joyce8/EMBER2024-capa huggingface dataset:
Function at 0x471080
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5320b0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 0x11], 1
cmp dword [esi + 0x18], ebx
jne 0x4710cc
push 0x5643ec
lea eax, [ebp - 0x12]
push eax
mov byte [ebp - 0x12], bl
call fcn.00520fdb
mov eax, dword [esi + 0x14]
xor ecx, ecx
cmp eax, 0xffffffff
je 0x4710f3
push ebx
push ebx
push ecx
mov ecx, dword [ebp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x47110b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
jmp 0x4710fa
mov dword [esi + 0x10], 0xc
push 0x5643ec
lea edx, [ebp - 0x13]
push edx
mov byte [ebp - 0x13], bl
call fcn.00520fdb
mov eax, dword [esi + 0x14]
mov dword [ebp + 8], ebx
mov dword [ebp - 0x18], ebx
cmp eax, 0xffffffff
je 0x47114e
push ebx
lea ecx, [ebp - 0x18]
push ecx
push 4
lea edx, [ebp + 8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, ebx
jne 0x471138
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
cmp dword [ebp - 0x18], ebx
jne 0x471163
push 0x5643ec
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 0x14], bl
call fcn.00520fdb
mov dword [esi + 0x10], 0xc
jmp 0x47113d
cmp byte [ebp + 0x10], bl
je 0x47116d
mov eax, dword [ebp + 8]
jmp 0x471199
mov ecx, dword [ebp + 8]
mov eax, ecx
mov edx, ecx
shl edx, 0x10
and eax, 0xff00
or eax, edx
mov edx, ecx
sar edx, 0x18
shl eax, 8
and edx, 0xff
sar ecx, 8
or eax, edx
and ecx, 0xff00
or eax, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x473b70
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x533879
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [ebp + 0x10]
push ebx
push ebx
push eax
mov dword [ebp - 4], ebx
push 0x400
mov dword [ebp - 0x10], 1
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov esi, eax
cmp esi, ebx
jg 0x473bd2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
inc esi
cmp esi, ebx
jle 0x473c3a
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0051eb37
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x473c3a
mov ecx, esi
test esi, esi
je 0x473c07
mov edi, edi
mov byte [eax], 0
inc eax
dec ecx
jne 0x473c00
mov eax, dword [ebp + 0x10]
push esi
push ebx
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jle 0x473c26
push ebx
mov eax, edi
call fcn.005080c0
jmp 0x473c31
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
push ebx
call fcn.0051eadb
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x476cb0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x575494]
xor eax, ebp
mov dword [ebp - 4], eax
xor al, al
cmp ecx, 0x200
je 0x476cd2
cmp ecx, 0x300
jne 0x476d12
xor eax, eax
mov word [ebp - 0x38], ax
mov eax, dword [edi + 0x38]
push esi
test eax, eax
je 0x476d03
push 0x19
lea ecx, [ebp - 0x38]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jg 0x476d03
mov edx, dword [edi + 0x34]
push ebx
mov ebx, dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + edi + 0x34], eax
pop ebx
lea eax, [ebp - 0x38]
push eax
lea eax, [edi + 0x48]
call fcn.005080c0
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051eacc
mov esp, ebp
pop ebp
ret
Function at 0x478c10
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [0x575494]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [esi + 0x438], 0
je 0x478cc3
cmp dword [esi + 0x178], 0x9d8
jne 0x478cc3
mov eax, dword [esi + 0x21c]
mov dword [eax + 0x418], 2
mov eax, dword [esi + 0x19c]
xor ecx, ecx
push edi
mov word [ebp - 0x828], cx
test eax, eax
je 0x478c93
push 0x410
lea edx, [ebp - 0x828]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jg 0x478c93
mov eax, dword [esi + 0x198]
push ebx
mov ebx, dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + esi + 0x198], eax
pop ebx
mov edx, dword [esi + 0x21c]
lea ecx, [ebp - 0x828]
push ecx
add edx, 0x41c
push 0x411
push edx
call fcn.0051f8a9
add esp, 0xc
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051eacc
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.00478d30
mov eax, dword [esi + 0x21c]
mov ecx, dword [esi + 0x434]
mov dword [eax + 0x410], ecx
mov eax, dword [esi + 0x428]
test eax, eax
jne 0x478ceb
mov eax, 0x54ee24
mov edx, dword [esi + 0x21c]
push eax
add edx, 0x208
push 0x104
push edx
call fcn.0051f8a9
mov ecx, dword [ebp - 4]
mov eax, dword [esi + 0x21c]
xor ecx, ebp
add esp, 0xc
mov dword [eax + 0x418], 1
call fcn.0051eacc
mov esp, ebp
pop ebp
ret
Function at 0x478d30
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x535676
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x575494]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov esi, ecx
mov word [ebp - 0x218], ax
mov eax, dword [esi + 0xa4]
xor ebx, ebx
mov dword [ebp - 0x23c], esi
mov byte [ebp - 0x219], 0
cmp eax, ebx
je 0x478db1
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, ebx
jg 0x478db1
mov edx, dword [esi + 0xa0]
mov ebx, dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + esi + 0xa0], eax
xor ebx, ebx
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x220], ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
cmp edi, ebx
jle 0x478e2d
mov dword [ebp - 0x248], ebx
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x240], ebx
mov ecx, edi
lea ebx, [ebp - 0x248]
call fcn.00507c00
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
xor ebx, ebx
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x224], edx
mov dword [ebp - 0x220], eax
cmp ecx, ebx
je 0x478e2d
lea edx, [edi + 1]
push edx
lea eax, [ebp - 0x218]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov dword [ebp - 0x224], edi
lea edi, [ebp - 0x228]
mov dword [ebp - 4], ebx
call fcn.00507570
mov ebx, edi
call fcn.005075e0
cmp dword [ebp - 0x224], 0
jle 0x478f02
mov ecx, dword [ebp - 0x228]
test ecx, ecx
jne 0x478e5e
mov ecx, 0x54ee24
lea ebx, [esi + 0x434]
lea eax, [esi + 0x428]
push ebx
lea edi, [esi + 0x1d0]
push ecx
mov esi, eax
mov dword [ebp - 0x238], eax
call fcn.00448fe0
test al, al
je 0x478f23
xor edi, edi
mov dword [ebp - 0x234], edi
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x22c], edi
mov esi, dword [ebp - 0x23c]
mov byte [ebp - 4], 1
mov ecx, dword [esi + 0x21c]
add ecx, 0x208
push ecx
lea eax, [ebp - 0x234]
call fcn.005080c0
mov edx, dword [esi + 0x21c]
mov eax, dword [ebx]
cmp eax, dword [edx + 0x410]
jne 0x478ee2
mov ecx, dword [ebp - 0x238]
lea eax, [ebp - 0x234]
call fcn.00445280
test al, al
je 0x478ee9
mov byte [ebp - 0x219], 1
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x234]
cmp eax, edi
je 0x478f23
push eax
call fcn.0051eadb
add esp, 4
jmp 0x478f23
push 0x54ee24
lea eax, [esi + 0x428]
mov dword [esi + 0x434], 0x11
call fcn.005080c0
mov byte [ebp - 0x219], 1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x228]
test eax, eax
je 0x478f3d
push eax
call fcn.0051eadb
add esp, 4
mov al, byte [ebp - 0x219]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0051eacc
mov esp, ebp
pop ebp
ret
Function at 0x478f60
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
mov eax, dword [esi + 0x98]
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
mov ebx, 6
je 0x47903e
test eax, eax
je 0x478f8b
push 0
push eax
call edi
jmp 0x478f9b
mov eax, dword [esi + 0xa0]
mov ecx, dword [eax + 4]
mov dword [ecx + esi + 0xa0], ebx
mov eax, dword [esi + 0xbc]
test eax, eax
je 0x478fac
push 0
push eax
call edi
jmp 0x478fbc
mov edx, dword [esi + 0xc4]
mov eax, dword [edx + 4]
mov dword [eax + esi + 0xc4], ebx
mov eax, dword [esi + 0x190]
test eax, eax
je 0x478fcd
push 5
push eax
call edi
jmp 0x478fdd
mov ecx, dword [esi + 0x198]
mov edx, dword [ecx + 4]
mov dword [edx + esi + 0x198], ebx
mov eax, dword [esi + 0x1b4]
test eax, eax
je 0x478fee
push 5
push eax
call edi
jmp 0x478ffe
mov eax, dword [esi + 0x1bc]
mov ecx, dword [eax + 4]
mov dword [ecx + esi + 0x1bc], ebx
cmp byte [esi + 0x218], 0
mov edi, dword [sym.imp.USER32.dll_EnableWindow]
je 0x479025
mov eax, dword [esi + 0x50]
test eax, eax
je 0x47901b
push 0
push eax
call edi
jmp 0x479025
mov edx, dword [esi + 0x58]
mov eax, dword [edx + 4]
mov dword [eax + esi + 0x58], ebx
mov eax, dword [esi + 0xf8]
test eax, eax
je 0x4790f8
push 0
push eax
call edi
pop edi
pop ebx
pop ebp
ret 4
test eax, eax
je 0x479049
push 5
push eax
call edi
jmp 0x479059
mov eax, dword [esi + 0xa0]
mov ecx, dword [eax + 4]
mov dword [ecx + esi + 0xa0], ebx
mov eax, dword [esi + 0xbc]
test eax, eax
je 0x47906a
push 5
push eax
call edi
jmp 0x47907a
mov edx, dword [esi + 0xc4]
mov eax, dword [edx + 4]
mov dword [eax + esi + 0xc4], ebx
mov eax, dword [esi + 0x190]
test eax, eax
je 0x47908b
push 0
push eax
call edi
jmp 0x47909b
mov ecx, dword [esi + 0x198]
mov edx, dword [ecx + 4]
mov dword [edx + esi + 0x198], ebx
mov eax, dword [esi + 0x1b4]
test eax, eax
je 0x4790ac
push 0
push eax
call edi
jmp 0x4790bc
mov eax, dword [esi + 0x1bc]
mov ecx, dword [eax + 4]
mov dword [ecx + esi + 0x1bc], ebx
cmp byte [esi + 0x218], 0
mov edi, dword [sym.imp.USER32.dll_EnableWindow]
je 0x4790e3
mov eax, dword [esi + 0x50]
test eax, eax
je 0x4790d9
push 1
push eax
call edi
jmp 0x4790e3
mov edx, dword [esi + 0x58]
mov eax, dword [edx + 4]
mov dword [eax + esi + 0x58], ebx
mov eax, dword [esi + 0xf8]
test eax, eax
je 0x4790f8
push 1
push eax
call edi
pop edi
pop ebx
pop ebp
ret 4
mov ecx, dword [esi + 0x100]
mov edx, dword [ecx + 4]
pop edi
mov dword [edx + esi + 0x100], ebx
pop ebx
pop ebp
ret 4
Function at 0x479880
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x575494]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [esi + 0xe8]
test eax, eax
je 0x4799ca
xor ecx, ecx
push ecx
mov word [ebp - 0x20c], cx
mov edx, dword [eax + 0x208]
push edx
lea eax, [ebp - 0x20c]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp word [ebp - 0x20c], 0
je 0x4798e3
push 0x54ede0
lea ecx, [ebp - 0x20c]
push 0x104
push ecx
call fcn.0052003e
add esp, 0xc
mov edx, dword [esi + 0xe8]
push edi
push edx
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0052003e
mov eax, dword [esi + 0x38]
add esp, 0xc
test eax, eax
je 0x47992c
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
test eax, eax
jne 0x47993a
mov edx, dword [esi + 0x34]
push ebx
mov ebx, dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + esi + 0x34], eax
pop ebx
jmp 0x47993a
mov eax, dword [esi + 0x34]
mov ecx, dword [eax + 4]
mov dword [esi + ecx + 0x34], 0x57
mov edx, dword [esi + 0xe8]
cmp byte [edx + 0x20c], 0
mov eax, dword [esi + 0x98]
pop edi
je 0x479994
test eax, eax
je 0x479972
push 0
push 1
push 0xf1
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051eacc
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x94]
mov ecx, dword [eax + 4]
mov dword [esi + ecx + 0x94], 6
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051eacc
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x4799b6
push 0
push 0
push 0xf1
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051eacc
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 0x94]
mov eax, dword [edx + 4]
mov dword [esi + eax + 0x94], 6
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051eacc
mov esp, ebp
pop ebp
ret
Function at 0x479e60
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x535676
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x575494]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov esi, ecx
mov word [ebp - 0x218], ax
mov eax, dword [esi + 0x38]
xor ebx, ebx
mov dword [ebp - 0x23c], esi
mov byte [ebp - 0x219], 0
cmp eax, ebx
je 0x479ed8
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp eax, ebx
jg 0x479ed8
mov edx, dword [esi + 0x34]
mov ebx, dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + esi + 0x34], eax
xor ebx, ebx
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x220], ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
cmp edi, ebx
jle 0x479f54
mov dword [ebp - 0x248], ebx
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x240], ebx
mov ecx, edi
lea ebx, [ebp - 0x248]
call fcn.00507c00
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
xor ebx, ebx
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x224], edx
mov dword [ebp - 0x220], eax
cmp ecx, ebx
je 0x479f54
lea edx, [edi + 1]
push edx
lea eax, [ebp - 0x218]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov dword [ebp - 0x224], edi
lea edi, [ebp - 0x228]
mov dword [ebp - 4], ebx
call fcn.00507570
mov ebx, edi
call fcn.005075e0
cmp dword [ebp - 0x224], 0
jle 0x47a023
mov ecx, dword [ebp - 0x228]
test ecx, ecx
jne 0x479f85
mov ecx, 0x54ee24
lea ebx, [esi + 0xf8]
lea eax, [esi + 0xec]
push ebx
lea edi, [esi + 0xd0]
push ecx
mov esi, eax
mov dword [ebp - 0x238], eax
call fcn.00448fe0
test al, al
je 0x47a044
xor edi, edi
mov dword [ebp - 0x234], edi
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x22c], edi
mov esi, dword [ebp - 0x23c]
mov byte [ebp - 4], 1
mov ecx, dword [esi + 0xe8]
push ecx
lea eax, [ebp - 0x234]
call fcn.005080c0
mov edx, dword [esi + 0xe8]
mov eax, dword [ebx]
cmp eax, dword [edx + 0x208]
jne 0x47a003
mov ecx, dword [ebp - 0x238]
lea eax, [ebp - 0x234]
call fcn.00445280
test al, al
je 0x47a00a
mov byte [ebp - 0x219], 1
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x234]
cmp eax, edi
je 0x47a044
push eax
call fcn.0051eadb
add esp, 4
jmp 0x47a044
push 0x54ee24
lea eax, [esi + 0xec]
mov dword [esi + 0xf8], 0x11
call fcn.005080c0
mov byte [ebp - 0x219], 1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x228]
test eax, eax
je 0x47a05e
push eax
call fcn.0051eadb
add esp, 4
mov al, byte [ebp - 0x219]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0051eacc
mov esp, ebp
pop ebp
ret
Function at 0x47b340
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi + 0xe4]
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x47b363
test bl, bl
je 0x47b35c
push 5
push eax
call edi
jmp 0x47b377
push 0
push eax
call edi
jmp 0x47b377
mov eax, dword [esi + 0xec]
mov ecx, dword [eax + 4]
mov dword [ecx + esi + 0xec], 6
mov eax, dword [esi + 0x108]
test eax, eax
je 0x47b393
test bl, bl
je 0x47b38c
push 5
push eax
call edi
jmp 0x47b3a7
push 0
push eax
call edi
jmp 0x47b3a7
mov edx, dword [esi + 0x110]
mov eax, dword [edx + 4]
mov dword [eax + esi + 0x110], 6
mov eax, dword [esi + 0x12c]
test eax, eax
je 0x47b3c3
test bl, bl
je 0x47b3bc
push 5
push eax
call edi
jmp 0x47b3d7
push 0
push eax
call edi
jmp 0x47b3d7
mov ecx, dword [esi + 0x134]
mov edx, dword [ecx + 4]
mov dword [edx + esi + 0x134], 6
mov eax, dword [esi + 0x174]
test eax, eax
je 0x47b3f3
test bl, bl
je 0x47b3ec
push 5
push eax
call edi
jmp 0x47b407
push 0
push eax
call edi
jmp 0x47b407
mov eax, dword [esi + 0x17c]
mov ecx, dword [eax + 4]
mov dword [ecx + esi + 0x17c], 6
mov eax, dword [esi + 0x198]
test eax, eax
je 0x47b423
test bl, bl
je 0x47b41c
push 5
push eax
call edi
jmp 0x47b437
push 0
push eax
call edi
jmp 0x47b437
mov edx, dword [esi + 0x1a0]
mov eax, dword [edx + 4]
mov dword [eax + esi + 0x1a0], 6
mov eax, dword [esi + 0x150]
test eax, eax
je 0x47b453
test bl, bl
je 0x47b44c
push 5
push eax
call edi
pop edi
ret
push 0
push eax
call edi
pop edi
ret
mov ecx, dword [esi + 0x158]
mov edx, dword [ecx + 4]
mov dword [edx + esi + 0x158], 6
pop edi
ret

Function at 0x47bb40
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
xor bl, bl
cmp edi, 2
je 0x47bb7f
cmp edi, 0x20
je 0x47bb75
cmp edi, 0x10000
je 0x47bb75
cmp edi, 0x40
je 0x47bb75
cmp edi, 0x20000
je 0x47bb75
cmp edi, 0x100000
je 0x47bb75
cmp edi, 0x200000
jne 0x47bb81
cmp eax, 1
je 0x47bb81
cmp eax, 2
je 0x47bb81
mov bl, 1
push esi
mov esi, dword [ebp + 8]
call fcn.0047b340
cmp edi, 4
je 0x47bb94
cmp edi, 8
jne 0x47bba5
mov ebx, esi
push 1
lea esi, [ebx + 0xb4]
call fcn.004bed50
jmp 0x47bbb5
push 0
add esi, 0xb4
call fcn.004bed50
mov ebx, dword [ebp + 8]
pop esi
cmp edi, 0x40
je 0x47bbc3
cmp edi, 0x20000
jne 0x47bbeb
mov eax, dword [ebx + 0x58]
test eax, eax
je 0x47bbd8
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebx
pop ebp
ret 4
mov eax, dword [ebx + 0x60]
mov ecx, dword [eax + 4]
mov dword [ecx + ebx + 0x60], 6
pop ebx
pop ebp
ret 4
mov eax, dword [ebx + 0x58]
test eax, eax
je 0x47bc00
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebx
pop ebp
ret 4
mov edx, dword [ebx + 0x60]
mov eax, dword [edx + 4]
mov dword [eax + ebx + 0x60], 6
pop ebx
pop ebp
ret 4
Function at 0x47e530
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x535f68
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
add esi, 0x248
mov dword [ebp - 0x10], esi
test ebx, ebx
je 0x47e59e
push 0x7d4
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x47e58a
push 0x7d4
push ebx
mov edi, eax
call fcn.00435080
jmp 0x47e5ae
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + 4]
lea esi, [ecx + esi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
jmp 0x47e5ae
mov edx, dword [esi + 0x10]
mov eax, dword [edx + 4]
lea eax, [eax + esi + 0x10]
mov dword [eax], 0x57
mov esi, dword [ebp + 8]
mov edx, 0x9ca
add esi, 0x2ac
push ebx
lea ecx, [edx - 1]
mov edi, 2
call fcn.004bea70
push 0x9c9
mov ebx, esi
call fcn.004bec70
push 0x9ca
call fcn.004bec70
call fcn.004c7a70
test al, al
je 0x47e754
mov al, byte [ebp + 0x10]
test al, al
je 0x47e609
cmp byte [0x57774c], 0
je 0x47e754
cmp al, 1
jne 0x47e754
push 0x84d3
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, 0x5776a0
call fcn.00471380
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x47e62f
mov ecx, 0x54ee24
mov eax, dword [ebp - 0x10]
call fcn.00405d30
mov edx, dword [0x577698]
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push 1
push 0x138d
add edi, 0x26c
push edx
mov ebx, 3
mov edx, edi
call fcn.004ae810
mov ebx, 0xc35e
mov eax, edi
call fcn.004ae9d0
mov ebx, 0xc35f
mov eax, edi
call fcn.004ae9d0
mov ebx, 0xc360
mov eax, edi
call fcn.004ae9d0
push 0x88c2
lea eax, [ebp - 0x28]
push eax
mov ecx, 0x5776a0
call fcn.00471380
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00508010
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x47e6b4
push eax
call fcn.0051eadb
add esp, 4
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x47e6c0
mov ecx, 0x54ee24
mov eax, 0x9c9
mov ebx, esi
call fcn.004bee10
push 0x88c3
lea ecx, [ebp - 0x28]
push ecx
mov ecx, 0x5776a0
call fcn.00471380
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.00508010
xor ebx, ebx
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x28]
cmp eax, ebx
je 0x47e709
push eax
call fcn.0051eadb
add esp, 4
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov ecx, dword [ebp - 0x1c]
cmp ecx, ebx
jne 0x47e715
mov ecx, 0x54ee24
mov eax, 0x9ca
mov ebx, esi
call fcn.004bee10
mov edi, dword [ebp + 8]
call fcn.00482370
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x47e77e
push eax
call fcn.0051eadb
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 8]
test eax, eax
je 0x47e769
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x47e777
mov edx, dword [ecx + 0x10]
mov eax, dword [edx + 4]
mov dword [eax + ecx + 0x10], 6
push 0
call fcn.004bed50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x47e7a0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x538c58
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x575494]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea esi, [ebx + 0x2d4]
test edi, edi
je 0x47e80b
push 0x7d5
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x47e7f7
push 0x7d5
push edi
mov edi, eax
call fcn.00435080
jmp 0x47e81b
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + 4]
lea edi, [ecx + esi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
jmp 0x47e81b
mov edx, dword [esi + 0x10]
mov eax, dword [edx + 4]
lea eax, [eax + esi + 0x10]
mov dword [eax], 0x57
call fcn.004c78f0
test al, al
je 0x47e8e7
push 0x84d4
lea ecx, [ebp - 0x18]
push ecx
mov ecx, 0x5776a0
call fcn.00471380
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
test ecx, ecx
jne 0x47e84e
mov ecx, 0x54ee24
mov eax, esi
call fcn.00405d30
mov eax, dword [0x577698]
mov ecx, dword [ebp + 0xc]
push 1
lea esi, [ebx + 0x2f8]
push 0x138e
push eax
mov ebx, 1
mov edx, esi
call fcn.004ae810
test al, al
je 0x47e892
mov ebx, 0xc361
mov eax, esi
call fcn.004ae9d0
test al, al
je 0x47e892
mov edx, esi
call fcn.004aea40
mov eax, dword [esi + 8]
test eax, eax
je 0x47e8a4
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x47e8b4
mov edx, dword [esi + 0x10]
mov eax, dword [edx + 4]
lea eax, [eax + esi + 0x10]
mov dword [eax], 6
mov eax, dword [ebp + 8]
call fcn.00482460
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x47e919
push eax
call fcn.0051eadb
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 8]
test eax, eax
je 0x47e90b
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx + 4]
mov dword [edx + esi + 0x10], 6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8