecx
mov edx, dword [esi + 0x60]
and ecx, 5
push ecx
push 0x223
push edx
call edi
push eax
call ebp
mov ecx, dword [esi + 0x60]
xor eax, eax
cmp ebx, 3
setne al
mov ebp, eax
push ebp
push 0x205
push ecx
call edi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov edx, dword [esi + 0x60]
push ebp
push 0x203
push edx
call edi
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
cmp ebx, 3
je 0x479cc0
cmp ebx, 2
jne 0x479d50
fild dword [esi + 0xcc]
cmp ebx, 3
fidiv dword [esi + 0xd4]
fstp dword [esp + 0x14]
fild dword [esi + 0xd0]
fidiv dword [esi + 0xd8]
fstp dword [esp + 0x18]
jne 0x479cfb
mov eax, dword [esi + 0xc0]
mov edx, dword [esi + 0xc4]
mov dword [esp + 0x24], eax
mov dword [esp + 0x10], edx
jmp 0x479d0f
mov ecx, dword [esi + 0xb8]
mov eax, dword [esi + 0xbc]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x24]
mov eax, dword [esi + 0x60]
push ecx
push 0
push edx
push 0x221
push 0x21b
push eax
call fcn.00476270
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x28]
mov eax, dword [esi + 0x60]
push ecx
push 0
push edx
push 0x222
push 0x224
push eax
call fcn.00476270
add esp, 0x30
mov eax, dword [esi + 0x64]
mov ecx, dword [esp + 0x1c]
pop edi
pop ebp
test eax, eax
mov dword [esi + 0x84], ecx
pop ebx
je 0x479d6b
mov ecx, esi
call fcn.00477220
pop esi
add esp, 0x10
ret 4
Function at 0x47b600
Capabilities:
Print debug messages

Disassembly:
push ebx
mov ebx, ecx
push ebp
mov ebp, dword [esp + 0xc]
xor ecx, ecx
push esi
mov word [ebx], cx
mov word [ebx + 2], cx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
mov ax, word [ebp + 2]
cmp ax, cx
jbe 0x47b68c
cmp ax, 0xc
ja 0x47b68c
mov ax, word [ebp]
xor edx, edx
mov word [ebx], ax
mov cx, word [ebp + 2]
mov word [ebx + 2], cx
mov eax, dword [ebp + 4]
mov dx, cx
mov dword [ebx + 4], eax
mov esi, dword [edx*4 + 0x4daa6c]
imul esi, eax
cmp esi, 4
ja 0x47b661
mov eax, dword [ebp + 8]
pop esi
mov dword [ebx + 8], eax
mov eax, ebx
pop ebp
pop ebx
ret 4
push edi
push esi
call fcn.004bd49b
mov ecx, esi
mov dword [ebx + 8], eax
mov esi, dword [ebp + 8]
mov edx, ecx
mov edi, eax
add esp, 4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
ret 4
push str.Invalid_meta_data_item_typeID_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop esi
mov eax, ebx
pop ebp
pop ebx
ret 4