joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42c54c
Capabilities:
Delete registry key

Disassembly:
sub esp, 4
push ecx
push edx
push esi
mov esi, 0
lea ecx, [esp + 0xc]
push ecx
push eax
push 0x80000000
call sub.ADVAPI32.dll_RegOpenKeyA
cmp eax, 0
jne 0x42c589
push ebx
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegDeleteKeyA
cmp eax, 0
jne 0x42c580
mov esi, 1
push dword [esp + 0xc]
call sub.ADVAPI32.dll_RegCloseKey
mov eax, esi
pop esi
pop edx
pop ecx
add esp, 4
ret

Function at 0x42c594
Capabilities:
Set registry value

Disassembly:
sub esp, 4
push ecx
push edx
push esi
push edi
mov edi, ecx
mov esi, 0
lea ecx, [esp + 0x10]
push ecx
push eax
push 0x80000000
call sub.ADVAPI32.dll_RegCreateKeyA
cmp eax, 0
jne 0x42c5df
mov eax, edi
call fcn.0042c788
push eax
push edi
push 1
push ebx
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegSetValueA
cmp eax, 0
jne 0x42c5d6
mov esi, 1
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegCloseKey
mov eax, esi
pop edi
pop esi
pop edx
pop ecx
add esp, 4
ret

Function at 0x42c5ec
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ecx
push edx
push esi
push edi
push ebp
mov edi, ecx
mov ebp, edx
mov esi, 0
lea ecx, [esp + 0x14]
push ecx
push eax
push 0x80000000
call sub.ADVAPI32.dll_RegOpenKeyA
cmp eax, 0
jne 0x42c646
mov dword [esp + 0x18], ebp
lea eax, [esp + 0x18]
push eax
push edi
push ebx
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegQueryValueA
jmp 0x42c631
cmp dword [esp + 0x18], 0
jne 0x42c638
jmp 0x42c63d
cmp eax, 0
je 0x42c628
jmp 0x42c63d
mov esi, 1
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
mov eax, esi
pop ebp
pop edi
pop esi
pop edx
pop ecx
add esp, 8
ret

Function at 0x42cccc
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x24
push ebx
push ecx
push edx
push esi
push edi
push ebp
mov ebp, eax
mov dword [esp + 0x18], ecx
mov esi, edx
push 0x1c
lea eax, [esp + 0x24]
push eax
push ebp
call sub.KERNEL32.dll_VirtualQuery
cmp eax, 0
jne 0x42ccf9
mov eax, 0
jmp 0x42cd8c
mov edi, dword [esp + 0x24]
cmp edi, 0
jne 0x42cd0c
mov eax, 0
jmp 0x42cd8c
push dword [esp + 0x18]
push ebx
push edi
call sub.KERNEL32.dll_GetModuleFileNameA
cmp eax, 0
je 0x42cd02
mov eax, edi
mov ebx, edi
mov eax, dword [eax + 0x3c]
add ebx, eax
mov dword [esp + 0x1c], ebx
mov eax, ebx
mov ecx, 0
lea ecx, [ecx + 0x18]
add eax, ecx
movzx ebx, word [ebx + 0x14]
add eax, ebx
sub ebp, edi
mov edx, 0
mov ebx, dword [esp + 0x1c]
movzx ebx, word [ebx + 6]
cmp edx, ebx
jae 0x42cd87
mov ebx, dword [eax + 0xc]
mov ecx, dword [eax + 8]
cmp dword [eax + 0x10], ecx
jbe 0x42cd76
mov ecx, dword [eax + 0x10]
jmp 0x42cd79
cmp ebp, edi
jbe 0x42cd64
jmp 0x42cd81
inc edx
mov dword [esi], edx
sub ebp, ebx
mov eax, dword [esp + 0x40]
mov dword [eax], ebp
mov eax, 1
jmp 0x42cd8c
mov ecx, dword [eax + 8]
mov edi, ebx
add edi, ecx
cmp ebp, ebx
jae 0x42cd5e
inc edx
add eax, 0x28
jmp 0x42cd42
mov eax, 0
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
add esp, 0x24
ret 4
Function at 0x432678
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push ebx
push ecx
push edx
push esi
push edi
push ebp
mov esi, eax
jmp 0x4326a1
push dword [0x5203ec]
call sub.USER32.dll_IsWindow
cmp eax, 0
jne 0x432697
jmp 0x4326aa
mov eax, 1
jmp 0x432860
cmp dword [0x5203ec], 0
jne 0x432685
mov eax, 0x18
mov bl, byte [eax + str.Clarion_VBX_Server_V1.00]
mov byte [esp + eax + 0x53], bl
sub eax, 1
jae 0x4326af
mov eax, 0x14
mov bl, byte [eax + str.Auxilary_VBX_Control]
mov byte [esp + eax + 0x3e], bl
sub eax, 1
jae 0x4326c3
mov eax, 8
mov bl, byte [eax + str.DDE_Data]
mov byte [esp + eax + 0x35], bl
sub eax, 1
jae 0x4326d7
mov eax, 8
mov bx, word [eax + str.DDE_Event]
mov word [esp + eax + 0x2b], bx
sub eax, 2
jae 0x4326eb
mov eax, 0xa
mov bl, byte [eax + str.DDE_Change]
mov byte [esp + eax + 0x20], bl
sub eax, 1
jae 0x432701
lea eax, [esp + 0x53]
push eax
call sub.KERNEL32.dll_GlobalAddAtomA
mov bx, ax
lea eax, [esp + 0x3e]
push eax
call sub.KERNEL32.dll_GlobalAddAtomA
mov dword [esi + 0x40], 1
movzx ebp, bx
mov ebx, ebp
movzx edi, ax
mov eax, edi
shl eax, 0x10
or ebx, eax
mov dword [esp + 0x1c], ebx
push ebx
mov eax, dword [esi]
push eax
push 0x3e0
push 0xffff
call sub.USER32.dll_SendMessageA
mov eax, esi
mov ebx, 0x3e8
call fcn.004328f4
cmp dword [esi + 0x40], 2
jne 0x4327a0
lea eax, [esp + 0x35]
push eax
call sub.KERNEL32.dll_GlobalAddAtomA
mov word [0x5203f0], ax
lea eax, [esp + 0x2b]
push eax
call sub.KERNEL32.dll_GlobalAddAtomA
mov word [0x5203f4], ax
lea eax, [esp + 0x20]
push eax
call sub.KERNEL32.dll_GlobalAddAtomA
mov word [0x5203f8], ax
mov eax, 1
jmp 0x432860
push 0
push str.CWVBX32.EXE
call sub.KERNEL32.dll_WinExec
cmp eax, 0x20
jae 0x4327c7
push ebp
call sub.KERNEL32.dll_GlobalDeleteAtom
push edi
call sub.KERNEL32.dll_GlobalDeleteAtom
mov eax, 0
jmp 0x432860
mov dword [esp + 0x18], 0x14
jmp 0x43280c
mov eax, dword [esp + 0x18]
dec eax
mov dword [esp + 0x18], eax
inc eax
cmp eax, 0
jne 0x4327e2
jmp 0x432812
mov dword [esi + 0x40], 1
mov eax, dword [esp + 0x1c]
push eax
mov eax, dword [esi]
push eax
push 0x3e0
push 0xffff
call sub.USER32.dll_SendMessageA
mov eax, esi
mov ebx, 0x1f4
call fcn.004328f4
cmp dword [esi + 0x40], 2
jne 0x4327d1
cmp dword [esi + 0x40], 2
jne 0x43284f
lea eax, [esp + 0x35]
push eax
call sub.KERNEL32.dll_GlobalAddAtomA
mov word [0x5203f0], ax
lea eax, [esp + 0x2b]
push eax
call sub.KERNEL32.dll_GlobalAddAtomA
mov word [0x5203f4], ax
lea eax, [esp + 0x20]
push eax
call sub.KERNEL32.dll_GlobalAddAtomA
mov word [0x5203f8], ax
mov eax, 1
jmp 0x432860
push ebp
call sub.KERNEL32.dll_GlobalDeleteAtom
push edi
call sub.KERNEL32.dll_GlobalDeleteAtom
mov eax, 0
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
add esp, 0x54
ret
Function at 0x43286c
Capabilities:
Hide graphical window

Disassembly:
push ecx
push edx
push esi
mov esi, eax
cmp byte [0x5203fc], 0
jne 0x432881
mov byte [0x5203fc], 1
cmp ebx, 0
je 0x43288d
mov eax, 0x40000000
jmp 0x432892
mov eax, 0x80000000
push 0
mov ecx, dword [esi + 4]
push ecx
push 0
push ebx
push 0
push 0
push 0
push 0
push eax
push str.Clarion_VBX_Client
push str.DdeClient
push 0
call sub.USER32.dll_CreateWindowExA
mov dword [esi], eax
movzx eax, si
push eax
push str.lo_this
mov eax, dword [esi]
push eax
call sub.USER32.dll_SetPropA
mov eax, esi
shr eax, 0x10
and ax, 0xffff
movzx eax, ax
push eax
push str.hi_this
mov eax, dword [esi]
push eax
call sub.USER32.dll_SetPropA
push 0
mov eax, dword [esi]
push eax
call sub.USER32.dll_ShowWindow
mov eax, dword [esi]
pop esi
pop edx
pop ecx
ret

Function at 0x4328f4
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x1c
pushal
mov edi, eax
call sub.KERNEL32.dll_GetTickCount
mov esi, eax
call sub.KERNEL32.dll_GetTickCount
sub eax, esi
cmp eax, ebx
jae 0x432932
push 1
push 0x3e8
push 0x3e0
mov eax, dword [edi]
push eax
lea ebp, [esp + 0x30]
push ebp
call sub.USER32.dll_PeekMessageA
cmp eax, 0
je 0x432901
push ebp
call sub.USER32.dll_DispatchMessageA
jmp 0x432939
mov dword [edi + 0x40], 0x32
popal
add esp, 0x1c
ret
Function at 0x439968
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0xc
push ebx
push ecx
push edx
push esi
mov esi, eax
mov eax, dword [esi + 0x77]
and eax, 1
cmp eax, 0
je 0x439a28
mov eax, dword [esi + 0xb4]
cmp eax, 3
jne 0x4399d7
lea edx, [esp + 0x10]
mov eax, edx
call fcn.00514a14
mov eax, edx
lea ebx, [esi + 0xb4]
mov ecx, 0
call fcn.0043926c
mov eax, edx
call fcn.00514444
mov ebx, dword [esi + 0xe9]
mov ebx, dword [esi + 0xe9]
mov eax, dword [ebx]
call dword [eax + 0x24]
mov eax, edx
call fcn.00514a2c
jmp 0x439a4c
cmp dword [esi + 0xb8], 3
je 0x4399e5
jmp 0x4399fd
cmp eax, 1
jne 0x4399f8
cmp dword [esi + 0xb8], 2
jne 0x4399cc
mov eax, dword [esi + 0xe9]
lea ebx, [esi + 0xb4]
call fcn.00438d80
jmp 0x439a51
cmp eax, 4
jne 0x439a10
mov eax, dword [esi + 0xe9]
lea ebx, [esi + 0xb4]
call fcn.00438d34
jmp 0x439a51
cmp eax, 2
jne 0x439a4c
mov eax, dword [esi + 0xe9]
lea ebx, [esi + 0xb4]
call fcn.00438cc0
jmp 0x439a51
mov eax, 0x520448
push eax
push 0x258
push 0xd
mov eax, dword [esi + 0x5b]
push eax
call sub.USER32.dll_SendMessageA
mov eax, esi
mov ebx, 0x520448
call fcn.00437eb0
jmp 0x439a51
mov eax, 0
pop esi
pop edx
pop ecx
pop ebx
add esp, 0xc
ret
Function at 0x44d4c4
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0xe8
pushal
mov ebp, eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ecx
push 0x64
lea esi, [esp + 0x34]
push esi
mov eax, dword [ebx + 0x5b]
push eax
call sub.USER32.dll_GetClassNameA
push 0x64
lea edi, [esp + 0x98]
push edi
mov eax, dword [ebx + 0x5b]
push eax
call sub.USER32.dll_GetWindowTextA
lea eax, [esp + 0xf8]
push eax
mov eax, dword [ebx + 0x5b]
push eax
call sub.USER32.dll_GetWindowRect
mov eax, dword [ebx + 0x5b]
push eax
call sub.USER32.dll_GetParent
mov dword [esp + 0x24], eax
cmp dword [esp + 0x20], 0
jne 0x44d527
mov ecx, dword [0x59c2d0]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0xf8]
push ecx
push eax
call sub.USER32.dll_ScreenToClient
lea eax, [esp + 0x100]
push eax
push dword [esp + 0x28]
call sub.USER32.dll_ScreenToClient
push 0xfffffffffffffff0
mov eax, dword [ebx + 0x5b]
push eax
call sub.USER32.dll_GetWindowLongA
mov ebx, eax
mov dword [esp + 0x2c], 0
mov eax, ebx
and eax, 0x40000000
cmp eax, 0
je 0x44d573
mov eax, dword [ebp + 8]
add eax, 0x4000
mov dword [esp + 0x2c], eax
push 0xffffffffffffffec
mov eax, dword [esp + 0x2c]
mov eax, dword [eax + 0x5b]
push eax
call sub.USER32.dll_GetWindowLongA
push ebp
push dword [0x5d5cac]
push dword [esp + 0x34]
push dword [esp + 0x2c]
mov ecx, dword [esp + 0x114]
sub ecx, dword [esp + 0x10c]
push ecx
mov ecx, dword [esp + 0x114]
sub ecx, dword [esp + 0x10c]
push ecx
push dword [esp + 0x114]
push dword [esp + 0x114]
push ebx
push edi
push esi
push eax
call sub.USER32.dll_CreateWindowExA
mov dword [ebp + 0x5b], eax
mov eax, dword [esp + 0x100]
mov ebx, dword [esp + 0x104]
call fcn.0044c388
mov eax, ebp
mov ebx, 1
call fcn.0044d46c
popal
add esp, 0xe8
ret
Function at 0x450918
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
mov esi, eax
mov eax, ecx
call fcn.00474d30
cmp eax, 0
setne al
movzx edx, al
mov eax, ebx
cmp eax, 0x7c59
jne 0x4509ac
mov edi, dword [esi + 0xc]
mov ebx, esi
mov ecx, 0x200
call fcn.00510fa0
jmp 0x450957
mov eax, esi
call fcn.0044c99c
cmp eax, 0
jne 0x450968
jmp 0x4509a2
mov eax, dword [esi + 0xc]
xor eax, edi
and eax, 0x200
cmp eax, 0
jne 0x450949
jmp 0x4509a2
mov eax, dword [esi + 0xc]
and eax, 0x200
cmp eax, 0
je 0x45098c
push 0x57
push 0
push 0
push 0
push 0
push 0
mov eax, dword [esi + 0x5b]
push eax
call sub.USER32.dll_SetWindowPos
jmp 0x450997
push 0
mov eax, dword [esi + 0x5b]
push eax
call sub.USER32.dll_ShowWindow
mov eax, esi
mov ebx, dword [eax + 4]
call dword [ebx + 0xa4]
mov eax, 1
jmp 0x450a30
cmp eax, 0x7ce0
je 0x4509c1
cmp eax, 0x7ce5
je 0x4509c1
cmp eax, 0x7ce4
jne 0x4509df
mov eax, esi
add eax, 0x88
call fcn.0045ef0c
mov eax, esi
mov ebx, dword [eax + 4]
call dword [ebx + 0xa4]
mov eax, 1
jmp 0x450a30
cmp eax, 0x7c5f
jne 0x4509f8
mov eax, esi
call fcn.0044c984
cmp eax, 0
sete al
movzx eax, al
jmp 0x450a10
cmp eax, 0x7c88
jne 0x450a1b
mov eax, dword [esi + 0xc]
and eax, 0x1000
cmp eax, 0
setne al
movzx eax, al
cmp eax, edx
je 0x450a1b
mov eax, esi
call fcn.0045058c
mov eax, esi
call fcn.0044e21c
mov edx, eax
mov eax, esi
add eax, 0x77
call fcn.0044c800
mov eax, edx
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
Function at 0x45146c
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 4
pushal
mov esi, eax
mov dword [esp + 0x20], esi
cmp ebx, 0xd
je 0x451485
cmp ebx, 0x1b
je 0x451485
cmp ebx, 9
jne 0x451491
mov eax, esi
call fcn.0044ab84
jmp 0x451662
cmp ebx, 0x2d
jne 0x4514bc
mov eax, dword [esi + 0x77]
and eax, 0x20
cmp eax, 0
jne 0x451662
cmp dword [0x59c3e4], 0
sete al
movzx eax, al
mov dword [0x59c3e4], eax
jmp 0x451662
cmp ebx, 0x24
jne 0x4514f2
mov eax, esi
mov ebx, 0
call fcn.00451730
push 0x10
call sub.USER32.dll_GetKeyState
mov bx, ax
mov eax, esi
cmp bx, 0
setl bl
movzx ecx, bl
mov ebx, 0
call fcn.00435fd0
jmp 0x451662
cmp ebx, 0x23
jne 0x45152e
mov eax, esi
mov ebx, 0x7fffffff
call fcn.00451730
push 0x10
call sub.USER32.dll_GetKeyState
mov cx, ax
mov eax, esi
movsx ebx, word [esi + 0x84]
cmp cx, 0
setl al
movzx ecx, al
mov eax, dword [esp + 0x20]
call fcn.00435fd0
jmp 0x451662
cmp ebx, 0x25
jne 0x4515be
push 0x11
call sub.USER32.dll_GetKeyState
cmp ax, 0
jge 0x45158f
movsx ebx, word [esi + 0x8e]
jmp 0x451567
mov ecx, dword [esi + 0x80]
mov eax, ebx
movzx eax, byte [ecx + eax - 1]
call fcn.004606a0
cmp eax, 0
jne 0x451566
jmp 0x451588
dec ebx
cmp ebx, 0
jg 0x45154d
jmp 0x451588
mov ecx, dword [esi + 0x80]
mov eax, ebx
movzx eax, byte [ecx + eax - 1]
call fcn.004606a0
cmp eax, 0
je 0x451587
jmp 0x451597
dec ebx
cmp ebx, 0
jg 0x45156e
jmp 0x451597
movsx ebx, word [esi + 0x8e]
dec ebx
mov eax, esi
call fcn.00451730
push 0x10
call sub.USER32.dll_GetKeyState
mov cx, ax
mov eax, esi
cmp cx, 0
setl cl
movzx ecx, cl
call fcn.00435fd0
jmp 0x451662
cmp ebx, 0x27
jne 0x451625
push 0x11
call sub.USER32.dll_GetKeyState
cmp ax, 0
jge 0x451638
movsx ebx, word [esi + 0x8e]
jmp 0x4515f2
mov ecx, dword [esi + 0x80]
mov eax, ebx
movzx eax, byte [ecx + eax]
call fcn.004606a0
cmp eax, 0
je 0x4515f1
jmp 0x451618
inc ebx
movsx eax, word [esi + 0x84]
cmp ebx, eax
jl 0x4515d9
jmp 0x451618
mov ecx, dword [esi + 0x80]
mov eax, ebx
movzx eax, byte [ecx + eax]
call fcn.004606a0
cmp eax, 0
jne 0x451617
jmp 0x451640
inc ebx
movsx eax, word [esi + 0x84]
cmp ebx, eax
jl 0x4515ff
jmp 0x451640
cmp ebx, 0x2e
jne 0x451662
mov eax, esi
mov ebx, 0x7f
call fcn.004511a8
jmp 0x451676
movsx ebx, word [esi + 0x8e]
inc ebx
mov eax, esi
call fcn.00451730
push 0x10
call sub.USER32.dll_GetKeyState
mov cx, ax
mov eax, esi
cmp cx, 0
setl cl
movzx ecx, cl
call fcn.00435fd0
mov eax, dword [esi + 0xc]
and eax, 0x800
cmp eax, 0
je 0x451676
mov eax, esi
call fcn.00435f68
popal
add esp, 4
ret
Function at 0x4590a8
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 4
pushal
mov esi, eax
mov dword [esp + 0x20], esi
jmp 0x4590c3
push 0x11
call sub.USER32.dll_GetKeyState
cmp ax, 0
jl 0x4590ca
jmp 0x4590e3
cmp ebx, 9
je 0x4590b4
jmp 0x4590e3
push 0x10
call sub.USER32.dll_GetKeyState
cmp ax, 0
jge 0x4590de
mov ebx, 0x25
jmp 0x4590e3
mov ebx, 0x27
cmp ebx, 0x25
jne 0x459130
mov eax, esi
mov ebx, dword [esi + 0x9c]
mov eax, dword [esp + 0x20]
mov ecx, 0xffffffff
mov edx, 1
call fcn.00458368
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x459166
cmp esi, 0
jne 0x459113
mov eax, esi
jmp 0x459118
mov eax, esi
add eax, 0x77
mov ebx, dword [eax + 4]
mov eax, esi
mov ecx, 0xffffffff
mov edx, 1
call fcn.00458368
mov ebx, eax
jmp 0x459166
cmp ebx, 0x27
jne 0x45918e
cmp dword [esi + 0x9c], 0xffffffff
jne 0x459149
mov eax, esi
call fcn.0045ae80
mov ebx, eax
jmp 0x459166
mov eax, esi
mov ebx, dword [esi + 0x9c]
mov eax, dword [esp + 0x20]
mov ecx, 1
mov edx, 1
call fcn.00458368
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x459174
mov eax, esi
call fcn.0045ae80
mov ebx, eax
mov eax, esi
call fcn.00459284
mov eax, esi
mov ecx, 1
call fcn.004592f8
mov eax, esi
call fcn.0045ac00
popal
add esp, 4
ret

Function at 0x45c958
Capabilities:
Get graphical window text

Disassembly:
pushal
mov esi, eax
push 0
push 0
push 0xb8
mov eax, dword [esi + 0x5b]
push eax
call sub.USER32.dll_SendMessageA
cmp eax, 0
je 0x45c9d4
or dword [esi + 0x83], 1
push 0
push 0
push 0xe
mov eax, dword [esi + 0x5b]
push eax
call sub.USER32.dll_SendMessageA
mov ebx, eax
mov ecx, ebx
inc ecx
mov eax, ecx
call fcn.004dbf88
mov edi, eax
mov eax, edi
push eax
push ecx
push 0xd
mov eax, dword [esi + 0x5b]
push eax
call sub.USER32.dll_SendMessageA
push 0
push 0
push 0xb9
mov eax, dword [esi + 0x5b]
push eax
call sub.USER32.dll_SendMessageA
mov ecx, ebx
mov ebx, edi
mov eax, dword [esi + 0x3b]
mov eax, dword [eax]
call fcn.00504120
mov eax, dword [esi + 0x3b]
call fcn.0045ea90
mov eax, edi
call fcn.004dbf80
popal
ret

Function at 0x45ce50
Capabilities:
Get graphical window text

Disassembly:
sub esp, 8
pushal
mov edi, eax
call sub.KERNEL32.dll_GetCurrentThreadId
mov ebx, eax
push 0
mov eax, dword [edi + 0x5b]
push eax
call sub.USER32.dll_GetWindowThreadProcessId
cmp ebx, eax
je 0x45ce7b
mov eax, 0x21e
mov ebx, str.CTLTEXT
call fcn.0051a1f0
mov eax, dword [edi + 0x5b]
push eax
call sub.USER32.dll_GetWindowTextLengthA
mov ebx, eax
inc ebx
mov eax, ebx
call fcn.004dbf88
mov esi, eax
push ebx
push esi
mov eax, dword [edi + 0x5b]
push eax
call sub.USER32.dll_GetWindowTextA
push 0xfffffffffffffff0
mov eax, dword [edi + 0x5b]
push eax
call sub.USER32.dll_GetWindowLongA
mov edx, eax
or edx, 0x800000
or edx, 0x1000
or edx, 4
mov eax, edi
lea ebx, [esp + 0x24]
lea ecx, [esp + 0x20]
call fcn.0045ce0c
mov eax, edi
mov ebx, edx
mov edx, esi
mov ecx, dword [0x5209ec]
call fcn.0044ac2c
mov eax, edi
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
call fcn.0045ce24
mov eax, esi
call fcn.004dbf80
popal
add esp, 8
ret
Function at 0x45d840
Capabilities:
Hide graphical window

Disassembly:
push ecx
push edx
push esi
mov esi, eax
cmp dword [esi], 2
jne 0x45d855
push 0
mov eax, dword [esi + 4]
push eax
call sub.USER32.dll_ShowWindow
mov dword [esi], 0
cmp ebx, 0
je 0x45d867
mov eax, esi
call fcn.0045dbb4
pop esi
pop edx
pop ecx
ret
Function at 0x4685b0
Capabilities:
Check for software breakpoints

Disassembly:
sub esp, 4
push ebx
push ecx
push edx
push esi
push edi
push ebp
mov esi, eax
mov dword [esp + 0x18], esi
cmp dword [esi + 9], 0xcc
je 0x4685e4
mov eax, esi
mov ebx, dword [esi + 0x16b]
mov eax, dword [esp + 0x18]
call dword [ebx]
mov dword [esi + 0x66], 0
mov dword [esi + 9], 0xcc
mov eax, dword [esi + 0x16b]
cmp byte [eax + 8], 0
je 0x468646
mov eax, dword [esi + 0x4e]
cmp dword [esi + 0x66], eax
jae 0x468620
mov edi, dword [esi + 0x66]
mov eax, esi
lea ecx, [esi + 0x66]
mov ebp, dword [esi + 0x16f]
mov eax, dword [esp + 0x18]
mov ebx, 0
mov edx, 0
call dword [ebp + 4]
cmp dword [esi + 0x66], edi
jne 0x4685f0
mov al, 0
jmp 0x46865d
mov eax, esi
mov ebx, dword [esi + 0x16b]
mov eax, dword [esp + 0x18]
call dword [ebx + 4]
mov eax, esi
mov ebx, dword [esi + 0x16b]
mov eax, dword [esp + 0x18]
call dword [ebx]
mov dword [esi + 0x66], 0
jmp 0x4685e4
cmp byte [esi + 0x36], 0
je 0x468653
mov eax, 0xce
jmp 0x468658
mov eax, 0xcd
mov dword [esi + 9], eax
mov al, 1
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
add esp, 4
ret

Function at 0x468668
Capabilities:
Check for software breakpoints

Disassembly:
sub esp, 4
push ebx
push ecx
mov ecx, eax
mov dword [esp + 8], ecx
cmp dword [ecx + 9], 0xca
jne 0x46869b
mov eax, ecx
call fcn.0046d150
cmp byte [ecx + 0x35], 0
je 0x468694
mov dword [ecx + 9], 0xcf
mov al, 1
jmp 0x4686ee
mov dword [ecx + 9], 0xcb
cmp dword [ecx + 9], 0xcb
jne 0x4686d4
mov eax, dword [ecx + 0x17b]
cmp byte [eax + 0x10], 0
je 0x4686cc
mov eax, ecx
mov ebx, dword [ecx + 0x17b]
mov eax, dword [esp + 8]
call dword [ebx]
cmp eax, 0
jne 0x4686c7
mov al, 0
jmp 0x4686ee
cmp eax, 2
jne 0x4686b0
mov eax, dword [ecx + 0x6a]
mov dword [ecx + 0x72], eax
jmp 0x4686e7
cmp dword [ecx + 9], 0xcc
je 0x4686e7
mov eax, ecx
mov ebx, dword [ecx]
mov eax, dword [esp + 8]
call dword [ebx]
mov eax, ecx
call fcn.004685b0
pop ecx
pop ebx
add esp, 4
ret
Function at 0x475c0c
Capabilities:
Packed with generic packer

Disassembly:
sub esp, 0x34
pushal
mov esi, eax
mov dword [esp + 0x20], ebx
mov eax, dword [esi + 0xc]
mov eax, dword [eax + 0x2a7]
mov dword [esp + 0x28], eax
mov edi, dword [esp + 0x28]
cmp edi, 0
je 0x475c3c
mov eax, esi
mov ebx, edi
mov ecx, str.Number_of_rows_effected_by
mov dl, 1
call fcn.0047cc4c
mov ebp, dword [esp + 0x20]
push ebp
mov eax, dword [esi + 4]
push eax
call dword [0x59f9b4]
mov bx, ax
mov eax, esi
call fcn.0047cd04
cmp edi, 0
je 0x475e0a
mov dword [esp + 0x24], str._was
mov edx, edi
mov dword [esp + 0x30], edx
mov eax, edx
mov ebx, 0
mov ecx, 2
call fcn.0051a48c
mov ecx, dword [esp + 0x24]
cmp ecx, 0
je 0x475c91
mov eax, ecx
call fcn.00420750
mov ebx, eax
jmp 0x475c96
mov ebx, 0
mov eax, edx
lea edx, [esp + 0x34]
call fcn.0051a40c
cmp byte [0x59f994], 0
je 0x475cb3
push dword [esp + 0x30]
call sub.KERNEL32.dll_FlushFileBuffers
call fcn.0040fbf0
mov dword [0x52169c], eax
mov eax, dword [ebp]
mov ebp, edi
lea edx, [esp + 0x38]
mov ebx, edx
mov ecx, 0xa
call fcn.0047499c
mov eax, ebp
mov ebx, 0
mov ecx, 2
call fcn.0051a48c
cmp edx, 0
je 0x475cf3
mov eax, edx
call fcn.00420750
mov ebx, eax
jmp 0x475cf8
mov ebx, 0
mov eax, ebp
mov ecx, edx
lea edx, [esp + 0x4c]
call fcn.0051a40c
cmp byte [0x59f994], 0
je 0x475d14
push ebp
call sub.KERNEL32.dll_FlushFileBuffers
call fcn.0040fbf0
mov dword [0x52169c], eax
mov edx, 0x59ec48
call fcn.0040fbf0
sub eax, dword [0x52169c]
mov dword [esp + 0x2c], eax
mov eax, edi
mov ebx, 0
mov ecx, 2
call fcn.0051a48c
cmp edx, 0
je 0x475d53
mov eax, edx
call fcn.00420750
mov ebx, eax
jmp 0x475d58
mov ebx, 0
mov eax, edi
mov ecx, edx
lea ebp, [esp + 0x50]
mov edx, ebp
call fcn.0051a40c
mov eax, edi
mov edx, ebp
mov ebx, 0xc
mov ecx, str._Time_Taken:
call fcn.0051a40c
mov eax, dword [esp + 0x2c]
mov ebx, 0x64
cdq
idiv ebx
push edx
push eax
push str._ld._02ld_secs
push 0x5218a0
call fcn.004dbfa0
add esp, 0x10
mov eax, edi
mov ebx, 0
mov ecx, 2
call fcn.0051a48c
mov eax, 0x5218a0
cmp eax, 0
je 0x475dd5
mov eax, 0x5218a0
call fcn.00420750
mov ebx, eax
jmp 0x475dda
mov eax, dword [esi + 0xc]
cmp dword [eax + 0x2d2], 2
je 0x475c23
jmp 0x475e10
mov ebx, 0
mov eax, edi
mov edx, ebp
mov ecx, 0x5218a0
call fcn.0051a40c
mov eax, edi
mov edx, ebp
mov ebx, 2
mov ecx, 0x59eae4
call fcn.0051a40c
cmp byte [0x59f994], 0
je 0x475e0a
push edi
call sub.KERNEL32.dll_FlushFileBuffers
cmp byte [esi + 0x14], 0
jne 0x475dc3
popal
add esp, 0x34
ret