joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46a6b0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5301d9
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x559024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [ebp + 0x10]
push ebx
push ebx
push eax
mov dword [ebp - 4], ebx
push 0x400
mov dword [ebp - 0x10], 1
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov esi, eax
cmp esi, ebx
jg 0x46a712
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
inc esi
cmp esi, ebx
jle 0x46a77a
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005134b2
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x46a77a
mov ecx, esi
test esi, esi
je 0x46a747
mov edi, edi
mov byte [eax], 0
inc eax
dec ecx
jne 0x46a740
mov eax, dword [ebp + 0x10]
push esi
push ebx
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jle 0x46a766
push ebx
mov eax, edi
call fcn.004fcf00
jmp 0x46a771
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
push ebx
call fcn.005134a7
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x46dc80
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x559024]
xor eax, ebp
mov dword [ebp - 4], eax
xor al, al
cmp ecx, 0x200
je 0x46dca2
cmp ecx, 0x300
jne 0x46dce2
xor eax, eax
mov word [ebp - 0x38], ax
mov eax, dword [edi + 0x38]
push esi
test eax, eax
je 0x46dcd3
push 0x19
lea ecx, [ebp - 0x38]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jg 0x46dcd3
mov edx, dword [edi + 0x34]
push ebx
mov ebx, dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + edi + 0x34], eax
pop ebx
lea eax, [ebp - 0x38]
push eax
lea eax, [edi + 0x48]
call fcn.004fcf00
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00513498
mov esp, ebp
pop ebp
ret
Function at 0x470440
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [0x559024]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [esi + 0x4c8], 0
je 0x4704f3
cmp dword [esi + 0x208], 0x9d8
jne 0x4704f3
mov eax, dword [esi + 0x2ac]
mov dword [eax + 0x418], 2
mov eax, dword [esi + 0x22c]
xor ecx, ecx
push edi
mov word [ebp - 0x828], cx
test eax, eax
je 0x4704c3
push 0x410
lea edx, [ebp - 0x828]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jg 0x4704c3
mov eax, dword [esi + 0x228]
push ebx
mov ebx, dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + esi + 0x228], eax
pop ebx
mov edx, dword [esi + 0x2ac]
lea ecx, [ebp - 0x828]
push ecx
add edx, 0x41c
push 0x411
push edx
call fcn.00513c73
add esp, 0xc
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00513498
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.00470830
mov eax, dword [esi + 0x2ac]
mov ecx, dword [esi + 0x4c4]
mov dword [eax + 0x410], ecx
mov eax, dword [esi + 0x4b8]
test eax, eax
jne 0x47051b
mov eax, 0x538640
mov edx, dword [esi + 0x2ac]
push eax
add edx, 0x208
push 0x104
push edx
call fcn.00513c73
mov ecx, dword [ebp - 4]
mov eax, dword [esi + 0x2ac]
xor ecx, ebp
add esp, 0xc
mov dword [eax + 0x418], 1
call fcn.00513498
mov esp, ebp
pop ebp
ret

Function at 0x470790
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea esi, [ebx + 0x2b0]
push edi
lea edi, [ebx + 0x34]
test esi, esi
je 0x4707d4
xor eax, eax
mov word [esi], ax
mov eax, dword [edi + 4]
test eax, eax
je 0x4707e0
push 0x65
push esi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jg 0x4707e0
mov ecx, dword [edi]
mov eax, dword [ecx + 4]
add eax, edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp - 4]
mov dword [edx], eax
jmp 0x4707e0
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov dword [edi + ecx], 0x57
mov ecx, dword [ebx + 0x2ac]
pop edi
mov eax, esi
pop esi
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x470816
test dx, dx
je 0x470812
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x470816
add eax, 4
add ecx, 4
test dx, dx
jne 0x4707f0
xor eax, eax
jmp 0x47081b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x470825
mov al, 1
mov esp, ebp
pop ebp
ret
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x470830
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x529916
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x559024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov esi, ecx
mov word [ebp - 0x218], ax
mov eax, dword [esi + 0x134]
xor ebx, ebx
mov dword [ebp - 0x23c], esi
mov byte [ebp - 0x219], 0
cmp eax, ebx
je 0x4708b1
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, ebx
jg 0x4708b1
mov edx, dword [esi + 0x130]
mov ebx, dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + esi + 0x130], eax
xor ebx, ebx
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x220], ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
cmp edi, ebx
jle 0x47092d
mov dword [ebp - 0x248], ebx
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x240], ebx
mov ecx, edi
lea ebx, [ebp - 0x248]
call fcn.004fca40
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
xor ebx, ebx
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x224], edx
mov dword [ebp - 0x220], eax
cmp ecx, ebx
je 0x47092d
lea edx, [edi + 1]
push edx
lea eax, [ebp - 0x218]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov dword [ebp - 0x224], edi
lea edi, [ebp - 0x228]
mov dword [ebp - 4], ebx
call fcn.004fc3e0
mov ebx, edi
call fcn.004fc450
cmp dword [ebp - 0x224], 0
jle 0x470a02
mov ecx, dword [ebp - 0x228]
test ecx, ecx
jne 0x47095e
mov ecx, 0x538640
lea ebx, [esi + 0x4c4]
lea eax, [esi + 0x4b8]
push ebx
lea edi, [esi + 0x260]
push ecx
mov esi, eax
mov dword [ebp - 0x238], eax
call fcn.004408f0
test al, al
je 0x470a23
xor edi, edi
mov dword [ebp - 0x234], edi
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x22c], edi
mov esi, dword [ebp - 0x23c]
mov byte [ebp - 4], 1
mov ecx, dword [esi + 0x2ac]
add ecx, 0x208
push ecx
lea eax, [ebp - 0x234]
call fcn.004fcf00
mov edx, dword [esi + 0x2ac]
mov eax, dword [ebx]
cmp eax, dword [edx + 0x410]
jne 0x4709e2
mov ecx, dword [ebp - 0x238]
lea eax, [ebp - 0x234]
call fcn.0043cf70
test al, al
je 0x4709e9
mov byte [ebp - 0x219], 1
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x234]
cmp eax, edi
je 0x470a23
push eax
call fcn.005134a7
add esp, 4
jmp 0x470a23
push 0x538640
lea eax, [esi + 0x4b8]
mov dword [esi + 0x4c4], 0x11
call fcn.004fcf00
mov byte [ebp - 0x219], 1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x228]
test eax, eax
je 0x470a3d
push eax
call fcn.005134a7
add esp, 4
mov al, byte [ebp - 0x219]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00513498
mov esp, ebp
pop ebp
ret
Function at 0x470a60
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
mov eax, dword [esi + 0x128]
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
mov ebx, 6
je 0x470b3e
test eax, eax
je 0x470a8b
push 0
push eax
call edi
jmp 0x470a9b
mov eax, dword [esi + 0x130]
mov ecx, dword [eax + 4]
mov dword [ecx + esi + 0x130], ebx
mov eax, dword [esi + 0x14c]
test eax, eax
je 0x470aac
push 0
push eax
call edi
jmp 0x470abc
mov edx, dword [esi + 0x154]
mov eax, dword [edx + 4]
mov dword [eax + esi + 0x154], ebx
mov eax, dword [esi + 0x220]
test eax, eax
je 0x470acd
push 5
push eax
call edi
jmp 0x470add
mov ecx, dword [esi + 0x228]
mov edx, dword [ecx + 4]
mov dword [edx + esi + 0x228], ebx
mov eax, dword [esi + 0x244]
test eax, eax
je 0x470aee
push 5
push eax
call edi
jmp 0x470afe
mov eax, dword [esi + 0x24c]
mov ecx, dword [eax + 4]
mov dword [ecx + esi + 0x24c], ebx
cmp byte [esi + 0x2a8], 0
mov edi, dword [sym.imp.USER32.dll_EnableWindow]
je 0x470b25
mov eax, dword [esi + 0x50]
test eax, eax
je 0x470b1b
push 0
push eax
call edi
jmp 0x470b25
mov edx, dword [esi + 0x58]
mov eax, dword [edx + 4]
mov dword [eax + esi + 0x58], ebx
mov eax, dword [esi + 0x188]
test eax, eax
je 0x470bf8
push 0
push eax
call edi
pop edi
pop ebx
pop ebp
ret 4
test eax, eax
je 0x470b49
push 5
push eax
call edi
jmp 0x470b59
mov eax, dword [esi + 0x130]
mov ecx, dword [eax + 4]
mov dword [ecx + esi + 0x130], ebx
mov eax, dword [esi + 0x14c]
test eax, eax
je 0x470b6a
push 5
push eax
call edi
jmp 0x470b7a
mov edx, dword [esi + 0x154]
mov eax, dword [edx + 4]
mov dword [eax + esi + 0x154], ebx
mov eax, dword [esi + 0x220]
test eax, eax
je 0x470b8b
push 0
push eax
call edi
jmp 0x470b9b
mov ecx, dword [esi + 0x228]
mov edx, dword [ecx + 4]
mov dword [edx + esi + 0x228], ebx
mov eax, dword [esi + 0x244]
test eax, eax
je 0x470bac
push 0
push eax
call edi
jmp 0x470bbc
mov eax, dword [esi + 0x24c]
mov ecx, dword [eax + 4]
mov dword [ecx + esi + 0x24c], ebx
cmp byte [esi + 0x2a8], 0
mov edi, dword [sym.imp.USER32.dll_EnableWindow]
je 0x470be3
mov eax, dword [esi + 0x50]
test eax, eax
je 0x470bd9
push 1
push eax
call edi
jmp 0x470be3
mov edx, dword [esi + 0x58]
mov eax, dword [edx + 4]
mov dword [eax + esi + 0x58], ebx
mov eax, dword [esi + 0x188]
test eax, eax
je 0x470bf8
push 1
push eax
call edi
pop edi
pop ebx
pop ebp
ret 4
mov ecx, dword [esi + 0x190]
mov edx, dword [ecx + 4]
pop edi
mov dword [edx + esi + 0x190], ebx
pop ebx
pop ebp
ret 4
Function at 0x471380
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x559024]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [esi + 0xe8]
test eax, eax
je 0x4714ca
xor ecx, ecx
push ecx
mov word [ebp - 0x20c], cx
mov edx, dword [eax + 0x208]
push edx
lea eax, [ebp - 0x20c]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp word [ebp - 0x20c], 0
je 0x4713e3
push 0x5388e8
lea ecx, [ebp - 0x20c]
push 0x104
push ecx
call fcn.005149bd
add esp, 0xc
mov edx, dword [esi + 0xe8]
push edi
push edx
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.005149bd
mov eax, dword [esi + 0x38]
add esp, 0xc
test eax, eax
je 0x47142c
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
test eax, eax
jne 0x47143a
mov edx, dword [esi + 0x34]
push ebx
mov ebx, dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + esi + 0x34], eax
pop ebx
jmp 0x47143a
mov eax, dword [esi + 0x34]
mov ecx, dword [eax + 4]
mov dword [esi + ecx + 0x34], 0x57
mov edx, dword [esi + 0xe8]
cmp byte [edx + 0x20c], 0
mov eax, dword [esi + 0x98]
pop edi
je 0x471494
test eax, eax
je 0x471472
push 0
push 1
push 0xf1
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00513498
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x94]
mov ecx, dword [eax + 4]
mov dword [esi + ecx + 0x94], 6
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00513498
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x4714b6
push 0
push 0
push 0xf1
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00513498
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 0x94]
mov eax, dword [edx + 4]
mov dword [esi + eax + 0x94], 6
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00513498
mov esp, ebp
pop ebp
ret
Function at 0x471960
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x529916
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x559024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov esi, ecx
mov word [ebp - 0x218], ax
mov eax, dword [esi + 0x38]
xor ebx, ebx
mov dword [ebp - 0x23c], esi
mov byte [ebp - 0x219], 0
cmp eax, ebx
je 0x4719d8
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, ebx
jg 0x4719d8
mov edx, dword [esi + 0x34]
mov ebx, dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + esi + 0x34], eax
xor ebx, ebx
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x220], ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
cmp edi, ebx
jle 0x471a54
mov dword [ebp - 0x248], ebx
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x240], ebx
mov ecx, edi
lea ebx, [ebp - 0x248]
call fcn.004fca40
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
xor ebx, ebx
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x224], edx
mov dword [ebp - 0x220], eax
cmp ecx, ebx
je 0x471a54
lea edx, [edi + 1]
push edx
lea eax, [ebp - 0x218]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov dword [ebp - 0x224], edi
lea edi, [ebp - 0x228]
mov dword [ebp - 4], ebx
call fcn.004fc3e0
mov ebx, edi
call fcn.004fc450
cmp dword [ebp - 0x224], 0
jle 0x471b23
mov ecx, dword [ebp - 0x228]
test ecx, ecx
jne 0x471a85
mov ecx, 0x538640
lea ebx, [esi + 0xf8]
lea eax, [esi + 0xec]
push ebx
lea edi, [esi + 0xd0]
push ecx
mov esi, eax
mov dword [ebp - 0x238], eax
call fcn.004408f0
test al, al
je 0x471b44
xor edi, edi
mov dword [ebp - 0x234], edi
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x22c], edi
mov esi, dword [ebp - 0x23c]
mov byte [ebp - 4], 1
mov ecx, dword [esi + 0xe8]
push ecx
lea eax, [ebp - 0x234]
call fcn.004fcf00
mov edx, dword [esi + 0xe8]
mov eax, dword [ebx]
cmp eax, dword [edx + 0x208]
jne 0x471b03
mov ecx, dword [ebp - 0x238]
lea eax, [ebp - 0x234]
call fcn.0043cf70
test al, al
je 0x471b0a
mov byte [ebp - 0x219], 1
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x234]
cmp eax, edi
je 0x471b44
push eax
call fcn.005134a7
add esp, 4
jmp 0x471b44
push 0x538640
lea eax, [esi + 0xec]
mov dword [esi + 0xf8], 0x11
call fcn.004fcf00
mov byte [ebp - 0x219], 1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x228]
test eax, eax
je 0x471b5e
push eax
call fcn.005134a7
add esp, 4
mov al, byte [ebp - 0x219]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00513498
mov esp, ebp
pop ebp
ret
Function at 0x4729f0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 0xe4]
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x472a13
test bl, bl
je 0x472a0c
push 5
push eax
call edi
jmp 0x472a27
push 0
push eax
call edi
jmp 0x472a27
mov eax, dword [esi + 0xec]
mov ecx, dword [eax + 4]
mov dword [ecx + esi + 0xec], 6
mov eax, dword [esi + 0x108]
test eax, eax
je 0x472a43
test bl, bl
je 0x472a3c
push 5
push eax
call edi
jmp 0x472a57
push 0
push eax
call edi
jmp 0x472a57
mov edx, dword [esi + 0x110]
mov eax, dword [edx + 4]
mov dword [eax + esi + 0x110], 6
mov eax, dword [esi + 0x12c]
test eax, eax
je 0x472a73
test bl, bl
je 0x472a6c
push 5
push eax
call edi
jmp 0x472a87
push 0
push eax
call edi
jmp 0x472a87
mov ecx, dword [esi + 0x134]
mov edx, dword [ecx + 4]
mov dword [edx + esi + 0x134], 6
mov eax, dword [esi + 0x150]
test eax, eax
je 0x472aa3
test bl, bl
je 0x472a9c
push 5
push eax
call edi
pop edi
ret
push 0
push eax
call edi
pop edi
ret
mov eax, dword [esi + 0x158]
mov ecx, dword [eax + 4]
mov dword [ecx + esi + 0x158], 6
pop edi
ret
Function at 0x4731c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [edi + 0x2e0]
mov eax, dword [eax]
mov cl, 1
cmp eax, 1
je 0x4731d7
cmp eax, 2
jne 0x4731e8
mov eax, dword [ebp + 8]
cmp eax, 0x20
je 0x4731e4
cmp eax, 0x40
jne 0x4731eb
xor cl, cl
jmp 0x4731eb
mov eax, dword [ebp + 8]
push ebx
push esi
cmp eax, 2
je 0x47336a
cmp eax, 0x20
je 0x47336a
cmp eax, 0x40
je 0x47336a
cmp eax, 4
je 0x4732d0
cmp eax, 8
je 0x4732d0
mov eax, dword [edi + 0xe4]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x473236
push 0
push eax
call ebx
mov esi, 6
jmp 0x47324b
mov ecx, dword [edi + 0xec]
mov edx, dword [ecx + 4]
mov esi, 6
mov dword [edx + edi + 0xec], esi
mov eax, dword [edi + 0x108]
test eax, eax
je 0x47325c
push 0
push eax
call ebx
jmp 0x47326c
mov eax, dword [edi + 0x110]
mov ecx, dword [eax + 4]
mov dword [ecx + edi + 0x110], esi
mov eax, dword [edi + 0x12c]
test eax, eax
je 0x47327d
push 0
push eax
call ebx
jmp 0x47328d
mov edx, dword [edi + 0x134]
mov eax, dword [edx + 4]
mov dword [eax + edi + 0x134], esi
mov eax, dword [edi + 0x150]
test eax, eax
je 0x4732ae
push 0
push eax
call ebx
push 0
lea esi, [edi + 0xb4]
call fcn.004b5070
jmp 0x473386
mov ecx, dword [edi + 0x158]
mov edx, dword [ecx + 4]
mov dword [edx + edi + 0x158], esi
push 0
lea esi, [edi + 0xb4]
call fcn.004b5070
jmp 0x473386
mov eax, dword [edi + 0xe4]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x4732ec
push 0
push eax
call esi
mov ebx, 6
jmp 0x473301
mov eax, dword [edi + 0xec]
mov ecx, dword [eax + 4]
mov ebx, 6
mov dword [ecx + edi + 0xec], ebx
mov eax, dword [edi + 0x108]
test eax, eax
je 0x473312
push 0
push eax
call esi
jmp 0x473322
mov edx, dword [edi + 0x110]
mov eax, dword [edx + 4]
mov dword [eax + edi + 0x110], ebx
mov eax, dword [edi + 0x12c]
test eax, eax
je 0x473333
push 0
push eax
call esi
jmp 0x473343
mov ecx, dword [edi + 0x134]
mov edx, dword [ecx + 4]
mov dword [edx + edi + 0x134], ebx
mov eax, dword [edi + 0x150]
test eax, eax
je 0x473356
push 0
push eax
call esi
push 1
jmp 0x473375
mov eax, dword [edi + 0x158]
mov ecx, dword [eax + 4]
mov dword [ecx + edi + 0x158], ebx
push 1
jmp 0x473375
mov bl, cl
mov esi, edi
call fcn.004729f0
push 0
lea esi, [edi + 0xb4]
call fcn.004b5070
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 8], 0x40
mov eax, dword [edi + 0x58]
jne 0x4733b2
test eax, eax
je 0x47339e
push 5
push eax
call ebx
pop esi
pop ebx
pop ebp
ret 4
mov edx, dword [edi + 0x60]
mov eax, dword [edx + 4]
pop esi
mov dword [eax + edi + 0x60], 6
pop ebx
pop ebp
ret 4
test eax, eax
je 0x4733c1
push 0
push eax
call ebx
pop esi
pop ebx
pop ebp
ret 4
mov ecx, dword [edi + 0x60]
mov edx, dword [ecx + 4]
pop esi
mov dword [edx + edi + 0x60], 6
pop ebx
pop ebp
ret 4
Function at 0x475c80
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52c848
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x559024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
add esi, 0x248
mov dword [ebp - 0x10], esi
test ebx, ebx
je 0x475cee
push 0x7d4
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x475cda
push 0x7d4
push ebx
mov edi, eax
call fcn.0042dc20
jmp 0x475cfe
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + 4]
lea esi, [ecx + esi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
jmp 0x475cfe
mov edx, dword [esi + 0x10]
mov eax, dword [edx + 4]
lea eax, [eax + esi + 0x10]
mov dword [eax], 0x57
mov esi, dword [ebp + 8]
mov edx, 0x9ca
add esi, 0x2ac
push ebx
lea ecx, [edx - 1]
mov edi, 2
call fcn.004b4d90
push 0x9c9
mov ebx, esi
call fcn.004b4f90
push 0x9ca
call fcn.004b4f90
call fcn.004bc370
test al, al
je 0x475ea4
mov al, byte [ebp + 0x10]
test al, al
je 0x475d59
cmp byte [0x55a4ac], 0
je 0x475ea4
cmp al, 1
jne 0x475ea4
push 0x84d3
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, 0x55a400
call fcn.00467b90
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x475d7f
mov ecx, 0x538640
mov eax, dword [ebp - 0x10]
call fcn.00402f90
mov edx, dword [0x55a3f8]
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push 1
push 0x138d
add edi, 0x26c
push edx
mov ebx, 3
mov edx, edi
call fcn.004a5050
mov ebx, 0xc35e
mov eax, edi
call fcn.004a5210
mov ebx, 0xc35f
mov eax, edi
call fcn.004a5210
mov ebx, 0xc360
mov eax, edi
call fcn.004a5210
push 0x88c2
lea eax, [ebp - 0x28]
push eax
mov ecx, 0x55a400
call fcn.00467b90
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.004fce50
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x475e04
push eax
call fcn.005134a7
add esp, 4
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x475e10
mov ecx, 0x538640
mov eax, 0x9c9
mov ebx, esi
call fcn.004b5130
push 0x88c3
lea ecx, [ebp - 0x28]
push ecx
mov ecx, 0x55a400
call fcn.00467b90
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.004fce50
xor ebx, ebx
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x28]
cmp eax, ebx
je 0x475e59
push eax
call fcn.005134a7
add esp, 4
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov ecx, dword [ebp - 0x1c]
cmp ecx, ebx
jne 0x475e65
mov ecx, 0x538640
mov eax, 0x9ca
mov ebx, esi
call fcn.004b5130
mov edi, dword [ebp + 8]
call fcn.004797a0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x475ece
push eax
call fcn.005134a7
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 8]
test eax, eax
je 0x475eb9
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x475ec7
mov edx, dword [ecx + 0x10]
mov eax, dword [edx + 4]
mov dword [eax + ecx + 0x10], 6
push 0
call fcn.004b5070
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x475ef0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52d8e8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x559024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea esi, [ebx + 0x2d4]
test edi, edi
je 0x475f5b
push 0x7d5
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x475f47
push 0x7d5
push edi
mov edi, eax
call fcn.0042dc20
jmp 0x475f6b
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + 4]
lea edi, [ecx + esi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
jmp 0x475f6b
mov edx, dword [esi + 0x10]
mov eax, dword [edx + 4]
lea eax, [eax + esi + 0x10]
mov dword [eax], 0x57
call fcn.004bc1f0
test al, al
je 0x476037
push 0x84d4
lea ecx, [ebp - 0x18]
push ecx
mov ecx, 0x55a400
call fcn.00467b90
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
jne 0x475f9e
mov ecx, 0x538640
mov eax, esi
call fcn.00402f90
mov eax, dword [0x55a3f8]
mov ecx, dword [ebp + 0xc]
push 1
lea esi, [ebx + 0x2f8]
push 0x138e
push eax
mov ebx, 1
mov edx, esi
call fcn.004a5050
test al, al
je 0x475fe2
mov ebx, 0xc361
mov eax, esi
call fcn.004a5210
test al, al
je 0x475fe2
mov edx, esi
call fcn.004a5280
mov eax, dword [esi + 8]
test eax, eax
je 0x475ff4
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x476004
mov edx, dword [esi + 0x10]
mov eax, dword [edx + 4]
lea eax, [eax + esi + 0x10]
mov dword [eax], 6
mov eax, dword [ebp + 8]
call fcn.00479890
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x476069
push eax
call fcn.005134a7
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 8]
test eax, eax
je 0x47605b
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx + 4]
mov dword [edx + esi + 0x10], 6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8