joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44daee
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x23c
mov eax, dword [0x46a010]
xor eax, esp
mov dword [esp + 0x238], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x18]
xor esi, esi
mov dword [esp + 0x14], eax
mov ebx, edx
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
test edi, edi
je 0x44db2c
mov dword [edi], esi
cmp dword [ebp + 0x1c], esi
jne 0x44db76
push ebx
push 0x408b10
lea eax, [esp + 0x30]
push 0x109
push eax
call fcn.004145d2
lea ecx, [esp + 0x38]
add esp, 0x10
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x44db50
sub ecx, edx
sar ecx, 1
je 0x44db70
cmp word [esp + ecx*2 + 0x26], 0x5c
jne 0x44db70
xor eax, eax
mov word [esp + ecx*2 + 0x26], ax
lea eax, [esp + 0x28]
jmp 0x44db78
mov eax, ebx
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push esi
push eax
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
test ecx, ecx
je 0x44dbdc
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x44dcf1
test byte [eax + 0x1c], 1
je 0x44dcf1
cmp byte [eax + 0x19], 4
jb 0x44dcf1
push ecx
lea eax, [esp + 0x2c]
push eax
call fcn.00411040
push eax
mov eax, dword [0x46a020]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xc
pop ecx
call fcn.0044d6ec
jmp 0x44dcf1
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x28]
lea eax, [esp + 0x18]
push eax
push esi
push dword [esp + 0x24]
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
mov edx, 0x46a020
test ecx, ecx
je 0x44dc4f
mov eax, dword [0x46a020]
cmp eax, edx
je 0x44dcac
test byte [eax + 0x1c], 1
je 0x44dcac
cmp byte [eax + 0x19], 4
jb 0x44dcac
push ecx
push dword [esp + 0x18]
push ebx
push ecx
call fcn.00411040
pop ecx
push eax
mov eax, dword [0x46a020]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xd
pop ecx
call fcn.0044d76f
jmp 0x44dcac
mov ecx, dword [ebp + 0x14]
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x10], ecx
je 0x44dca3
cmp dword [esp + 0x10], 3
jne 0x44dc6c
cmp ecx, 4
jne 0x44dc6c
cmp eax, ecx
je 0x44dca3
mov eax, dword [0x46a020]
cmp eax, edx
je 0x44dcac
test byte [eax + 0x1c], 1
je 0x44dcac
cmp byte [eax + 0x19], 3
jb 0x44dcac
push ecx
push dword [esp + 0x14]
push dword [esp + 0x1c]
push ebx
call fcn.00411040
push eax
mov eax, dword [0x46a020]
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0044d84c
jmp 0x44dcac
test edi, edi
je 0x44dca9
mov dword [edi], eax
xor esi, esi
inc esi
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, eax
test ecx, ecx
je 0x44dcf1
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x44dcf1
test byte [eax + 0x1c], 1
je 0x44dcf1
cmp byte [eax + 0x19], 2
jb 0x44dcf1
push ecx
push ecx
call fcn.00411040
pop ecx
mov ecx, dword [0x46a020]
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0xf
pop ecx
call fcn.0044d6b9
mov ecx, dword [esp + 0x244]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00468719
mov esp, ebp
pop ebp
ret 0x18
Function at 0x44dd0f
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x234
mov eax, dword [0x46a010]
xor eax, esp
mov dword [esp + 0x230], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, edx
push eax
push 0x408b10
mov dword [esp + 0x20], eax
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
lea eax, [esp + 0x28]
push 0x109
push eax
mov dword [esp + 0x24], ecx
xor esi, esi
call fcn.004145d2
lea ecx, [esp + 0x30]
add esp, 0x10
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x44dd61
sub ecx, edx
sar ecx, 1
je 0x44dd81
cmp word [esp + ecx*2 + 0x1e], 0x5c
jne 0x44dd81
xor eax, eax
mov word [esp + ecx*2 + 0x1e], ax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x14]
push eax
push esi
push 0x20006
push esi
push esi
push esi
lea eax, [esp + 0x3c]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ecx, eax
test ecx, ecx
je 0x44ddee
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x44ded6
test byte [eax + 0x1c], 1
je 0x44ded6
cmp byte [eax + 0x19], 2
jb 0x44ded6
push ecx
lea eax, [esp + 0x24]
push eax
call fcn.00411040
push eax
mov eax, dword [0x46a020]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x10
pop ecx
call fcn.0044d6ec
jmp 0x44ded6
mov eax, dword [0x46a020]
mov ebx, 0x46a020
cmp eax, ebx
je 0x44de3d
test byte [eax + 0x1c], 1
je 0x44de3d
cmp byte [eax + 0x19], 4
jb 0x44de3d
cmp dword [esp + 0x1c], 1
mov eax, 0x408b6c
je 0x44de19
mov eax, 0x408b7c
lea ecx, [esp + 0x20]
push ecx
push eax
call fcn.00411040
push eax
mov eax, dword [0x46a020]
mov edx, 0x408c04
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x11
pop ecx
call fcn.00426a02
push dword [ebp + 0x10]
push dword [esp + 0x18]
push dword [ebp + 0x14]
push esi
push edi
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, eax
test ecx, ecx
je 0x44de91
mov eax, dword [0x46a020]
cmp eax, ebx
je 0x44de94
test byte [eax + 0x1c], 1
je 0x44de94
cmp byte [eax + 0x19], 2
jb 0x44de94
push ecx
push edi
push dword [esp + 0x20]
push ecx
call fcn.00411040
pop ecx
push eax
mov eax, dword [0x46a020]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x12
pop ecx
call fcn.0044d76f
jmp 0x44de94
xor esi, esi
inc esi
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, eax
test ecx, ecx
je 0x44ded6
mov eax, dword [0x46a020]
cmp eax, ebx
je 0x44ded6
test byte [eax + 0x1c], 1
je 0x44ded6
cmp byte [eax + 0x19], 2
jb 0x44ded6
push ecx
push ecx
call fcn.00411040
pop ecx
mov ecx, dword [0x46a020]
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x13
pop ecx
call fcn.0044d6b9
mov ecx, dword [esp + 0x23c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00468719
mov esp, ebp
pop ebp
ret 0x10
Function at 0x44f62e
Capabilities:
Parse credit card information

Disassembly:
mov edi, edi
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
je 0x44f75b
xor edi, edi
cmp word [esi], di
je 0x44f75b
call fcn.0044f7df
movzx ecx, word [esi]
test cx, cx
je 0x44f729
push 2
pop ebx
cmp cx, 0x3b
je 0x44f75b
cmp cx, 0x22
je 0x44f75b
cmp cx, 0x3c
je 0x44f75b
cmp cx, 0x3e
je 0x44f75b
cmp cx, 0x2a
je 0x44f75b
cmp cx, 0x2b
je 0x44f75b
cmp cx, 0x3d
je 0x44f75b
cmp cx, 0x7c
je 0x44f75b
cmp cx, 0x3f
je 0x44f75b
cmp cx, 0x2c
je 0x44f75b
cmp cx, 0x20
je 0x44f75b
cmp cx, 9
je 0x44f75b
cmp cx, 0x3a
jne 0x44f711
test eax, eax
jne 0x44f71b
add esi, ebx
mov edi, esi
movzx eax, word [esi]
test ax, ax
je 0x44f75b
movzx eax, ax
push eax
call sub.msvcrt.dll_iswdigit
add esi, ebx
pop ecx
test eax, eax
je 0x44f75b
movzx eax, word [esi]
test ax, ax
jne 0x44f6ea
sub esi, edi
xor eax, eax
and esi, 0xfffffffe
cmp esi, 0xa
setle al
jmp 0x44f75d
test eax, eax
je 0x44f71b
cmp cx, 0x5d
je 0x44f72e
add esi, ebx
movzx ecx, word [esi]
test cx, cx
jne 0x44f65c
xor eax, eax
inc eax
jmp 0x44f75d
add esi, ebx
cmp word [esi], di
je 0x44f729
add esi, ebx
mov edi, esi
movzx eax, word [esi]
test ax, ax
je 0x44f75b
movzx eax, ax
push eax
call sub.msvcrt.dll_iswdigit
add esi, ebx
pop ecx
test eax, eax
je 0x44f75b
movzx eax, word [esi]
test ax, ax
jne 0x44f741
jmp 0x44f702
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x45062e
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x46a010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, edx
mov esi, 0x80004005
test edi, edi
je 0x45072f
push ebx
xor eax, eax
mov ebx, 0x104
mov word [ebp - 0x20c], ax
xor esi, esi
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x20c]
push ebx
push eax
call dword [sym.imp.msvcrt.dll_wcsnlen]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x210], eax
pop ecx
pop ecx
test eax, eax
jne 0x4506a4
call ebx
mov esi, eax
test esi, esi
jle 0x4506a4
movzx esi, si
or esi, 0x80070000
push 0x104
push 0x408e70
call dword [sym.imp.msvcrt.dll_wcsnlen]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x210]
add ecx, 2
add eax, ecx
mov ecx, 0x104
cmp eax, ecx
jbe 0x4506cf
mov esi, 0x80004005
test esi, esi
js 0x45072e
mov edx, ecx
lea ecx, [ebp - 0x20c]
push 0x402f68
call fcn.0041d6eb
mov esi, eax
test esi, esi
js 0x45072e
push 0x408e70
mov edx, 0x104
lea ecx, [ebp - 0x20c]
call fcn.0041d6eb
mov esi, eax
test esi, esi
js 0x45072e
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi], eax
test eax, eax
jne 0x45072c
call ebx
mov esi, eax
test esi, esi
jle 0x45072e
movzx esi, si
or esi, 0x80070000
jmp 0x45072e
xor esi, esi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00468719
mov esp, ebp
pop ebp
ret
Function at 0x458348
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov edi, ecx
cmp dword [ebp + 8], ebx
je 0x4583b1
mov eax, dword [edi]
push dword [ebp + 8]
call dword [eax + 0x30]
mov esi, eax
test esi, esi
jns 0x45844f
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x458556
test byte [eax + 0x1c], 8
je 0x458556
cmp byte [eax + 0x19], 2
jb 0x458556
push esi
push 0x409e30
call fcn.00411040
push eax
mov eax, dword [0x46a020]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x10
jmp 0x45843f
cmp word [edi + 0x40], bx
jne 0x4583f7
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x4583ed
test byte [eax + 0x1c], 1
je 0x4583ed
cmp byte [eax + 0x19], 2
jb 0x4583ed
call fcn.00411040
push eax
mov eax, dword [0x46a020]
mov edx, 0x409f30
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x11
pop ecx
call fcn.004110b1
mov esi, 0x8007007b
jmp 0x458556
mov eax, dword [edi]
call dword [eax + 0x20]
mov esi, eax
test esi, esi
jns 0x45844f
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x458556
test byte [eax + 0x1c], 8
je 0x458556
cmp byte [eax + 0x19], 2
jb 0x458556
push esi
push 0x409e60
call fcn.00411040
push eax
mov eax, dword [0x46a020]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x12
mov edx, 0x409f30
pop ecx
call fcn.00410eec
jmp 0x458556
cmp dword [edi + 0x30], ebx
jne 0x4584ac
mov ebx, 0x800
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [edi + 0x30], eax
test eax, eax
jne 0x4584a9
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x45849f
test byte [eax + 0x1c], 1
je 0x45849f
cmp byte [eax + 0x19], 2
jb 0x45849f
call fcn.00411040
push eax
mov eax, dword [0x46a020]
mov edx, 0x409f30
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x13
pop ecx
call fcn.004110b1
mov esi, 0x8007000e
jmp 0x458556
mov dword [edi + 0x34], ebx
lea eax, [edi + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
jne 0x458503
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x4584fe
test byte [eax + 0x1c], 1
je 0x4584fe
cmp byte [eax + 0x19], 2
jb 0x4584fe
call ebx
push eax
lea eax, [edi + 0x40]
push eax
call fcn.00411040
push eax
mov eax, dword [0x46a020]
mov edx, 0x409f30
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x14
pop ecx
call fcn.0041d87e
mov eax, 0x80
xor ecx, ecx
inc ecx
cmp dword [ebp + 0x10], 0
je 0x45850f
push 3
pop ecx
push 0
push eax
push 2
push 0
push ecx
push 0x40000000
lea eax, [edi + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi + 0x2c], eax
cmp eax, 0xffffffff
jne 0x458541
call ebx
mov esi, eax
test esi, esi
jle 0x458556
movzx esi, si
or esi, 0x80070000
jmp 0x458556
mov eax, dword [ebp + 0xc]
xor ecx, ecx
inc ecx
mov dword [edi + 0x24c], eax
mov dword [edi + 0x28], ecx
mov dword [edi + 0x250], ecx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x45accd
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 8], 4
push eax
push 0x20019
xor ebx, ebx
push ebx
push 0x40a248
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x45ad2c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x40a2c0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x45ad2c
cmp dword [ebp - 0xc], 4
jne 0x45ad2c
cmp dword [ebp - 0x10], 1
sete bl
cmp dword [ebp - 4], 0
je 0x45ad3b
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45b0aa
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x46a010]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push 0x5c
push 0x46b448
mov dword [ebp - 0x2c], 0x10
call sub.msvcrt.dll_wcschr
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x45b127
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x45b11d
test byte [eax + 0x1c], 1
je 0x45b11d
cmp byte [eax + 0x19], 2
jb 0x45b11d
mov ecx, 0x46b448
push ecx
push ecx
call fcn.00411040
pop ecx
push eax
mov eax, dword [0x46a020]
mov edx, 0x40a3a4
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x56
pop ecx
call fcn.0041d606
mov esi, 0x80070057
jmp 0x45b1cb
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x45b18d
mov eax, dword [0x46a020]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x46a020
je 0x45b17a
test byte [eax + 0x1c], 1
je 0x45b17a
cmp byte [eax + 0x19], 2
jb 0x45b17a
call esi
push eax
push ecx
call fcn.00411040
pop ecx
push eax
mov eax, dword [0x46a020]
mov edx, 0x40a3a4
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x57
pop ecx
call fcn.00412c68
call esi
mov esi, eax
test esi, esi
jle 0x45b1cb
movzx esi, si
or esi, 0x80070000
jmp 0x45b1cb
mov ecx, 0x46b448
mov eax, ebx
sub eax, ecx
sar eax, 1
push eax
lea eax, [ebp - 0x28]
push eax
push ecx
call sub.msvcrt.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x45b1bf
test edi, edi
je 0x45b1b3
lea eax, [ebx + 2]
mov dword [edi], eax
mov dword [0x46b044], 1
jmp 0x45b1cb
test edi, edi
je 0x45b1c5
mov dword [edi], esi
mov dword [0x46b044], esi
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00468719
mov esp, ebp
pop ebp
ret 4
Function at 0x45e15c
Capabilities:
Terminate thread

Disassembly:
mov edi, edi
push ecx
push esi
push edi
push 2
mov edi, ecx
xor esi, esi
pop eax
mov ecx, 0x46b84c
xchg dword [ecx], eax
cmp eax, 1
jne 0x45e1bb
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x45e236
test byte [eax + 0x1c], 8
je 0x45e236
cmp byte [eax + 0x19], 2
jb 0x45e236
push esi
push ecx
call fcn.00411040
pop ecx
push eax
mov eax, dword [0x46a020]
mov edx, 0x40ab90
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x6a
pop ecx
call fcn.00412c68
jmp 0x45e236
push esi
push esi
push 0x10
push dword [edi + 0x40]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [edi]
push edi
call dword [eax + 8]
push esi
push dword [edi + 0x98]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
jne 0x45e236
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x45e220
test byte [eax + 0x1c], 8
je 0x45e220
cmp byte [eax + 0x19], 2
jb 0x45e220
push esi
push ecx
call fcn.00411040
pop ecx
push eax
mov eax, dword [0x46a020]
mov edx, 0x40ab90
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x6b
pop ecx
call fcn.00412c68
test esi, esi
jle 0x45e22f
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x45e236
mov esi, 0x80004005
pop edi
mov eax, esi
pop esi
pop ecx
ret

Function at 0x460f7e
Capabilities:
Get hostname

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x46a010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edx, dword [ebp + 0xc]
lea edi, [ebp - 0x22]
xor eax, eax
mov ebx, ecx
push 7
mov word [ebp - 0x24], ax
xor esi, esi
pop ecx
rep stosd dword es:[edi], eax
mov dword [ebp - 0x28], esi
stosw word es:[edi], ax
cmp word [edx], si
jne 0x461027
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x10
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x461024
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x46100c
test byte [eax + 0x1c], 8
je 0x46100c
cmp byte [eax + 0x19], 2
jb 0x46100c
push esi
push ecx
call fcn.00411040
pop ecx
push eax
mov eax, dword [0x46a020]
mov edx, 0x40b04c
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xa
pop ecx
call fcn.00412c68
test esi, esi
jle 0x46101b
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x46107b
mov esi, 0x80004005
jmp 0x46107b
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebx + 0x24], eax
test eax, eax
jne 0x461075
mov eax, dword [0x46a020]
mov esi, 0x8007000e
cmp eax, 0x46a020
je 0x46107b
test byte [eax + 0x1c], 8
je 0x46107b
cmp byte [eax + 0x19], 2
jb 0x46107b
push esi
push ecx
call fcn.00411040
pop ecx
push eax
mov eax, dword [0x46a020]
mov edx, 0x40b04c
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xb
pop ecx
call fcn.00412c68
jmp 0x46107b
mov ecx, dword [ebp + 8]
mov dword [ebx + 0x20], ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00468719
mov esp, ebp
pop ebp
ret 8
Function at 0x46164c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, ecx
push 0x40b0cc
push dword [esi + 0x18]
call edi
xor ebx, ebx
mov dword [esi + 0x20], eax
inc ebx
test eax, eax
jne 0x4616a2
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x4616a2
test byte [eax + 0x1c], bl
je 0x4616a2
cmp byte [eax + 0x19], 2
jb 0x4616a2
call fcn.00411040
push eax
mov eax, dword [0x46a020]
mov edx, 0x40b180
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x10
pop ecx
call fcn.004110b1
push 0x40b0e0
push dword [esi + 0x18]
call edi
mov dword [esi + 0x24], eax
test eax, eax
jne 0x4616e8
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x4616e8
test byte [eax + 0x1c], bl
je 0x4616e8
cmp byte [eax + 0x19], 2
jb 0x4616e8
call fcn.00411040
push eax
mov eax, dword [0x46a020]
mov edx, 0x40b180
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x11
pop ecx
call fcn.004110b1
push 0x40b0f0
push dword [esi + 0x18]
call edi
mov dword [esi + 0x28], eax
test eax, eax
jne 0x46172e
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x46172e
test byte [eax + 0x1c], bl
je 0x46172e
cmp byte [eax + 0x19], 2
jb 0x46172e
call fcn.00411040
push eax
mov eax, dword [0x46a020]
mov edx, 0x40b180
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x12
pop ecx
call fcn.004110b1
push 0x40b100
push dword [esi + 0x18]
call edi
mov dword [esi + 0x2c], eax
test eax, eax
jne 0x461774
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x461774
test byte [eax + 0x1c], bl
je 0x461774
cmp byte [eax + 0x19], 2
jb 0x461774
call fcn.00411040
push eax
mov eax, dword [0x46a020]
mov edx, 0x40b180
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x13
pop ecx
call fcn.004110b1
push 0x40b114
push dword [esi + 0x18]
call edi
mov dword [esi + 0x30], eax
test eax, eax
jne 0x4617ba
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x4617ba
test byte [eax + 0x1c], bl
je 0x4617ba
cmp byte [eax + 0x19], 2
jb 0x4617ba
call fcn.00411040
push eax
mov eax, dword [0x46a020]
mov edx, 0x40b180
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x14
pop ecx
call fcn.004110b1
push 0x40b12c
push dword [esi + 0x18]
call edi
mov dword [esi + 0x34], eax
test eax, eax
jne 0x461800
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x461800
test byte [eax + 0x1c], bl
je 0x461800
cmp byte [eax + 0x19], 2
jb 0x461800
call fcn.00411040
push eax
mov eax, dword [0x46a020]
mov edx, 0x40b180
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x15
pop ecx
call fcn.004110b1
push 0x40b150
push dword [esi + 0x18]
call edi
mov dword [esi + 0x38], eax
test eax, eax
jne 0x461846
mov eax, dword [0x46a020]
cmp eax, 0x46a020
je 0x461846
test byte [eax + 0x1c], bl
je 0x461846
cmp byte [eax + 0x19], 2
jb 0x461846
call fcn.00411040
push eax
mov eax, dword [0x46a020]
mov edx, 0x40b180
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x16
pop ecx
call fcn.004110b1
cmp dword [esi + 0x20], 0
je 0x461852
cmp dword [esi + 0x28], 0
jne 0x461854
xor ebx, ebx
pop edi
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x4623d8
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi]
mov eax, dword [ecx]
call dword [eax + 0x58]
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [edi + 0xc], eax
jne 0x46244e
mov esi, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x462416
cmp ebx, 3
jbe 0x46249c
cmp ebx, 6
je 0x46249c
cmp ebx, 7
je 0x46246a
test esi, esi
je 0x462533
cmp esi, 3
jbe 0x462435
cmp esi, 4
je 0x4624f2
cmp esi, 6
jne 0x462533
cmp dword [ebp + 8], 0
je 0x462461
mov ecx, dword [edi]
mov ebx, esi
mov eax, dword [ecx]
call dword [eax + 0x58]
mov dword [ebp - 4], eax
xor eax, eax
cmp dword [edi + 0xc], eax
je 0x4623fb
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
push dword [edi + 0x10]
call esi
push 0
push dword [edi + 0x14]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push eax
push dword [edi + 0x14]
call ebx
cmp esi, 7
je 0x462493
mov eax, dword [ebp - 4]
cmp dword [eax*4 + 0x40b320], 1
jne 0x462493
push 5
push dword [edi + 0x10]
call ebx
push 1
jmp 0x4624e4
push 0
push dword [edi + 0x10]
call ebx
jmp 0x462461
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
push dword [edi + 0x14]
call esi
cmp dword [ebp + 8], 0
je 0x462461
mov ecx, dword [ebp + 8]
call fcn.0045b449
test eax, eax
je 0x4624db
mov ecx, dword [edi]
mov eax, dword [ecx]
call dword [eax + 0x50]
test eax, eax
je 0x4624db
mov eax, dword [ebp - 4]
cmp dword [eax*4 + 0x40b304], 1
jne 0x4624db
push 5
push dword [edi + 0x10]
call esi
jmp 0x46248f
push 5
push dword [edi + 0x10]
call esi
push 0
push dword [edi + 0x10]
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x462461
mov ecx, dword [edi]
mov eax, dword [ecx]
call dword [eax + 0x2c]
test eax, eax
jne 0x46251c
cmp dword [ebp + 0xc], eax
jne 0x46251c
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push dword [edi + 0x14]
call esi
push 1
push dword [edi + 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
jmp 0x462529
push 0
push dword [edi + 0x14]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
call esi
push 0
push dword [edi + 0x10]
jmp 0x46245f
push eax
jmp 0x46251e