joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4656ac
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff58
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 8]
call fcn.0040f8f0
test eax, eax
je 0x465717
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00465515
mov ebx, eax
test ebx, ebx
je 0x46574f
lea edx, [ebp - 0xa8]
mov ecx, 0x10000000
mov eax, dword [ebp - 8]
call fcn.0040f968
mov eax, esi
call fcn.0040f9e4
add eax, eax
lea edx, [ebp - 0xa8]
add eax, 2
push eax
push esi
push 1
push 0
push edx
push ebx
call sub.ADVAPI32.DLL_RegSetValueExW
mov eax, ebx
call fcn.004655bb
jmp 0x46574f
mov eax, esi
call fcn.0040f9e4
add eax, eax
add eax, 2
push eax
call fcn.0048bc00
pop ecx
mov ebx, eax
mov ecx, 0x10000000
mov edx, ebx
mov eax, esi
call fcn.0040f944
push ebx
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00465660
push ebx
call fcn.0048ba28
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x465848
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
call fcn.00465571
mov ebx, eax
mov esi, 1
test ebx, ebx
je 0x46588a
lea eax, [ebp + 8]
lea edx, [ebp - 0xc]
push eax
push edi
push edx
push 0
push dword [ebp - 8]
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov esi, eax
mov eax, ebx
call fcn.004655bb
test esi, esi
je 0x46589e
push dword [ebp + 0xc]
push edi
call fcn.0048d424
add esp, 8
xor eax, eax
jmp 0x4658a0
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4658c8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff54
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 0x10]
call fcn.0040f8f0
test eax, eax
je 0x46593b
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00465571
mov ebx, eax
lea edx, [ebp - 0xac]
mov ecx, 0x10000000
mov eax, dword [ebp - 8]
call fcn.0040f968
mov esi, 1
test ebx, ebx
je 0x465931
lea eax, [ebp + 8]
lea edx, [ebp - 0xc]
push eax
push edi
push edx
lea ecx, [ebp - 0xac]
push 0
push ecx
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExW
mov esi, eax
mov eax, ebx
call fcn.004655bb
test esi, esi
sete bl
and ebx, 1
jmp 0x465973
mov eax, dword [ebp + 8]
inc eax
push eax
call fcn.0048bc00
pop ecx
mov esi, eax
push esi
push 0x49fd10
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00465848
mov ebx, eax
mov ecx, dword [ebp + 8]
mov edx, edi
mov eax, esi
call fcn.0040f968
push esi
call fcn.0048ba28
pop ecx
test bl, bl
jne 0x465981
mov edx, dword [ebp + 0xc]
mov eax, edi
call fcn.0040f9f8
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x46598c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
call fcn.00465571
mov ebx, eax
mov esi, 1
mov dword [ebp - 0x10], 4
test ebx, ebx
je 0x4659d5
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
push eax
push edi
push edx
push 0
push dword [ebp - 8]
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov esi, eax
mov eax, ebx
call fcn.004655bb
test esi, esi
je 0x4659e2
mov edx, dword [ebp + 8]
xor eax, eax
mov dword [edi], edx
jmp 0x4659e4
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x465a38
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, dword [ebp + 8]
call fcn.00465571
mov ebx, eax
mov dword [ebp - 0xc], esi
mov edi, 1
test ebx, ebx
je 0x465a79
lea eax, [ebp - 0xc]
lea edx, [ebp - 8]
push eax
push dword [ebp + 0x10]
push edx
push 0
push dword [ebp - 4]
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov edi, eax
mov eax, ebx
call fcn.004655bb
test edi, edi
je 0x465aa6
cmp dword [ebp + 0xc], 0
je 0x465a94
push esi
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.0048d234
add esp, 0xc
jmp 0x465aa2
push esi
push 0
push dword [ebp + 0x10]
call fcn.0048d2a4
add esp, 0xc
xor eax, eax
jmp 0x465aa9
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x465ac4
Capabilities:
Delete registry key

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, eax
mov eax, ebx
push 0x100
lea ecx, [esp + 4]
call fcn.004655d7
test al, al
je 0x465ae8
push esp
push ebx
call sub.ADVAPI32.DLL_RegDeleteKeyA
add esp, 0x100
pop ebx
ret

Function at 0x465b00
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, ecx
mov ebx, eax
mov eax, ebx
push 0x100
lea ecx, [esp + 8]
call fcn.004655d7
test al, al
je 0x465b49
push esp
push 0x20006
push 0
lea edx, [esp + 0x10]
push edx
push ebx
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x465b49
push esi
push dword [esp + 4]
call sub.ADVAPI32.DLL_RegDeleteValueA
mov eax, dword [esp]
call fcn.004655bb
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x465d1c
Capabilities:
Get common file path

Disassembly:
add esp, 0xfffff800
push 0x400
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x49ffdb
lea eax, [esp + 4]
call fcn.0040b590
push eax
call fcn.0048d424
add esp, 8
mov ecx, 0x49fe83
mov edx, 0x49ffe6
mov eax, CreateStatusWindowA
push esp
call fcn.00465660
lea edx, [esp + 0x400]
push edx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea ecx, [esp + 0x400]
mov edx, 0x49ffe6
push ecx
mov ecx, 0x4a0025
mov eax, CreateStatusWindowA
call fcn.00465660
add esp, 0x800
ret
Function at 0x4674a8
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push 0x4a2f80
push 1
push 0
push 0x4a2fb0
call sub.OLE32.DLL_CoCreateInstance
test eax, eax
jl 0x467573
push edi
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x50]
test esi, esi
je 0x4674f4
push esi
mov eax, dword [ebp - 8]
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
cmp dword [ebp + 0xc], 0
je 0x467508
push 0
push dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x44]
cmp dword [ebp + 8], 0
je 0x46751a
push dword [ebp + 8]
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x2c]
lea eax, [ebp - 0xc]
push eax
push 0x4a2fe0
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx]
test eax, eax
jl 0x46756a
push 0x104
lea eax, [ebp - 0x214]
push eax
push 0xffffffffffffffff
push dword [ebp - 4]
push 0
push 0
call sub.KERNEL32.DLL_MultiByteToWideChar
push 1
lea edx, [ebp - 0x214]
push edx
mov ecx, dword [ebp - 0xc]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x18]
test eax, eax
jl 0x467561
mov bl, 1
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x467580
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
push esp
call sub.SHELL32.DLL_SHGetMalloc
lea eax, [esp + 4]
push eax
push 0x10
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push ebx
push dword [esp + 8]
call sub.SHELL32.DLL_SHGetPathFromIDListA
push dword [esp + 4]
mov edx, dword [esp + 4]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x14]
pop ecx
pop edx
pop ebx
ret

Function at 0x4675b8
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
push ebx
add esp, 0xffffffe0
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x4675cd
xor eax, eax
jmp 0x46760b
push ebx
call fcn.0048d454
pop ecx
mov byte [ebx + eax + 1], 0
push 0x1e
push 0
lea edx, [esp + 8]
push edx
call fcn.0048d2a4
add esp, 0xc
mov dword [esp + 4], 3
mov word [esp + 0x10], 0x14
mov dword [esp + 8], ebx
push esp
call sub.SHELL32.DLL_SHFileOperationA
test eax, eax
sete al
and eax, 1
add esp, 0x20
pop ebx
ret

Function at 0x467b38
Capabilities:
Create directory

Disassembly:
push ebx
push esi
add esp, 0xfffffc00
mov esi, edx
mov ebx, eax
mov eax, esp
mov edx, 0x400
call fcn.00467f64
mov eax, esp
call fcn.0040ba78
push ebx
lea edx, [esp + 4]
push edx
call fcn.0048d348
add esp, 8
mov eax, esp
call fcn.0040a664
test eax, eax
je 0x467b80
push 0
lea edx, [esp + 4]
push edx
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
jne 0x467ba2
push esp
mov eax, 0x1f7
call fcn.004117b8
push eax
call fcn.0044a23c
add esp, 8
mov eax, 0x4a697c
call fcn.0042997c
xor eax, eax
jmp 0x467bae
push esp
push esi
call fcn.0048d424
add esp, 8
mov al, 1
add esp, 0x400
pop esi
pop ebx
ret
Function at 0x467c70
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffac
mov edi, ecx
mov esi, edx
mov ebx, eax
push 0x44
push 0
lea eax, [esp + 8]
push eax
call fcn.0048d2a4
add esp, 0xc
mov dword [esp], 0x44
lea edx, [esp + 0x44]
push edx
lea ecx, [esp + 4]
push ecx
push esi
push 0
push 0
push 0
push 0
push 0
push ebx
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
je 0x467cd9
test edi, edi
je 0x467cc3
push edi
push dword [esp + 0x48]
call sub.KERNEL32.DLL_WaitForSingleObject
push dword [esp + 0x48]
call sub.KERNEL32.DLL_CloseHandle
push dword [esp + 0x44]
call sub.KERNEL32.DLL_CloseHandle
mov al, 1
jmp 0x467cdb
xor eax, eax
add esp, 0x54
pop edi
pop esi
pop ebx
ret

Function at 0x467d98
Capabilities:
Capture screenshot

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd8
mov dword [esp], eax
call sub.USER32.DLL_GetDesktopWindow
mov ebp, eax
push ebp
call sub.USER32.DLL_GetDC
mov edi, eax
push edi
call sub.GDI32.DLL_CreateCompatibleDC
mov ebx, eax
push edi
call sub.GDI32.DLL_CreateCompatibleDC
mov esi, eax
lea eax, [esp + 0x10]
push eax
push 0x18
push dword [esp + 8]
call sub.GDI32.DLL_GetObjectA
push dword [esp + 0x18]
push dword [esp + 0x18]
push edi
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [esp + 4], eax
push dword [esp]
push ebx
call sub.GDI32.DLL_SelectObject
mov dword [esp + 8], eax
push dword [esp + 4]
push esi
call sub.GDI32.DLL_SelectObject
mov dword [esp + 0xc], eax
push 0xcc0020
mov edx, dword [esp + 0x1c]
push edx
mov eax, dword [esp + 0x1c]
mov ecx, eax
neg ecx
push ecx
mov ecx, eax
dec ecx
push 0
push ecx
push ebx
push edx
push eax
push 0
push 0
push esi
call sub.GDI32.DLL_StretchBlt
push 0xcc0020
push 0
push 0
push esi
push dword [esp + 0x28]
push dword [esp + 0x28]
push 0
push 0
push ebx
call sub.GDI32.DLL_BitBlt
push dword [esp + 8]
push ebx
call sub.GDI32.DLL_SelectObject
push dword [esp + 0xc]
push esi
call sub.GDI32.DLL_SelectObject
push dword [esp + 4]
call sub.GDI32.DLL_DeleteObject
push ebx
call sub.GDI32.DLL_DeleteDC
push esi
call sub.GDI32.DLL_DeleteDC
push edi
push ebp
call sub.USER32.DLL_ReleaseDC
add esp, 0x28
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x467f64
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
push 0x4a069c
push esi
mov edx, 0x4a06b4
mov eax, 0x4a06ae
mov ecx, ebx
call fcn.0046582c
cmp byte [ebx], 0
je 0x467f91
push ebx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x467faf
push ebx
push esi
call sub.KERNEL32.DLL_GetTempPathA
test eax, eax
je 0x467fa1
cmp byte [ebx], 0
jne 0x467faf
push 0x4a06bf
push ebx
call fcn.0048d424
add esp, 8
mov eax, ebx
call fcn.0040ba78
pop esi
pop ebx
ret

Function at 0x4680ec
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [esp + 0x10], 2
jne 0x46811b
cmp dword [esp + 4], 5
ja 0x46811f
cmp dword [esp + 4], 5
jne 0x46811b
cmp dword [esp + 8], 0
ja 0x46811f
xor eax, eax
jmp 0x468124
mov eax, 1
add esp, 0x94
ret
Function at 0x4686b8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 3
add esp, 0xfffff004
push eax
dec eax
jne 0x4686c1
mov eax, dword [ebp - 4]
add esp, 0xfffffaf4
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x2454], edx
mov edi, eax
mov eax, 0x4a079c
call fcn.0048d8c4
call fcn.004957b8
mov dword [ebp - 0x2458], eax
xor ebx, ebx
mov word [ebp - 0x2440], 8
push 0
push 0
lea eax, [ebp - 0x242c]
mov ecx, dword [ebp - 0x2454]
mov edx, edi
call fcn.00412404
inc dword [ebp - 0x2434]
mov word [ebp - 0x2440], 0x14
lea eax, [ebp - 0x28fc]
call fcn.00412ecc
lea eax, [ebp - 0x28d0]
call fcn.00412ecc
lea eax, [ebp - 0x28a4]
call fcn.00412ecc
inc dword [0x4bc1a8]
jmp 0x4687e5
test bl, bl
jne 0x46877b
call fcn.004957b8
sub eax, dword [ebp - 0x2458]
cmp eax, 0x3e8
jle 0x46877b
push 0
xor ecx, ecx
xor edx, edx
mov eax, 5
call fcn.00475ac0
mov bl, 1
test bl, bl
je 0x46878f
lea eax, [ebp - 0x3510]
call fcn.004775c4
call fcn.00476b3c
call fcn.00444324
cmp byte [ebp + 0x14], 0
je 0x4687af
lea eax, [ebp - 0x3510]
call fcn.0040b590
lea edx, [ebp - 0x3510]
cmp eax, edx
jne 0x4687b3
xor eax, eax
jmp 0x4687b8
mov eax, 1
mov word [ebp - 0x2440], 0x14
push esi
push eax
mov dl, byte [ebp + 0x10]
lea eax, [ebp - 0x3510]
push edx
lea edx, [ebp - 0x3110]
mov cl, byte [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x3510]
push dword [ebp + 8]
call fcn.00468888
lea edx, [ebp - 0x3510]
lea eax, [ebp - 0x242c]
call fcn.00412538
test eax, eax
jne 0x468807
cmp dword [0x4bc1ac], 0
je 0x468753
dec dword [0x4bc1a8]
mov eax, dword [0x4bc1ac]
test eax, eax
sete dl
and edx, 1
mov byte [ebp - 0x2459], dl
mov word [ebp - 0x2440], 0x14
test eax, eax
je 0x46883e
mov eax, esi
call fcn.00464ea4
xor edx, edx
mov dword [0x4bc1ac], edx
jmp 0x468845
mov eax, esi
call fcn.004651b8
test bl, bl
je 0x468854
push dword [0x4b9824]
call sub.USER32.DLL_DestroyWindow
mov al, byte [ebp - 0x2459]
mov edx, 2
push eax
lea eax, [ebp - 0x242c]
dec dword [ebp - 0x2434]
call fcn.004124dc
pop eax
mov edx, dword [ebp - 0x2450]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4695db
Capabilities:
Check for time delay via gettickcount
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
push 0x1000000
call fcn.0048bc00
pop ecx
mov edi, eax
test edi, edi
jne 0x4695fe
mov eax, 1
xor edx, edx
jmp 0x469691
mov dword [esp], 0
mov dword [esp + 4], 0
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 8], eax
xor ebx, ebx
mov esi, 0x800000
jmp 0x469655
mov eax, 0x10000
and esi, 0xffffff
and ebx, 0xffffff
mov dl, byte [edi + esi]
mov byte [edi + ebx], dl
sub ebx, 0x100
xor byte [edi + esi], dl
sub esi, 0x100
dec eax
test eax, eax
jg 0x469624
dec ebx
dec esi
add dword [esp], 1
adc dword [esp + 4], 0
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [esp + 8]
cmp eax, 0xc8
jb 0x46961f
push edi
call fcn.0048ba28
pop ecx
push 0
push 0x64
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.0049189c
add eax, 1
adc edx, 0
mov dword [esp], eax
mov dword [esp + 4], edx
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x46d9d4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffff6cc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov ebx, dword [ebp + 0x10]
lea esi, [ebp - 0x44]
push 0x3c
push 0
push esi
call fcn.0048d2a4
add esp, 0xc
mov dword [esi], 0x3c
mov dword [esi + 4], 0x500
test bl, bl
jne 0x46da17
or dword [esi + 4], 0x40
mov dword [esi + 0x10], edi
cmp dword [ebp + 8], 0
je 0x46da28
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
jmp 0x46da4c
lea edx, [ebp - 0x94]
mov ecx, 0x50
mov eax, dword [esi + 0x10]
call fcn.0046c614
test al, al
je 0x46da47
lea edx, [ebp - 0x94]
jmp 0x46da49
xor edx, edx
mov dword [esi + 0xc], edx
mov eax, dword [ebp - 8]
mov dword [esi + 0x18], eax
mov eax, edi
mov ecx, dword [ebp + 0x14]
mov dword [esi + 0x14], ecx
call fcn.0040b590
cmp edi, eax
jne 0x46da81
push edi
push 0x4a0bc8
lea edx, [ebp - 0x894]
push edx
call fcn.004902f4
add esp, 0xc
lea ecx, [ebp - 0x894]
mov dword [esi + 0x10], ecx
mov dword [esi + 0x1c], 1
call fcn.0040f8f0
test eax, eax
je 0x46db3e
mov eax, dword [ebp - 4]
call fcn.0040e6a4
cmp word [eax], 0
je 0x46db3e
xor edi, edi
push 0x4a0bcd
call sub.KERNEL32.DLL_GetModuleHandleA
test eax, eax
je 0x46dac4
push 0x4a0bd9
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov edi, eax
test edi, edi
jne 0x46dacf
xor eax, eax
jmp 0x46dbe6
mov edx, dword [ebp - 4]
mov dword [esi + 0x10], edx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x46daf5
lea edx, [ebp - 0x934]
mov ecx, 0x10000000
call fcn.0040f968
lea edx, [ebp - 0x934]
mov dword [esi + 0xc], edx
cmp dword [ebp - 8], 0
je 0x46db17
lea edx, [ebp - 0x1134]
mov ecx, 0x10000000
mov eax, dword [ebp - 8]
call fcn.0040f968
lea eax, [ebp - 0x1134]
mov dword [esi + 0x18], eax
cmp dword [ebp + 0x14], 0
je 0x46db39
lea edx, [ebp - 0x1934]
mov ecx, 0x10000000
mov eax, dword [ebp + 0x14]
call fcn.0040f968
lea edx, [ebp - 0x1934]
mov dword [esi + 0x14], edx
push esi
call edi
jmp 0x46db44
push esi
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
je 0x46db54
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x483
jne 0x46db5b
xor eax, eax
jmp 0x46dbe6
test bl, bl
jne 0x46dbe4
mov eax, dword [esi + 0x38]
test eax, eax
je 0x46dba3
mov edx, dword [0x4a0b9c]
mov dword [edx*4 + 0x4c3278], eax
mov ecx, dword [0x4a0b9c]
mov eax, dword [esi + 0x20]
mov dword [ecx*4 + 0x4c32b8], eax
mov edx, dword [0x4a0b9c]
inc edx
and edx, 0x8000000f
jns 0x46db9b
dec edx
or edx, 0xfffffff0
inc edx
mov dword [0x4a0b9c], edx
jmp 0x46dbd6
xor ebx, ebx
mov eax, dword [ebx*4 + 0x4c32b8]
cmp eax, dword [esi + 0x20]
jne 0x46dbd0
push 0
push dword [ebx*4 + 0x4c3278]
call sub.KERNEL32.DLL_WaitForSingleObject
cmp eax, 0x102
jne 0x46dbd0
mov edx, dword [ebx*4 + 0x4c3278]
mov dword [esi + 0x38], edx
inc ebx
cmp ebx, 0x10
jl 0x46dba5
cmp dword [ebp + 0xc], 0
je 0x46dbe4
mov ecx, dword [ebp + 0xc]
mov eax, dword [esi + 0x38]
mov dword [ecx], eax
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x46ee74
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
push 0x4bc1c0
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x46eeab
push 0x40
mov eax, 0x2bc
call fcn.004117b8
push eax
mov eax, 0x2bd
call fcn.004117b8
push eax
push dword [0x4b9818]
call sub.USER32.DLL_MessageBoxA
pop ebx
ret
push 0
mov edx, 0x4bc1c0
xor ecx, ecx
mov eax, ebx
call fcn.0046e0c8
pop ebx
ret

Function at 0x46eec0
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffff004
push eax
add esp, 0xfffffb64
mov esi, ecx
mov ebx, edx
push 0
push 0
xor edx, edx
mov eax, ebx
call fcn.0046d315
test al, al
je 0x46ef0c
push 0x30
mov eax, 0x65
call fcn.004117b8
push eax
mov eax, 0x596
call fcn.004117b8
push eax
push dword [0x4b9818]
call sub.USER32.DLL_MessageBoxA
jmp 0x46f0ca
cmp dword [0x4bc1a0], 0
jne 0x46ef49
push 0
push 1
push 0
push 0
xor ecx, ecx
mov edx, esi
mov eax, ebx
call fcn.0046d9d4
test al, al
jne 0x46f0ca
push ebx
mov eax, 0x201
call fcn.004117b8
push eax
call fcn.0044a23c
add esp, 8
jmp 0x46f0ca
mov edx, esp
mov eax, 0x4a0d1e
call fcn.00467b38
test al, al
je 0x46f0ca
lea edx, [esp + 0x400]
push edx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push esp
call fcn.0048ee28
pop ecx
lea edx, [esp + 0x800]
mov eax, 0x4ba55c
call fcn.0045d1d8
call fcn.0045259c
mov ecx, 0x4b2abc
mov edx, 0x4b26bc
mov eax, 0x4ba55c
call fcn.0045d1a4
mov ecx, dword [esp + 0x810]
mov dword [0x4b1274], ecx
mov edx, 0x4a0bc6
mov eax, dword [0x4b32bc]
call fcn.0040f0a4
call fcn.00453070
mov eax, 0x4ba55c
xor ecx, ecx
xor edx, edx
call fcn.004586e0
cmp dword [0x4bc1b0], 0
jne 0x46f0ca
lea edx, [esp + 0x89c]
mov eax, ebx
call fcn.0040b6a0
lea edx, [esp + 0xc9c]
mov eax, esi
call fcn.0040b7ac
lea edx, [esp + 0x89c]
lea eax, [esp + 0x89c]
call fcn.0040a580
lea edx, [esp + 0xc9c]
lea eax, [esp + 0xc9c]
call fcn.0040a5c8
push 0x200c
push 0
push 0x4c7520
call fcn.0048d2a4
add esp, 0xc
lea ecx, [esp + 0x89c]
push ecx
push 0x4c8129
call fcn.0048d424
add esp, 8
mov eax, 0x4c852a
lea edx, [esp + 0xc9c]
call fcn.0040f9f8
push 0x4b26bc
push 0x4c7524
call fcn.0048d424
add esp, 8
mov edx, 0x4b2abc
mov eax, 0x4c7924
call fcn.0040f9f8
push esp
push 0x4c8d2a
call fcn.0048d424
add esp, 8
lea ecx, [esp + 0x400]
push ecx
call fcn.0048ee28
pop ecx
mov eax, dword [0x4b1274]
cmp dword [esp + 0x88c], 0
setne dl
push 0x4c7520
and edx, 1
mov dword [0x4c8124], eax
push 0x10000
push 0x46d378
mov byte [0x4c8128], dl
call fcn.00495638
add esp, 0xc
add esp, 0x149c
pop esi
pop ebx
ret
Function at 0x47593e
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
push eax
push dword [0x4b9824]
call sub.USER32.DLL_GetDlgItem
mov ebx, eax
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push ebx
call sub.USER32.DLL_GetWindowTextA
push esp
push esi
call fcn.0048d3d8
add esp, 8
test eax, eax
je 0x47597b
push esi
push ebx
call sub.USER32.DLL_SetWindowTextA
add esp, 0x200
pop esi
pop ebx
ret
Function at 0x476b3c
Capabilities:
Get graphical window text

Disassembly:
add esp, 0xfffffe00
mov eax, dword [0x4b9824]
test eax, eax
je 0x476be9
push pe_nt_image_headers32
lea edx, [esp + 4]
push edx
push eax
call sub.USER32.DLL_GetWindowTextA
cmp dword [0x4c96dc], 8
je 0x476b8e
push 0x4c96e0
lea ecx, [esp + 4]
push ecx
call fcn.0048d3d8
add esp, 8
test eax, eax
je 0x476b8e
push 0x4c96e0
push dword [0x4b9824]
call sub.USER32.DLL_SetWindowTextA
mov eax, dword [0x4c96dc]
test eax, eax
je 0x476ba6
cmp eax, 1
je 0x476ba6
cmp eax, 2
je 0x476ba6
cmp eax, 8
jne 0x476bcb
mov edx, 0x4c9760
mov eax, 0x9c
call fcn.0047593e
mov eax, 0x4c97e0
call fcn.0040b590
mov edx, eax
mov eax, 0x9b
call fcn.0047593e
mov edx, 0x64
mov eax, 2
call fcn.00444c40
test al, al
je 0x476be9
push dword [0x4b9824]
call sub.USER32.DLL_UpdateWindow
add esp, 0x200
ret