joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46bf44
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff58
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 8]
call fcn.0040ffc8
test eax, eax
je 0x46bfaf
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.0046bda8
mov ebx, eax
test ebx, ebx
je 0x46bfe7
lea edx, [ebp - 0xa8]
mov ecx, 0x10000000
mov eax, dword [ebp - 8]
call fcn.00410040
mov eax, esi
call fcn.00410228
add eax, eax
lea edx, [ebp - 0xa8]
add eax, 2
push eax
push esi
push 1
push 0
push edx
push ebx
call sub.ADVAPI32.DLL_RegSetValueExW
mov eax, ebx
call fcn.0046be54
jmp 0x46bfe7
mov eax, esi
call fcn.00410228
add eax, eax
add eax, 2
push eax
call fcn.00493640
pop ecx
mov ebx, eax
mov ecx, 0x10000000
mov edx, ebx
mov eax, esi
call fcn.0041001c
push ebx
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.0046bef8
push ebx
call fcn.00493468
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x46c0e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
call fcn.0046be0a
mov ebx, eax
mov esi, 1
test ebx, ebx
je 0x46c122
lea eax, [ebp + 8]
lea edx, [ebp - 0xc]
push eax
push edi
push edx
push 0
push dword [ebp - 8]
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov esi, eax
mov eax, ebx
call fcn.0046be54
test esi, esi
jne 0x46c12c
cmp dword [ebp + 8], 0
jne 0x46c13c
push dword [ebp + 0xc]
push edi
call fcn.00494e64
add esp, 8
xor eax, eax
jmp 0x46c13e
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x46c164
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff54
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 0x10]
call fcn.0040ffc8
test eax, eax
je 0x46c1e2
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0046be0a
mov ebx, eax
lea edx, [ebp - 0xac]
mov ecx, 0x10000000
mov eax, dword [ebp - 8]
call fcn.00410040
mov esi, 1
test ebx, ebx
je 0x46c1cd
lea eax, [ebp + 8]
lea edx, [ebp - 0xc]
push eax
push edi
push edx
lea ecx, [ebp - 0xac]
push 0
push ecx
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExW
mov esi, eax
mov eax, ebx
call fcn.0046be54
test esi, esi
jne 0x46c1d7
cmp dword [ebp + 8], 0
ja 0x46c1db
xor ebx, ebx
jmp 0x46c21a
mov ebx, 1
jmp 0x46c21a
mov eax, dword [ebp + 8]
inc eax
push eax
call fcn.00493640
pop ecx
mov esi, eax
push esi
push 0x4a8388
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0046c0e0
mov ebx, eax
mov ecx, dword [ebp + 8]
mov edx, edi
mov eax, esi
call fcn.00410040
push esi
call fcn.00493468
pop ecx
test bl, bl
jne 0x46c228
mov edx, dword [ebp + 0xc]
mov eax, edi
call fcn.0041023c
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x46c234
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
call fcn.0046be0a
mov ebx, eax
mov esi, 1
mov dword [ebp - 0x10], 4
test ebx, ebx
je 0x46c27d
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
push eax
push edi
push edx
push 0
push dword [ebp - 8]
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov esi, eax
mov eax, ebx
call fcn.0046be54
test esi, esi
jne 0x46c287
cmp dword [ebp - 0x10], 0
jne 0x46c290
mov edx, dword [ebp + 8]
xor eax, eax
mov dword [edi], edx
jmp 0x46c292
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x46c2e4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, dword [ebp + 8]
call fcn.0046be0a
mov ebx, eax
mov dword [ebp - 0xc], esi
mov edi, 1
test ebx, ebx
je 0x46c325
lea eax, [ebp - 0xc]
lea edx, [ebp - 8]
push eax
push dword [ebp + 0x10]
push edx
push 0
push dword [ebp - 4]
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov edi, eax
mov eax, ebx
call fcn.0046be54
test edi, edi
jne 0x46c32f
cmp dword [ebp - 0xc], 0
jne 0x46c358
cmp dword [ebp + 0xc], 0
je 0x46c346
push esi
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.00494c74
add esp, 0xc
jmp 0x46c354
push esi
push 0
push dword [ebp + 0x10]
call fcn.00494ce4
add esp, 0xc
xor eax, eax
jmp 0x46c35b
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x46c374
Capabilities:
Delete registry key

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, eax
mov eax, ebx
push 0x100
lea ecx, [esp + 4]
call fcn.0046be70
test al, al
je 0x46c398
push esp
push ebx
call sub.ADVAPI32.DLL_RegDeleteKeyA
add esp, 0x100
pop ebx
ret

Function at 0x46c3b0
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, ecx
mov ebx, eax
mov eax, ebx
push 0x100
lea ecx, [esp + 8]
call fcn.0046be70
test al, al
je 0x46c3f9
push esp
push 0x20006
push 0
lea edx, [esp + 0x10]
push edx
push ebx
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x46c3f9
push esi
push dword [esp + 4]
call sub.ADVAPI32.DLL_RegDeleteValueA
mov eax, dword [esp]
call fcn.0046be54
add esp, 0x104
pop esi
pop ebx
ret
Function at 0x46e038
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push 0x4ab624
push 1
push 0
push 0x4ab654
call sub.OLE32.DLL_CoCreateInstance
test eax, eax
jl 0x46e103
push edi
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x50]
test esi, esi
je 0x46e084
push esi
mov eax, dword [ebp - 8]
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
cmp dword [ebp + 0xc], 0
je 0x46e098
push 0
push dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x44]
cmp dword [ebp + 8], 0
je 0x46e0aa
push dword [ebp + 8]
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x2c]
lea eax, [ebp - 0xc]
push eax
push 0x4ab684
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx]
test eax, eax
jl 0x46e0fa
push 0x104
lea eax, [ebp - 0x214]
push eax
push 0xffffffffffffffff
push dword [ebp - 4]
push 0
push 0
call sub.KERNEL32.DLL_MultiByteToWideChar
push 1
lea edx, [ebp - 0x214]
push edx
mov ecx, dword [ebp - 0xc]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x18]
test eax, eax
jl 0x46e0f1
mov bl, 1
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x46e110
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
push esp
call sub.SHELL32.DLL_SHGetMalloc
lea eax, [esp + 4]
push eax
push 0x10
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push ebx
push dword [esp + 8]
call sub.SHELL32.DLL_SHGetPathFromIDListA
push dword [esp + 4]
mov edx, dword [esp + 4]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x14]
pop ecx
pop edx
pop ebx
ret

Function at 0x46e148
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
push ebx
add esp, 0xffffffe0
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x46e15d
xor eax, eax
jmp 0x46e19b
push ebx
call fcn.00494e94
pop ecx
mov byte [ebx + eax + 1], 0
push 0x1e
push 0
lea edx, [esp + 8]
push edx
call fcn.00494ce4
add esp, 0xc
mov dword [esp + 4], 3
mov word [esp + 0x10], 0x14
mov dword [esp + 8], ebx
push esp
call sub.SHELL32.DLL_SHFileOperationA
test eax, eax
sete al
and eax, 1
add esp, 0x20
pop ebx
ret

Function at 0x46e748
Capabilities:
Create directory

Disassembly:
push ebx
push esi
add esp, 0xfffffc00
mov esi, edx
mov ebx, eax
mov eax, esp
mov edx, 0x400
call fcn.0046eb74
mov eax, esp
call fcn.0040bf64
push ebx
lea edx, [esp + 4]
push edx
call fcn.00494d88
add esp, 8
mov eax, esp
call fcn.0040aa88
test eax, eax
je 0x46e790
push 0
lea edx, [esp + 4]
push edx
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
jne 0x46e7b2
push esp
mov eax, 0x1f7
call fcn.0041202c
push eax
call fcn.0044e3e0
add esp, 8
mov eax, 0x4af020
call fcn.0042cfac
xor eax, eax
jmp 0x46e7be
push esp
push esi
call fcn.00494e64
add esp, 8
mov al, 1
add esp, 0x400
pop esi
pop ebx
ret
Function at 0x46e880
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffac
mov edi, ecx
mov esi, edx
mov ebx, eax
push 0x44
push 0
lea eax, [esp + 8]
push eax
call fcn.00494ce4
add esp, 0xc
mov dword [esp], 0x44
lea edx, [esp + 0x44]
push edx
lea ecx, [esp + 4]
push ecx
push esi
push 0
push 0
push 0
push 0
push 0
push ebx
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
je 0x46e8e9
test edi, edi
je 0x46e8d3
push edi
push dword [esp + 0x48]
call sub.KERNEL32.DLL_WaitForSingleObject
push dword [esp + 0x48]
call sub.KERNEL32.DLL_CloseHandle
push dword [esp + 0x44]
call sub.KERNEL32.DLL_CloseHandle
mov al, 1
jmp 0x46e8eb
xor eax, eax
add esp, 0x54
pop edi
pop esi
pop ebx
ret

Function at 0x46e9a8
Capabilities:
Capture screenshot

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd8
mov dword [esp], eax
call sub.USER32.DLL_GetDesktopWindow
mov ebp, eax
push ebp
call sub.USER32.DLL_GetDC
mov edi, eax
push edi
call sub.GDI32.DLL_CreateCompatibleDC
mov ebx, eax
push edi
call sub.GDI32.DLL_CreateCompatibleDC
mov esi, eax
lea eax, [esp + 0x10]
push eax
push 0x18
push dword [esp + 8]
call sub.GDI32.DLL_GetObjectA
push dword [esp + 0x18]
push dword [esp + 0x18]
push edi
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [esp + 4], eax
push dword [esp]
push ebx
call sub.GDI32.DLL_SelectObject
mov dword [esp + 8], eax
push dword [esp + 4]
push esi
call sub.GDI32.DLL_SelectObject
mov dword [esp + 0xc], eax
push 0xcc0020
mov edx, dword [esp + 0x1c]
push edx
mov eax, dword [esp + 0x1c]
mov ecx, eax
neg ecx
push ecx
mov ecx, eax
dec ecx
push 0
push ecx
push ebx
push edx
push eax
push 0
push 0
push esi
call sub.GDI32.DLL_StretchBlt
push 0xcc0020
push 0
push 0
push esi
push dword [esp + 0x28]
push dword [esp + 0x28]
push 0
push 0
push ebx
call sub.GDI32.DLL_BitBlt
push dword [esp + 8]
push ebx
call sub.GDI32.DLL_SelectObject
push dword [esp + 0xc]
push esi
call sub.GDI32.DLL_SelectObject
push dword [esp + 4]
call sub.GDI32.DLL_DeleteObject
push ebx
call sub.GDI32.DLL_DeleteDC
push esi
call sub.GDI32.DLL_DeleteDC
push edi
push ebp
call sub.USER32.DLL_ReleaseDC
add esp, 0x28
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x46eb74
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable

Disassembly:
push ebx
push esi
add esp, 0xfffffc00
mov esi, edx
mov ebx, eax
mov eax, 0x4a8c99
push 0x4a8c87
push esi
mov ecx, ebx
mov edx, 0x4a8c9f
call fcn.0046c0c4
mov byte [esp], 0
cmp byte [ebx], 0
je 0x46ebcb
push 0x400
lea eax, [esp + 4]
push eax
push ebx
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
test eax, eax
je 0x46ebcb
lea edx, [esi - 1]
push edx
lea ecx, [esp + 4]
push ecx
push ebx
call fcn.00495044
add esp, 0xc
mov byte [ebx + esi - 1], 0
cmp byte [ebx], 0
je 0x46ebdb
push ebx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x46ebf9
push ebx
push esi
call sub.KERNEL32.DLL_GetTempPathA
test eax, eax
je 0x46ebeb
cmp byte [ebx], 0
jne 0x46ebf9
push 0x4a8caa
push ebx
call fcn.00494e64
add esp, 8
mov eax, ebx
call fcn.0040bf64
add esp, 0x400
pop esi
pop ebx
ret
Function at 0x46ed3c
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [esp + 0x10], 2
jne 0x46ed6b
cmp dword [esp + 4], 5
ja 0x46ed6f
cmp dword [esp + 4], 5
jne 0x46ed6b
cmp dword [esp + 8], 0
ja 0x46ed6f
xor eax, eax
jmp 0x46ed74
mov eax, 1
add esp, 0x94
ret

Function at 0x46f370
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 3
add esp, 0xfffff004
push eax
dec eax
jne 0x46f379
mov eax, dword [ebp - 4]
add esp, 0xfffffaf4
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x2454], edx
mov edi, eax
mov eax, 0x4a8d94
call fcn.00495294
call fcn.0049d288
mov dword [ebp - 0x2458], eax
xor ebx, ebx
mov word [ebp - 0x2440], 8
push 0
push 0
lea eax, [ebp - 0x242c]
mov ecx, dword [ebp - 0x2454]
mov edx, edi
call fcn.00412cdc
inc dword [ebp - 0x2434]
mov word [ebp - 0x2440], 0x14
lea eax, [ebp - 0x28fc]
call fcn.004137a4
lea eax, [ebp - 0x28d0]
call fcn.004137a4
lea eax, [ebp - 0x28a4]
call fcn.004137a4
inc dword [0x4c4ce8]
jmp 0x46f49d
test bl, bl
jne 0x46f433
call fcn.0049d288
sub eax, dword [ebp - 0x2458]
cmp eax, 0x3e8
jle 0x46f433
push 0
xor ecx, ecx
xor edx, edx
mov eax, 5
call fcn.0047cca0
mov bl, 1
test bl, bl
je 0x46f447
lea eax, [ebp - 0x3510]
call fcn.0047e8a0
call fcn.0047dd2c
call fcn.004483d0
cmp byte [ebp + 0x14], 0
je 0x46f467
lea eax, [ebp - 0x3510]
call fcn.0040ba60
lea edx, [ebp - 0x3510]
cmp eax, edx
jne 0x46f46b
xor eax, eax
jmp 0x46f470
mov eax, 1
mov word [ebp - 0x2440], 0x14
push esi
push eax
mov dl, byte [ebp + 0x10]
lea eax, [ebp - 0x3510]
push edx
lea edx, [ebp - 0x3110]
mov cl, byte [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x3510]
push dword [ebp + 8]
call fcn.0046f540
lea edx, [ebp - 0x3510]
lea eax, [ebp - 0x242c]
call fcn.00412e10
test eax, eax
jne 0x46f4bf
cmp dword [0x4c4cf0], 0
je 0x46f40b
dec dword [0x4c4ce8]
mov eax, dword [0x4c4cf0]
test eax, eax
sete dl
and edx, 1
mov byte [ebp - 0x2459], dl
mov word [ebp - 0x2440], 0x14
test eax, eax
je 0x46f4f6
mov eax, esi
call fcn.0046b718
xor edx, edx
mov dword [0x4c4cf0], edx
jmp 0x46f4fd
mov eax, esi
call fcn.0046ba2c
test bl, bl
je 0x46f50c
push dword [0x4c234c]
call sub.USER32.DLL_DestroyWindow
mov al, byte [ebp - 0x2459]
mov edx, 2
push eax
lea eax, [ebp - 0x242c]
dec dword [ebp - 0x2434]
call fcn.00412db4
pop eax
mov edx, dword [ebp - 0x2450]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4702c5
Capabilities:
Check for time delay via gettickcount
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
push 0x1000000
call fcn.00493640
pop ecx
mov edi, eax
test edi, edi
jne 0x4702e8
mov eax, 1
xor edx, edx
jmp 0x47037b
mov dword [esp], 0
mov dword [esp + 4], 0
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 8], eax
xor ebx, ebx
mov esi, 0x800000
jmp 0x47033f
mov eax, 0x10000
and esi, 0xffffff
and ebx, 0xffffff
mov dl, byte [edi + esi]
mov byte [edi + ebx], dl
sub ebx, 0x100
xor byte [edi + esi], dl
sub esi, 0x100
dec eax
test eax, eax
jg 0x47030e
dec ebx
dec esi
add dword [esp], 1
adc dword [esp + 4], 0
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [esp + 8]
cmp eax, 0xc8
jb 0x470309
push edi
call fcn.00493468
pop ecx
push 0
push 0x64
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.0049936c
add eax, 1
adc edx, 0
mov dword [esp], eax
mov dword [esp + 4], edx
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x474930
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffff6cc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov ebx, dword [ebp + 0x10]
lea esi, [ebp - 0x44]
push 0x3c
push 0
push esi
call fcn.00494ce4
add esp, 0xc
mov dword [esi], 0x3c
mov dword [esi + 4], 0x500
test bl, bl
jne 0x474973
or dword [esi + 4], 0x40
mov dword [esi + 0x10], edi
cmp dword [ebp + 8], 0
je 0x474984
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
jmp 0x4749a8
lea edx, [ebp - 0x94]
mov ecx, 0x50
mov eax, dword [esi + 0x10]
call fcn.004733a8
test al, al
je 0x4749a3
lea edx, [ebp - 0x94]
jmp 0x4749a5
xor edx, edx
mov dword [esi + 0xc], edx
mov eax, dword [ebp - 8]
mov dword [esi + 0x18], eax
mov eax, edi
mov ecx, dword [ebp + 0x14]
mov dword [esi + 0x14], ecx
call fcn.0040ba60
cmp edi, eax
jne 0x4749dd
push edi
push 0x4a91c0
lea edx, [ebp - 0x894]
push edx
call fcn.00497dc4
add esp, 0xc
lea ecx, [ebp - 0x894]
mov dword [esi + 0x10], ecx
mov dword [esi + 0x1c], 1
call fcn.0040ffc8
test eax, eax
je 0x474aa8
mov eax, dword [ebp - 4]
call fcn.0040edb0
cmp word [eax], 0
je 0x474aa8
xor edi, edi
push 0x4a91c5
call sub.KERNEL32.DLL_GetModuleHandleA
test eax, eax
je 0x474a20
push 0x4a91d1
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov edi, eax
test edi, edi
jne 0x474a2b
xor eax, eax
jmp 0x474b5e
mov edx, dword [ebp - 4]
mov dword [esi + 0x10], edx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x474a51
lea edx, [ebp - 0x934]
mov ecx, 0x10000000
call fcn.00410040
lea edx, [ebp - 0x934]
mov dword [esi + 0xc], edx
cmp dword [ebp - 8], 0
je 0x474a73
lea edx, [ebp - 0x1134]
mov ecx, 0x10000000
mov eax, dword [ebp - 8]
call fcn.00410040
lea eax, [ebp - 0x1134]
mov dword [esi + 0x18], eax
cmp dword [ebp + 0x14], 0
je 0x474a95
lea edx, [ebp - 0x1934]
mov ecx, 0x10000000
mov eax, dword [ebp + 0x14]
call fcn.00410040
lea edx, [ebp - 0x1934]
mov dword [esi + 0x14], edx
mov byte [0x4c4cec], 1
push esi
call edi
mov byte [0x4c4cec], 0
jmp 0x474abc
mov byte [0x4c4cec], 1
push esi
call sub.SHELL32.DLL_ShellExecuteExA
mov byte [0x4c4cec], 0
test eax, eax
je 0x474acc
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x483
jne 0x474ad3
xor eax, eax
jmp 0x474b5e
test bl, bl
jne 0x474b5c
mov eax, dword [esi + 0x38]
test eax, eax
je 0x474b1b
mov edx, dword [0x4a9194]
mov dword [edx*4 + 0x4caa14], eax
mov ecx, dword [0x4a9194]
mov eax, dword [esi + 0x20]
mov dword [ecx*4 + 0x4caa54], eax
mov edx, dword [0x4a9194]
inc edx
and edx, 0x8000000f
jns 0x474b13
dec edx
or edx, 0xfffffff0
inc edx
mov dword [0x4a9194], edx
jmp 0x474b4e
xor ebx, ebx
mov eax, dword [ebx*4 + 0x4caa54]
cmp eax, dword [esi + 0x20]
jne 0x474b48
push 0
push dword [ebx*4 + 0x4caa14]
call sub.KERNEL32.DLL_WaitForSingleObject
cmp eax, 0x102
jne 0x474b48
mov edx, dword [ebx*4 + 0x4caa14]
mov dword [esi + 0x38], edx
inc ebx
cmp ebx, 0x10
jl 0x474b1d
cmp dword [ebp + 0xc], 0
je 0x474b5c
mov ecx, dword [ebp + 0xc]
mov eax, dword [esi + 0x38]
mov dword [ecx], eax
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x475df0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
push 0x4c4d04
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x475e27
push 0x40
mov eax, 0x2bc
call fcn.0041202c
push eax
mov eax, 0x2bd
call fcn.0041202c
push eax
push dword [0x4c2340]
call sub.USER32.DLL_MessageBoxA
pop ebx
ret
push 0
mov edx, 0x4c4d04
xor ecx, ecx
mov eax, ebx
call fcn.00475040
pop ebx
ret

Function at 0x475e3c
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffff004
push eax
add esp, 0xfffffb64
mov esi, ecx
mov ebx, edx
push 0
push 0
xor edx, edx
mov eax, ebx
call fcn.00474154
test al, al
je 0x475e88
push 0x30
mov eax, 0x65
call fcn.0041202c
push eax
mov eax, 0x596
call fcn.0041202c
push eax
push dword [0x4c2340]
call sub.USER32.DLL_MessageBoxA
jmp 0x476046
cmp dword [0x4c4ce0], 0
jne 0x475ec5
push 0
push 1
push 0
push 0
xor ecx, ecx
mov edx, esi
mov eax, ebx
call fcn.00474930
test al, al
jne 0x476046
push ebx
mov eax, 0x201
call fcn.0041202c
push eax
call fcn.0044e3e0
add esp, 8
jmp 0x476046
mov edx, esp
mov eax, 0x4a932f
call fcn.0046e748
test al, al
je 0x476046
lea edx, [esp + 0x400]
push edx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push esp
call fcn.004967f8
pop ecx
lea edx, [esp + 0x800]
mov eax, 0x4c309c
call fcn.004626b8
call fcn.00456d34
mov ecx, 0x4bb1b4
mov edx, 0x4badb4
mov eax, 0x4c309c
call fcn.00462684
mov ecx, dword [esp + 0x810]
mov dword [0x4b996c], ecx
mov edx, 0x4a91be
mov eax, dword [0x4bb9b4]
call fcn.0040f77c
call fcn.00457894
mov eax, 0x4c309c
xor ecx, ecx
xor edx, edx
call fcn.0045d68c
cmp dword [0x4c4cf4], 0
jne 0x476046
lea edx, [esp + 0x89c]
mov eax, ebx
call fcn.0040bb70
lea edx, [esp + 0xc9c]
mov eax, esi
call fcn.0040bc98
lea edx, [esp + 0x89c]
lea eax, [esp + 0x89c]
call fcn.0040a9a4
lea edx, [esp + 0xc9c]
lea eax, [esp + 0xc9c]
call fcn.0040a9ec
push 0x200c
push 0
push 0x4cecbc
call fcn.00494ce4
add esp, 0xc
lea ecx, [esp + 0x89c]
push ecx
push 0x4cf8c5
call fcn.00494e64
add esp, 8
mov eax, 0x4cfcc6
lea edx, [esp + 0xc9c]
call fcn.0041023c
push 0x4badb4
push 0x4cecc0
call fcn.00494e64
add esp, 8
mov edx, 0x4bb1b4
mov eax, 0x4cf0c0
call fcn.0041023c
push esp
push 0x4d04c6
call fcn.00494e64
add esp, 8
lea ecx, [esp + 0x400]
push ecx
call fcn.004967f8
pop ecx
mov eax, dword [0x4b996c]
cmp dword [esp + 0x88c], 0
setne dl
push 0x4cecbc
and edx, 1
mov dword [0x4cf8c0], eax
push 0x10000
push 0x4741b8
mov byte [0x4cf8c4], dl
call fcn.0049d108
add esp, 0xc
add esp, 0x149c
pop esi
pop ebx
ret
Function at 0x47cb1e
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
push eax
push dword [0x4c234c]
call sub.USER32.DLL_GetDlgItem
mov ebx, eax
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push ebx
call sub.USER32.DLL_GetWindowTextA
push esp
push esi
call fcn.00494e18
add esp, 8
test eax, eax
je 0x47cb5b
push esi
push ebx
call sub.USER32.DLL_SetWindowTextA
add esp, 0x200
pop esi
pop ebx
ret
Function at 0x47dd2c
Capabilities:
Get graphical window text

Disassembly:
add esp, 0xfffffe00
mov eax, dword [0x4c234c]
test eax, eax
je 0x47ddd9
push pe_nt_image_headers32
lea edx, [esp + 4]
push edx
push eax
call sub.USER32.DLL_GetWindowTextA
cmp dword [0x4d0e7c], 8
je 0x47dd7e
push 0x4d0e80
lea ecx, [esp + 4]
push ecx
call fcn.00494e18
add esp, 8
test eax, eax
je 0x47dd7e
push 0x4d0e80
push dword [0x4c234c]
call sub.USER32.DLL_SetWindowTextA
mov eax, dword [0x4d0e7c]
test eax, eax
je 0x47dd96
cmp eax, 1
je 0x47dd96
cmp eax, 2
je 0x47dd96
cmp eax, 8
jne 0x47ddbb
mov edx, 0x4d0f00
mov eax, 0x9c
call fcn.0047cb1e
mov eax, 0x4d0f80
call fcn.0040ba60
mov edx, eax
mov eax, 0x9b
call fcn.0047cb1e
mov edx, 0x64
mov eax, 2
call fcn.00448d18
test al, al
je 0x47ddd9
push dword [0x4c234c]
call sub.USER32.DLL_UpdateWindow
add esp, 0x200
ret