joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d660
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x563168
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push edi
mov eax, dword [0x5c3678]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0045d780
xor ebx, ebx
cmp byte [ebp + 8], bl
je 0x45d698
lea eax, [ebx + 1]
jmp 0x45d6a2
cmp eax, 1
jne 0x45d6a2
mov eax, 2
mov dword [ebp - 0x14], eax
xor eax, eax
cmp eax, str.software360TotalSecurity
je 0x45d764
xor ecx, ecx
cmp ecx, str.UserProfile
je 0x45d764
xor edx, edx
cmp edx, str.DeviceStatus
je 0x45d764
mov eax, dword [0x5cc90c]
mov edx, dword [eax + 0xc]
mov ecx, 0x5cc90c
call edx
add eax, 0x10
mov dword [ebp - 0x10], eax
push str.UserProfile
push str.software360TotalSecurity
push str._s_s
lea edi, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.0043bdd0
add esp, 0xc
lea eax, [ebp + 8]
push eax
push str.software360TotalSecurity
push SysReAllocString
mov dword [ebp + 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x45d728
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 8], ebx
mov eax, dword [ebp - 0x10]
push 4
lea edx, [ebp - 0x14]
push edx
push 4
push str.DeviceStatus
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
lea eax, [ebp - 0x10]
sete bl
call fcn.004f0b40
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45d780
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5615a0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push edi
mov eax, dword [0x5c3678]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x1c], ebx
cmp eax, str.software360TotalSecurity
je 0x45d8ee
xor ecx, ecx
cmp ecx, str.UserProfile
je 0x45d8ee
xor edx, edx
cmp edx, str.DeviceStatus
je 0x45d8ee
mov eax, dword [0x5cc90c]
mov edx, dword [eax + 0xc]
mov ecx, 0x5cc90c
call edx
add eax, 0x10
mov dword [ebp - 0x14], eax
push str.UserProfile
push str.software360TotalSecurity
push str._s_s
lea edi, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.0043bdd0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x18]
push edx
push str.DeviceStatus
push eax
push SysReAllocString
mov byte [ebp - 0xd], 1
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x45d83f
cmp dword [ebp - 0x18], 4
je 0x45d842
mov byte [ebp - 0xd], bl
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
call fcn.004f0b40
cmp byte [ebp - 0xd], bl
je 0x45d8ec
mov eax, dword [ebp - 0x1c]
cmp eax, 2
jbe 0x45d8ee
mov edx, dword [0x5cc90c]
mov eax, dword [edx + 0xc]
mov ecx, 0x5cc90c
mov dword [ebp - 0x24], ebx
call eax
add eax, 0x10
mov dword [ebp - 0x18], eax
push str.UserProfile
push str.software360TotalSecurity
push str._s_s
lea edi, [ebp - 0x18]
mov dword [ebp - 4], 1
call fcn.0043bdd0
add esp, 0xc
lea ecx, [ebp - 0x14]
push ecx
push str.software360TotalSecurity
push SysReAllocString
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x45d8c8
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], ebx
mov ecx, dword [ebp - 0x18]
push 4
lea eax, [ebp - 0x24]
push eax
push 4
push str.DeviceStatus
push ecx
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea eax, [ebp - 0x18]
call fcn.004f0b40
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45e4f0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x561570
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x5c3678]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
xor eax, eax
mov dword [ebp - 0x14], esi
cmp eax, str.software360TotalSecurity
je 0x45e5a3
xor ecx, ecx
cmp ecx, str.Experience
je 0x45e5a3
xor edx, edx
cmp edx, str.AccountFlags
je 0x45e5a3
mov eax, dword [0x5cc90c]
mov edx, dword [eax + 0xc]
mov ecx, 0x5cc90c
call edx
add eax, 0x10
mov dword [ebp - 0x10], eax
push str.Experience
push str.software360TotalSecurity
push str._s_s
lea edi, [ebp - 0x10]
mov dword [ebp - 4], esi
call fcn.0043bdd0
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x1c]
push edx
push str.AccountFlags
push eax
push SysReAllocString
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov eax, edi
mov dword [ebp - 4], 0xffffffff
call fcn.004f0b40
mov eax, dword [ebp - 0x14]
or eax, 1
xor ecx, ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], eax
cmp ecx, str.software360TotalSecurity
je 0x45e65b
xor edx, edx
cmp edx, str.Experience
je 0x45e65b
xor eax, eax
cmp eax, str.AccountFlags
je 0x45e65b
mov edx, dword [0x5cc90c]
mov eax, dword [edx + 0xc]
mov ecx, 0x5cc90c
call eax
add eax, 0x10
mov dword [ebp - 0x18], eax
push str.Experience
push str.software360TotalSecurity
push str._s_s
lea edi, [ebp - 0x18]
mov dword [ebp - 4], 1
call fcn.0043bdd0
add esp, 0xc
lea ecx, [ebp - 0x10]
push ecx
push str.software360TotalSecurity
push SysReAllocString
mov dword [ebp - 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x45e637
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], esi
mov ecx, dword [ebp - 0x18]
push 4
lea eax, [ebp - 0x20]
push eax
push 4
push str.AccountFlags
push ecx
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea eax, [ebp - 0x18]
call fcn.004f0b40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x461fd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x561ae8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push edi
mov eax, dword [0x5c3678]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor eax, eax
cmp eax, str.software360TotalSecurity
je 0x4620a4
test edi, edi
je 0x4620a4
cmp dword [ebp + 8], eax
je 0x4620a4
test esi, esi
je 0x4620a4
mov edx, dword [0x5cc90c]
mov eax, dword [edx + 0xc]
mov ecx, 0x5cc90c
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
push edi
push str.software360TotalSecurity
push str._s_s
lea edi, [ebp - 0x10]
mov dword [ebp - 4], 0
call fcn.0043bdd0
mov edx, dword [ebp + 0xc]
add esp, 0xc
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp + 8]
push edx
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
push ecx
push edx
mov edi, 4
push esi
mov bl, 1
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x462087
cmp dword [ebp - 0x14], edi
je 0x462089
xor bl, bl
lea eax, [ebp - 0x10]
call fcn.004f0b40
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4620c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x561ae8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5c3678]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, edx
xor eax, eax
cmp eax, str.software360TotalSecurity
je 0x4621a3
test edi, edi
je 0x4621a3
test esi, esi
je 0x4621a3
mov edx, dword [0x5cc90c]
mov eax, dword [edx + 0xc]
mov ecx, 0x5cc90c
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
push edi
push str.software360TotalSecurity
push str._s_s
lea edi, [ebp - 0x10]
mov dword [ebp - 4], 0
call fcn.0043bdd0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
add esp, 0xc
push ecx
mov ecx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x14]
push eax
push esi
mov esi, dword [ebp - 0x10]
push esi
push ecx
mov bl, 1
mov dword [ebp - 0x14], 0
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x46216a
cmp dword [ebp - 0x14], 3
je 0x46216c
xor bl, bl
lea eax, [esi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x46218f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4621c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x578e78
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x5c3678]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, edx
xor eax, eax
cmp eax, str.software360TotalSecurity
je 0x4622b1
test edi, edi
je 0x4622b1
test esi, esi
je 0x4622b1
mov edx, dword [0x5cc90c]
mov eax, dword [edx + 0xc]
mov ecx, 0x5cc90c
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
push edi
push str.software360TotalSecurity
push str._s_s
lea edi, [ebp - 0x10]
mov dword [ebp - 4], 0
call fcn.0043bdd0
mov edx, dword [ebp + 8]
add esp, 0xc
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x14]
push eax
push esi
mov esi, dword [ebp - 0x10]
push esi
push ecx
mov bl, 1
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 8
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x462278
mov eax, dword [ebp - 0x14]
cmp eax, 0xb
je 0x46227a
cmp eax, 4
je 0x46227a
xor bl, bl
lea eax, [esi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x46229d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4622d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x561538
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push edi
mov eax, dword [0x5c3678]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor eax, eax
cmp eax, str.software360TotalSecurity
je 0x4623ab
xor ebx, ebx
cmp edi, ebx
je 0x4623ab
cmp dword [ebp + 8], ebx
je 0x4623ab
cmp esi, ebx
je 0x4623ab
mov edx, dword [0x5cc90c]
mov eax, dword [edx + 0xc]
mov ecx, 0x5cc90c
call eax
add eax, 0x10
mov dword [ebp - 0x14], eax
push edi
push str.software360TotalSecurity
push str._s_s
lea edi, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.0043bdd0
add esp, 0xc
lea ecx, [ebp - 0x10]
push ecx
push str.software360TotalSecurity
push esi
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x462374
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], ebx
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x14]
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push ecx
push edx
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
lea eax, [ebp - 0x14]
sete bl
call fcn.004f0b40
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4623c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x561508
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5c3678]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
cmp eax, str.software360TotalSecurity
je 0x4624c0
xor ecx, ecx
cmp ecx, str.UserProfile
je 0x4624c0
xor ebx, ebx
cmp esi, ebx
je 0x4624c0
mov edx, dword [0x5cc90c]
mov eax, dword [edx + 0xc]
mov ecx, 0x5cc90c
call eax
add eax, 0x10
mov dword [ebp - 0x14], eax
push str.UserProfile
push str.software360TotalSecurity
push str._s_s
lea edi, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.0043bdd0
add esp, 0xc
lea ecx, [ebp - 0x10]
push ecx
push str.software360TotalSecurity
push SysReAllocString
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x46246a
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
push 3
push esi
mov esi, dword [ebp - 0x14]
push esi
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
lea eax, [esi - 0x10]
sete bl
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4624ac
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4624e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x561508
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5c3678]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x14]
mov edi, ecx
xor eax, eax
cmp eax, str.software360TotalSecurity
je 0x4625d3
xor esi, esi
cmp edi, esi
je 0x4625d3
cmp dword [ebp + 8], esi
je 0x4625d3
mov edx, dword [0x5cc90c]
mov eax, dword [edx + 0xc]
mov ecx, 0x5cc90c
call eax
add eax, 0x10
mov dword [ebp - 0x14], eax
push edi
push str.software360TotalSecurity
push str._s_s
lea edi, [ebp - 0x14]
mov dword [ebp - 4], esi
call fcn.0043bdd0
add esp, 0xc
lea ecx, [ebp - 0x10]
push ecx
push str.software360TotalSecurity
push ebx
mov dword [ebp - 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x462580
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], esi
mov ecx, dword [ebp + 8]
mov esi, dword [ebp - 0x14]
push 8
lea eax, [ebp + 0xc]
push eax
push 0xb
push ecx
push esi
push ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
lea eax, [esi - 0x10]
sete bl
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4625bf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4625f0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5614d8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push edi
mov eax, dword [0x5c3678]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
cmp eax, str.software360TotalSecurity
je 0x462696
xor ecx, ecx
cmp ecx, str.UserProfile
je 0x462696
test esi, esi
je 0x462696
mov edx, dword [0x5cc90c]
mov eax, dword [edx + 0xc]
mov ecx, 0x5cc90c
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
push str.UserProfile
push str.software360TotalSecurity
push str._s_s
lea edi, [ebp - 0x10]
mov dword [ebp - 4], 0
call fcn.0043bdd0
mov ecx, dword [ebp - 0x10]
add esp, 0xc
push esi
push ecx
push SysReAllocString
mov bl, 1
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
test eax, eax
je 0x46267b
xor bl, bl
lea eax, [ebp - 0x10]
call fcn.004f0b40
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46c940
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x572eda
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x5c3678]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, esi
call fcn.0046faa0
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
xor ebx, ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], eax
lea edi, [esi + 0x50]
push edi
mov dword [ebp - 4], ebx
call fcn.004ac300
mov dword [esi], vtable.CAutoCompleteEdit.0
mov dword [esi + 0x2c], vtable.CAutoCompleteEdit.1.0
mov dword [edi], vtable.CAutoCompleteEdit.2.0
mov dword [esi + 0x19c], ebx
mov dword [esi + 0x1a0], ebx
mov dword [esi + 0x1a4], ebx
mov byte [ebp - 4], 4
mov edx, dword [0x5cc90c]
mov eax, dword [edx + 0xc]
mov ecx, 0x5cc90c
call eax
add eax, 0x10
mov dword [esi + 0x1a8], eax
lea ecx, [esi + 0x1b4]
mov byte [ebp - 4], 5
push ecx
mov byte [esi + 0x1ac], bl
mov dword [esi + 0x1b0], 0xffffffff
call fcn.004e2e10
lea edx, [esi + 0x1cc]
push edx
mov byte [ebp - 4], 6
call fcn.004e2e10
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x46d0a0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [edi + 0x30]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x46d119
cmp dword [edi + 0x1a4], 0
lea eax, [edi + 0x1a4]
je 0x46d119
push esi
mov esi, dword [ebp + 0x10]
call fcn.0046f270
test eax, eax
jne 0x46d118
mov al, 0x80
test byte [ebp + 8], al
je 0x46d0ef
cmp byte [edi + 0x1ac], 0
jne 0x46d0e3
push edi
call fcn.0046d760
mov byte [edi + 0x1ac], 0
pop esi
pop ebp
ret 0xc
test byte [ebp + 0xc], al
je 0x46d118
mov esi, dword [edi + 0x30]
call dword [sym.imp.USER32.dll_GetFocus]
cmp esi, eax
je 0x46d118
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x46d118
mov ecx, dword [edi + 0x30]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 0xc
Function at 0x46e200
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56a7e8
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x5c3678]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [ebp + 8], 0
je 0x46e297
cmp dword [edi + 0x1a0], 0
je 0x46e297
mov eax, dword [edi + 0x1a0]
test eax, eax
jne 0x46e249
push 0x80004003
call fcn.0053c010
lea esi, [ebp - 0x10]
call fcn.0046f620
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x46e27a
mov eax, dword [esi]
mov edx, dword [eax + 0xbc]
lea ecx, [ebp + 8]
push ecx
push esi
mov dword [ebp + 8], 0
call edx
mov ecx, dword [ebp + 8]
jmp 0x46e27d
or ecx, 0xffffffff
mov edx, edi
call fcn.0046ded0
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x46e297
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
mov edx, dword [edi + 0x30]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x46e2b1
mov eax, dword [edi + 0x30]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x46ff40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5768c0
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x5c3678]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [edi]
mov edx, dword [eax + 0x28]
lea ecx, [ebp - 0x10]
push ecx
mov ecx, edi
call edx
push 0
push 1
push 0
mov dword [ebp - 4], 0
mov edx, dword [edi + 0x30]
mov eax, dword [eax]
push 0
lea ecx, [edi + 0x50]
push edx
push ecx
mov ecx, eax
call fcn.004ac6e0
test al, al
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
sete bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x46ffbf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x46ffd7
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x58]
test eax, eax
jne 0x46ffe8
push 0x80004003
call fcn.0053c010
lea esi, [ebp - 0x10]
call fcn.0046fa70
mov dword [ebp - 4], 1
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x47009e
push 0
push 0x3e8
lea esi, [ebp - 0x14]
mov eax, ebx
call fcn.0046fb00
lea esi, [edi + 0x19c]
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.00472570
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x470037
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
cmp dword [esi], 0
je 0x47009e
mov eax, dword [esi]
test eax, eax
jne 0x47004c
push 0x80004003
call fcn.0053c010
push 0
push 0x3e9
lea esi, [ebp - 0x14]
call fcn.0046fb00
lea esi, [edi + 0x1a0]
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.0046edc0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x47007f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
cmp dword [esi], 0
je 0x47009e
push 0
push ecx
mov eax, esi
mov ecx, esp
mov dword [ebp - 0x18], esp
call fcn.00472530
lea eax, [edi + 0x50]
push eax
mov edx, edi
call fcn.004ad4b0
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x4700b1
mov eax, dword [ebx]
mov ecx, dword [eax + 8]
push ebx
call ecx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4700d0
Capabilities:
Hide graphical window

Disassembly:
cmp byte [esi + 0x1b5], 0
je 0x47010a
mov eax, dword [esi + 0x1ac]
mov ecx, dword [esi + 0x1a8]
mov edx, dword [esi + 0x1b0]
push eax
mov eax, dword [esi + 0x1a4]
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [esi + 0x30]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
ret
mov edx, dword [esi + 0x30]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
xor eax, eax
ret