joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4501d0
Capabilities:
Check mutex on windows
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x27c
mov eax, dword [0x6a8c7c]
xor eax, esp
mov dword [esp + 0x278], eax
push ebx
push esi
push edi
push str.116D38D3_CE72_4EA1_AD3E_A550CE7FF1BF
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x45022c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x278]
xor ecx, esp
call fcn.005d584c
mov esp, ebp
pop ebp
ret 0x10
push ecx
call fcn.0046e3e0
mov ecx, eax
call fcn.0046e460
call fcn.0045b4a0
push 0x20a
mov edi, eax
lea eax, [esp + 0x74]
push 0
push eax
call fcn.005ed310
add esp, 0xc
lea eax, [esp + 0x70]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x685d44
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push 0
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [esp + 0x70]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x450294
sub eax, edx
lea ecx, [edi + 8]
sar eax, 1
push eax
lea eax, [esp + 0x74]
push eax
call fcn.0044e430
push ecx
push str.MainUI
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0x685028
mov dword [esp + 0x6c], vtable.nbase::SupportWeakCallback.0
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
call fcn.004da3a0
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], vtable.CMarchApp.0
mov eax, dword [eax + 4]
mov dword [esp + eax + 0x20], vtable.CMarchApp.1.0
mov eax, dword [esp + 0x10]
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x28], 1
mov byte [esp + 0x24], 1
mov dword [esp + 0x38], 0
call dword [eax + 4]
lea ecx, [esp + 0x10]
call fcn.00450160
call fcn.0045b4a0
mov ebx, eax
mov ecx, ebx
call fcn.0045c110
mov eax, dword [ebx + 4]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x45035d
push eax
call edi
mov dword [ebx + 4], 0
call fcn.0046e3e0
test esi, esi
je 0x450369
push esi
call edi
mov ecx, dword [esp + 0x284]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005d584c
mov esp, ebp
pop ebp
ret 0x10
Function at 0x450cb0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x617988
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x6a8c7c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ecx + 0x48]
mov dword [ebp - 0x10], edi
call fcn.004dae10
test edi, edi
js 0x450d63
call fcn.004dab90
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
je 0x450d63
call fcn.004dae10
mov esi, eax
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
mov eax, dword [ebx]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], eax
call fcn.004dae10
mov edi, eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [edi + 0x18]
call fcn.004db160
push eax
add eax, 0x10
push eax
push ecx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [edi + 0x18]
call fcn.004db180
cmp byte [ebp - 0x18], 0
jne 0x450d4f
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x14]
cmp eax, dword [ebx]
jne 0x450d58
mov eax, dword [ebp - 0x10]
inc dword [ebx + 8]
mov dword [ebx + 0xc], eax
test esi, esi
je 0x450d63
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x450d80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6179b8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x6a8c7c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.004dae10
call fcn.004dab90
push dword [eax]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
je 0x450e2d
mov ecx, dword [edi + 8]
cmp ecx, 1
jl 0x450e2d
add ecx, 0xffffffff
mov dword [edi + 8], ecx
jne 0x450e2d
call fcn.004dae10
mov esi, eax
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ebx, [edi + 0xc]
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push ebx
push eax
call fcn.004dae10
lea ecx, [eax + 0x18]
call fcn.00494fd0
call fcn.004dae10
mov edi, dword [ebp - 0x10]
cmp edi, dword [eax + 0x18]
je 0x450e1c
call fcn.004dae10
push edi
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [eax + 0x18]
call fcn.004db0b0
mov dword [ebx], 0xffffffff
test esi, esi
je 0x450e2d
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x451e80
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6179b8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x6a8c7c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 0x48]
call fcn.004da600
mov ecx, dword [esi + 0x48]
mov dword [esi + 0x48], 0
test ecx, ecx
je 0x451ec6
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [esi + 0x4c]
call fcn.004da600
mov ecx, dword [esi + 0x4c]
mov dword [esi + 0x4c], 0
test ecx, ecx
je 0x451ee2
mov eax, dword [ecx]
push 1
call dword [eax]
call fcn.004dab90
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push dword [eax]
call esi
test eax, eax
je 0x451ef9
mov byte [eax + 4], 1
call fcn.004dae10
call fcn.004dab90
push dword [eax]
call esi
mov edi, eax
test edi, edi
je 0x451f81
mov ecx, dword [edi + 8]
cmp ecx, 1
jl 0x451f81
add ecx, 0xffffffff
mov dword [edi + 8], ecx
jne 0x451f81
call fcn.004dae10
mov esi, eax
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ebx, [edi + 0xc]
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push ebx
push eax
call fcn.004dae10
lea ecx, [eax + 0x18]
call fcn.00494fd0
call fcn.004dae10
mov edi, dword [ebp - 0x10]
cmp edi, dword [eax + 0x18]
je 0x451f69
call fcn.004dae10
push edi
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [eax + 0x18]
call fcn.004db0b0
mov dword [ebx], 0xffffffff
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x451f81
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x6b42c0], 0
je 0x451f99
call fcn.004c5f30
mov dword [0x6b42c0], 0
mov eax, dword [0x6b4244]
mov dword [0x6b4244], 0
test eax, eax
je 0x451fb7
push 4
push eax
call fcn.005d588d
add esp, 8
call fcn.00499060
push dword [0x6b42bc]
call dword [sym.imp.gdiplus.dll_GdiplusShutdown]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x455550
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x617fd0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x6a8c7c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
cmp esi, 0x113
jne 0x4555bd
cmp dword [ebp + 0xc], 0x7b
jne 0x455592
call fcn.00455cc0
push dword [ebp + 0x10]
mov ecx, edi
push dword [ebp + 0xc]
push esi
call fcn.004a5440
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005d584c
mov esp, ebp
pop ebp
ret 0xc
cmp esi, 0x656
jne 0x4555cf
push ecx
call fcn.004563f0
xor eax, eax
jmp 0x4555a0
cmp esi, 0x69d
jne 0x4556af
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
test esi, esi
je 0x4556a8
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4555fa
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x455696
cmp dword [edi + 0x2b8], 0
mov dword [edi + 0x2b4], 0
je 0x45567c
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x455626
mov eax, dword [esi]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0044dfc0
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
mov ecx, dword [edi + 0x2b8]
push eax
call fcn.0049d040
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x45567c
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x455672
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4556d3
push edx
push ecx
call fcn.005d588d
add esp, 8
mov ecx, dword [edi + 0x2c0]
push 0
mov eax, dword [ecx]
call dword [eax + 0x7c]
mov ecx, dword [edi + 0x2bc]
push 0
mov eax, dword [ecx]
call dword [eax + 0x7c]
mov ecx, esi
call fcn.0044e3d0
push 0x18
push esi
call fcn.005d588d
add esp, 8
xor eax, eax
jmp 0x4555a0
cmp esi, 0x69a
jne 0x455592
mov ecx, dword [edi + 0x2bc]
test ecx, ecx
je 0x4556a8
mov eax, dword [ecx]
push 1
call dword [eax + 0x7c]
xor eax, eax
jmp 0x4555a0
call fcn.005f564e
int3

Function at 0x4563f0
Capabilities:
Hide graphical window

Disassembly:
push edi
mov edi, ecx
push 0x7b
push dword [edi + 0x10]
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [edi]
mov edx, dword [eax + 0x14]
cmp eax, vtable.CMarchDiscountDlg.1.0
jne 0x456458
push dword [edi + 0x10]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x456422
push 0
push dword [edi + 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0x10
push dword [edi + 0x10]
call dword [sym.imp.USER32.dll_PostMessageW]
push 1
push dword [edi + 0x264]
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
push 0
push 0x657
push dword [edi + 0x264]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
ret 4
push 1
push 0
mov ecx, edi
call edx
jmp 0x456422

Function at 0x457570
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004a5440
Function at 0x45b500
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6185a8
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x6a8c7c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [edi + 8]
push eax
lea ecx, [ebp - 0x5c]
call fcn.004565b0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], 0x640041
lea edx, [eax + 2]
mov dword [ebp - 0x40], 0x62006f
mov dword [ebp - 0x3c], 0x540065
mov dword [ebp - 0x38], 0x6f006f
mov dword [ebp - 0x34], 0x73006c
mov dword [ebp - 0x30], 0x73002e
mov dword [ebp - 0x2c], 0x6f0074
mov dword [ebp - 0x28], 0x610072
mov dword [ebp - 0x24], 0x650067
mov dword [ebp - 0x20], 0x6c002e
mov dword [ebp - 0x1c], 0x2e0031
mov dword [ebp - 0x18], 0x6c0064
mov dword [ebp - 0x14], 0x6c
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x45b5a1
sub eax, edx
lea ecx, [ebp - 0x5c]
sar eax, 1
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.0044e8a0
cmp dword [ebp - 0x48], 8
lea eax, [ebp - 0x5c]
cmovae eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push 0
test eax, eax
lea eax, [ebp - 0x5c]
push 0x80
je 0x45b653
cmp dword [ebp - 0x48], 8
push 3
cmovae eax, dword [ebp - 0x5c]
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push eax
mov dword [edi + 4], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0x2d0
jae 0x45b611
xor esi, esi
jmp 0x45b67b
lea esi, [ebx + 1]
push esi
call fcn.005d5d35
push esi
push 0
push eax
mov dword [ebp - 0x64], eax
call fcn.005ed310
mov esi, dword [ebp - 0x64]
lea eax, [ebp - 0x60]
add esp, 0x10
mov dword [ebp - 0x60], 0
push 0
push eax
push ebx
push esi
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x45b676
push ebx
push esi
mov ecx, edi
call fcn.0045b6e0
jmp 0x45b676
cmp dword [ebp - 0x48], 8
push 2
cmovae eax, dword [ebp - 0x5c]
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi + 4], eax
mov dword [edi], 1
mov esi, 1
mov edx, dword [ebp - 0x48]
cmp edx, 8
jb 0x45b6b1
mov ecx, dword [ebp - 0x5c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45b6a7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45b6cf
push edx
push ecx
call fcn.005d588d
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005d584c
mov esp, ebp
pop ebp
ret
call fcn.005f564e
int3
Function at 0x462020
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61903b
mov eax, dword fs:[0]
push eax
sub esp, 0x2b8
mov eax, dword [0x6a8c7c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x21c]
mov edi, dword [ebp + 0xc]
push 0x20a
push 0
push eax
call fcn.005ed310
push esi
lea eax, [ebp - 0x21c]
push 0x105
push eax
call fcn.005f6a7e
add esp, 0x18
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push edi
push esi
lea eax, [ebp - 0x234]
push str.__s___s
push eax
call fcn.004db460
add esp, 0x10
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x288]
push ecx
lea ecx, [ebp - 0x278]
mov dword [ebp - 0x278], 0x44
push ecx
xor eax, eax
mov dword [ebp - 0x24c], 0x101
cmp dword [ebp - 0x220], 8
lea ecx, [ebp - 0x21c]
push ecx
push 0
push 0
mov word [ebp - 0x236], ax
xorps xmm0, xmm0
push 0
mov eax, 1
movlpd qword [ebp - 0x274], xmm0
mov word [ebp - 0x248], ax
lea eax, [ebp - 0x234]
cmovae eax, dword [ebp - 0x234]
push 0
push 0
push eax
push 0
movlpd qword [ebp - 0x26c], xmm0
movlpd qword [ebp - 0x264], xmm0
movlpd qword [ebp - 0x25c], xmm0
movlpd qword [ebp - 0x254], xmm0
movlpd qword [ebp - 0x246], xmm0
movlpd qword [ebp - 0x23e], xmm0
movups xmmword [ebp - 0x288], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x46216b
push dword [ebp - 0x284]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x288]
call esi
jmp 0x4621fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x2e4
jne 0x4621fc
call fcn.0046e3e0
cmp dword [eax], 5
jle 0x4621e8
push 0x38
lea eax, [ebp - 0x2c0]
mov dword [ebp - 0x2c4], 0x3c
push 0
push eax
call fcn.005ed310
add esp, 0xc
mov dword [ebp - 0x2c0], 0x40
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x2b8], str.runas
mov dword [ebp - 0x2ac], eax
lea eax, [ebp - 0x2c4]
mov dword [ebp - 0x2b4], esi
push eax
mov dword [ebp - 0x2b0], edi
mov dword [ebp - 0x2a8], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp 0x4621fc
push 0xa
push esi
push 0
push 0
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [ebp - 0x220]
cmp edx, 8
jb 0x462238
mov ecx, dword [ebp - 0x234]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x46222e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x462255
push edx
push ecx
call fcn.005d588d
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005d584c
mov esp, ebp
pop ebp
ret 8
call fcn.005f564e
int3
Function at 0x462260
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x619080
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x6a8c7c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0x3d4]
push eax
lea ecx, [ebp - 0x50]
call fcn.004565b0
mov dword [ebp - 4], 0
cmp dword [esi + 0x3b0], 1
je 0x4622b1
xor esi, esi
jmp 0x462398
xor eax, eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], ax
call fcn.0046e3e0
add eax, 0x28
cmp dword [eax + 0x14], 8
jb 0x4622ca
mov eax, dword [eax]
push 2
push eax
lea eax, [ebp - 0x18]
push 3
push eax
call fcn.005f6baf
add esp, 0x10
lea eax, [ebp - 0x20]
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
push eax
push 0
push 0
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
call fcn.005d68b0
mov edx, dword [esi + 0x3ac]
mov ecx, dword [esi + 0x3a8]
movsd qword [ebp - 0x58], xmm0
call fcn.005d68b0
mulsd xmm0, qword [0x68d518]
comisd xmm0, xmmword [ebp - 0x58]
jbe 0x46232c
mov esi, 0x64
jmp 0x462398
call fcn.0046e3e0
add eax, 0x28
lea ecx, [ebp - 0x38]
push eax
call fcn.004565b0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x38]
cmp dword [ebp - 0x24], 8
lea ecx, [ebp - 0x50]
cmovae edx, dword [ebp - 0x38]
cmp dword [ebp - 0x3c], 8
cmovae ecx, dword [ebp - 0x50]
push ecx
call fcn.0046c070
mov edx, dword [ebp - 0x24]
add esp, 4
mov esi, eax
cmp edx, 8
jb 0x462398
mov ecx, dword [ebp - 0x38]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x46238e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4623ea
push edx
push ecx
call fcn.005d588d
add esp, 8
mov edx, dword [ebp - 0x3c]
cmp edx, 8
jb 0x4623ce
mov ecx, dword [ebp - 0x50]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4623c4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4623ef
push edx
push ecx
call fcn.005d588d
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005d584c
mov esp, ebp
pop ebp
ret
call fcn.005f564e
call fcn.005f564e
int3
Function at 0x46b350
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x619fd8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x6a8c7c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
push 0x40
call fcn.005d585d
mov esi, eax
mov dword [ebp - 4], 0
lea ecx, [esi + 8]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], ecx
add esp, 4
mov dword [esi], vtable.._AV___Func_impl_no_alloc_V__WeakCallback_V___Binder_U_Unforced_std__AAP8CMarchMainWnd__AEXV__basic_string__WU__char_traits__W_std__V__allocator__W_2__2_PAX_ZABQAV3_ABV42_AAPAX_std___nbase__X__V_std__.0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x46b3b7
lock inc dword [eax + 8]
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
add ecx, 8
mov byte [ebp - 4], 1
movq xmm0, qword [edi + 8]
lea ebx, [ecx + 0xc]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], ebx
movq qword [ecx], xmm0
mov eax, dword [edi + 0x10]
mov dword [ecx + 8], eax
lea ecx, [ebx + 4]
mov eax, dword [edi + 0x14]
mov dword [ebx], eax
lea eax, [edi + 0x18]
push eax
mov dword [ebp - 0x1c], ecx
call fcn.004565b0
mov eax, dword [edi + 0x30]
mov dword [ebx + 0x1c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46ba60
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x6a8c7c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x105
lea eax, [ebp - 0x10c]
mov ebx, ecx
push 0
push eax
call fcn.005ed310
add esp, 0xc
xor eax, eax
mov cl, byte [eax + 0x6b4020]
lea eax, [eax + 1]
mov byte [ebp + eax - 0x10d], cl
test cl, cl
jne 0x46ba90
mov esi, ebx
mov al, byte [ebx]
inc ebx
test al, al
jne 0x46baa6
lea edi, [ebp - 0x10c]
sub ebx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x46bab6
mov ecx, ebx
lea eax, [ebp - 0x10c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.005f6ece
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.005d584c
mov esp, ebp
pop ebp
ret
Function at 0x46c7a0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x61a0e0
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x6a8c7c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0
push dword [esi + 0x264]
call dword [sym.imp.USER32.dll_EnableWindow]
push 6
xor eax, eax
mov dword [ebp - 0x2c], 0
push str.lbtext
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x28], 7
mov word [ebp - 0x3c], ax
call fcn.0044e430
push 0
push 0x6ab780
push 0x6ab7b0
push 0
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.00494060
push eax
call fcn.005ef916
mov dword [ebp - 4], 0xffffffff
add esp, 0x14
mov edx, dword [ebp - 0x28]
mov edi, eax
cmp edx, 8
jb 0x46c86a
mov ecx, dword [ebp - 0x3c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x46c860
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46c962
push edx
push ecx
call fcn.005d588d
add esp, 8
test edi, edi
je 0x46c90f
mov ecx, ebx
mov dword [ebp - 0x14], 0
xor eax, eax
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46c890
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x24]
call fcn.0044e430
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 1
push eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x128]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
cmp edx, 8
jb 0x46c8fb
mov ecx, dword [ebp - 0x24]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x46c8f1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46c967
push edx
push ecx
call fcn.005d588d
add esp, 8
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 7
mov word [ebp - 0x24], ax
mov ecx, esi
call fcn.00491510
mov eax, dword [esi]
mov edx, dword [eax + 0x14]
cmp eax, vtable.CMarchMsgDlg.2.0
jne 0x46c96c
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x46c94e
push 1
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.005f564e
call fcn.005f564e
push 1
push 1
mov ecx, esi
call edx
jmp 0x46c94e