joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d00e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x522eda
mov eax, dword fs:[0]
push eax
sub esp, 0x560
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x54c], ecx
push 0x410
push 0
lea eax, [ebp - 0x4e8]
push eax
call fcn.004b0090
add esp, 0xc
lea eax, [ebp - 0x4e8]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x45d256
lea eax, [ebp - 0x4e8]
push eax
lea ecx, [ebp - 0x500]
call fcn.00409053
and dword [ebp - 4], 0
push 0x5c
mov eax, dword [ebp - 0x54c]
add eax, 0x1648
push eax
lea eax, [ebp - 0x500]
push eax
lea eax, [ebp - 0x530]
push eax
call fcn.00481988
add esp, 0x10
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x550]
mov dword [ebp - 0x554], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x554]
call fcn.0040a5f1
push eax
push 0x208
lea eax, [ebp - 0x4e8]
push eax
call fcn.004cc3b7
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x530]
call fcn.0040a62b
mov byte [ebp - 4], 3
mov byte [ebp - 4], 0
lea eax, [ebp - 0x530]
mov dword [ebp - 0x560], eax
mov byte [ebp - 4], 4
mov byte [ebp - 4], 5
mov byte [ebp - 4], 0
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x500]
call fcn.0040a62b
mov dword [ebp - 4], 7
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x500]
mov dword [ebp - 0x564], eax
mov dword [ebp - 4], 8
mov dword [ebp - 4], 9
or dword [ebp - 4], 0xffffffff
push 0xc8
push 0
lea eax, [ebp - 0xd8]
push eax
call fcn.004b0090
add esp, 0xc
push dword [ebp + 8]
push 0x535e50
push 0x64
lea eax, [ebp - 0xd8]
push eax
call fcn.004077b0
add esp, 0x10
lea eax, [ebp - 0x4e8]
push eax
lea ecx, [ebp - 0x518]
call fcn.00409053
mov dword [ebp - 4], 0xa
lea eax, [ebp - 0x518]
push eax
lea eax, [ebp - 0x548]
push eax
call fcn.004815a2
pop ecx
pop ecx
mov dword [ebp - 0x558], eax
mov eax, dword [ebp - 0x558]
mov dword [ebp - 0x55c], eax
mov byte [ebp - 4], 0xb
push 1
push dword [ebp - 0x55c]
call fcn.004812a5
pop ecx
pop ecx
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x548]
call fcn.0040a62b
mov byte [ebp - 4], 0xd
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x548]
mov dword [ebp - 0x568], eax
mov byte [ebp - 4], 0xe
mov byte [ebp - 4], 0xf
mov byte [ebp - 4], 0xa
mov dword [ebp - 4], 0x10
lea ecx, [ebp - 0x518]
call fcn.0040a62b
mov dword [ebp - 4], 0x11
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x518]
mov dword [ebp - 0x56c], eax
mov dword [ebp - 4], 0x12
mov dword [ebp - 4], 0x13
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x4e8]
push eax
lea eax, [ebp - 0xd8]
push eax
push 0x5358d4
push 0x5358dc
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ad99f
leave
ret 4
Function at 0x45d26f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x522fde
mov eax, dword fs:[0]
push eax
sub esp, 0x560
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x54c], ecx
push 0x410
push 0
lea eax, [ebp - 0x4e8]
push eax
call fcn.004b0090
add esp, 0xc
lea eax, [ebp - 0x4e8]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x45d4ba
lea eax, [ebp - 0x4e8]
push eax
lea ecx, [ebp - 0x500]
call fcn.00409053
and dword [ebp - 4], 0
push 0x5c
mov eax, dword [ebp - 0x54c]
add eax, 0x1648
push eax
lea eax, [ebp - 0x500]
push eax
lea eax, [ebp - 0x530]
push eax
call fcn.00481988
add esp, 0x10
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x550]
mov dword [ebp - 0x554], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x554]
call fcn.0040a5f1
push eax
push 0x208
lea eax, [ebp - 0x4e8]
push eax
call fcn.004cc3b7
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x530]
call fcn.0040a62b
mov byte [ebp - 4], 3
mov byte [ebp - 4], 0
lea eax, [ebp - 0x530]
mov dword [ebp - 0x560], eax
mov byte [ebp - 4], 4
mov byte [ebp - 4], 5
mov byte [ebp - 4], 0
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x500]
call fcn.0040a62b
mov dword [ebp - 4], 7
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x500]
mov dword [ebp - 0x564], eax
mov dword [ebp - 4], 8
mov dword [ebp - 4], 9
or dword [ebp - 4], 0xffffffff
push 0xc8
push 0
lea eax, [ebp - 0xd8]
push eax
call fcn.004b0090
add esp, 0xc
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x53553c
push 0x64
lea eax, [ebp - 0xd8]
push eax
call fcn.004077b0
add esp, 0x14
lea eax, [ebp - 0x4e8]
push eax
lea ecx, [ebp - 0x518]
call fcn.00409053
mov dword [ebp - 4], 0xa
lea eax, [ebp - 0x518]
push eax
lea eax, [ebp - 0x548]
push eax
call fcn.004815a2
pop ecx
pop ecx
mov dword [ebp - 0x558], eax
mov eax, dword [ebp - 0x558]
mov dword [ebp - 0x55c], eax
mov byte [ebp - 4], 0xb
push 1
push dword [ebp - 0x55c]
call fcn.004812a5
pop ecx
pop ecx
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x548]
call fcn.0040a62b
mov byte [ebp - 4], 0xd
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x548]
mov dword [ebp - 0x568], eax
mov byte [ebp - 4], 0xe
mov byte [ebp - 4], 0xf
mov byte [ebp - 4], 0xa
mov dword [ebp - 4], 0x10
lea ecx, [ebp - 0x518]
call fcn.0040a62b
mov dword [ebp - 4], 0x11
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x518]
mov dword [ebp - 0x56c], eax
mov dword [ebp - 4], 0x12
mov dword [ebp - 4], 0x13
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x4e8]
push eax
lea eax, [ebp - 0xd8]
push eax
push 0x535e20
push 0x5355b4
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ad99f
leave
ret 8
Function at 0x45f9c6
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x523a9d
mov eax, dword fs:[0]
push eax
sub esp, 0x334
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x33c], ecx
and dword [ebp - 0x334], 0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x330]
call fcn.0040b2fe
mov byte [ebp - 4], 2
push 0x208
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.004b0090
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.data_tdir_info
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x100
push 0
lea eax, [ebp - 0x318]
push eax
call fcn.004b0090
add esp, 0xc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0x536208
lea eax, [ebp - 0x318]
push eax
call fcn.00418a75
add esp, 0x10
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45faf9
lea eax, [ebp - 0x218]
push eax
call fcn.004cc4f3
pop ecx
mov dword [ebp - 0x338], eax
push dword [ebp - 0x338]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x330]
call fcn.0040a770
jmp 0x45fb0c
lea eax, [ebp - 0x218]
push eax
push str.TCLSHostApp::GetAltTCLSPath_s_not_exist
call fcn.0046c5d3
pop ecx
pop ecx
lea eax, [ebp - 0x330]
push eax
mov ecx, dword [ebp + 8]
call fcn.0040b1fe
mov eax, dword [ebp - 0x334]
or eax, 1
mov dword [ebp - 0x334], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x330]
call fcn.0040a62b
mov byte [ebp - 4], 4
mov byte [ebp - 4], 1
lea eax, [ebp - 0x330]
mov dword [ebp - 0x340], eax
mov byte [ebp - 4], 5
mov byte [ebp - 4], 6
mov byte [ebp - 4], 1
mov byte [ebp - 4], 0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ad99f
leave
ret 0xc
Function at 0x4628e6
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x14], 0x5399ac
mov dword [ebp - 0x14], 0x5399b4
mov ecx, dword [ebp + 8]
call fcn.0040a5f1
mov dword [ebp - 8], eax
push dword [ebp - 8]
lea ecx, [ebp - 0x10]
call fcn.004688d0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x462964
push 0xffffffffffffffff
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x462942
mov ecx, dword [ebp + 8]
call fcn.0040a5f1
push eax
push str.TCLSHostApp::CheckAndTerminateTGMProcess___kill_TGM_process_success__path:__s
call fcn.0046c4d6
pop ecx
pop ecx
jmp 0x462957
mov ecx, dword [ebp + 8]
call fcn.0040a5f1
push eax
push str.TCLSHostApp::CheckAndTerminateTGMProcess___kill_TGM_process_failed__path:__s
call fcn.0046c5d3
pop ecx
pop ecx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 4], 0
leave
ret 4
Function at 0x4682a8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x840
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x840], ecx
cmp dword [ebp + 8], 0
je 0x4682d3
cmp dword [ebp + 0xc], 0
je 0x4682d3
cmp dword [ebp + 0x10], 0
jne 0x4682d8
jmp 0x468444
push 2
pop eax
imul eax, eax, 0
xor ecx, ecx
mov edx, dword [ebp + 0xc]
mov word [edx + eax], cx
push 0x410
push 0
lea eax, [ebp - 0x41c]
push eax
call fcn.004b0090
add esp, 0xc
lea eax, [ebp - 0x41c]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
jne 0x468318
jmp 0x468444
mov eax, dword [0x5399b8]
mov dword [ebp - 0xc], eax
mov ax, word [0x5399bc]
mov word [ebp - 8], ax
and dword [ebp - 0x834], 0
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x830], eax
cmp dword [ebp - 0x834], 0
jne 0x468444
mov eax, dword [ebp - 0x830]
movzx eax, word [eax]
test eax, eax
je 0x468444
push 2
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x830]
mov cx, word [ecx]
mov word [ebp + eax - 0xc], cx
push 0x208
lea eax, [ebp - 0x82c]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x468414
lea eax, [ebp - 0x82c]
push eax
call fcn.004cc4f3
pop ecx
mov dword [ebp - 0x838], eax
cmp dword [ebp - 0x838], 0x208
jae 0x468414
push dword [ebp - 0x838]
lea eax, [ebp - 0x82c]
push eax
push dword [ebp + 8]
call fcn.004d7559
add esp, 0xc
test eax, eax
jne 0x4683d4
mov dword [ebp - 0x83c], 1
jmp 0x4683db
and dword [ebp - 0x83c], 0
mov eax, dword [ebp - 0x83c]
mov dword [ebp - 0x834], eax
cmp dword [ebp - 0x834], 0
je 0x468414
mov eax, dword [ebp - 0x838]
mov ecx, dword [ebp + 8]
lea eax, [ecx + eax*2]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x531260
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004077b0
add esp, 0x14
mov eax, dword [ebp - 0x830]
movzx eax, word [eax]
test eax, eax
je 0x468431
mov eax, dword [ebp - 0x830]
inc eax
inc eax
mov dword [ebp - 0x830], eax
jmp 0x468414
mov eax, dword [ebp - 0x830]
inc eax
inc eax
mov dword [ebp - 0x830], eax
jmp 0x46833d
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret 0xc
Function at 0x468452
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x840
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x840], ecx
cmp dword [ebp + 8], 0
je 0x46847d
cmp dword [ebp + 0xc], 0
je 0x46847d
cmp dword [ebp + 0x10], 0
jne 0x468482
jmp 0x4685ee
push 2
pop eax
imul eax, eax, 0
xor ecx, ecx
mov edx, dword [ebp + 0xc]
mov word [edx + eax], cx
push 0x410
push 0
lea eax, [ebp - 0x41c]
push eax
call fcn.004b0090
add esp, 0xc
lea eax, [ebp - 0x41c]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
jne 0x4684c2
jmp 0x4685ee
mov eax, dword [0x5399b8]
mov dword [ebp - 0xc], eax
mov ax, word [0x5399bc]
mov word [ebp - 8], ax
and dword [ebp - 0x834], 0
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x830], eax
cmp dword [ebp - 0x834], 0
jne 0x4685ee
mov eax, dword [ebp - 0x830]
movzx eax, word [eax]
test eax, eax
je 0x4685ee
push 2
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x830]
mov cx, word [ecx]
mov word [ebp + eax - 0xc], cx
push 0x208
lea eax, [ebp - 0x82c]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x4685be
lea eax, [ebp - 0x82c]
push eax
call fcn.004cc4f3
pop ecx
mov dword [ebp - 0x838], eax
cmp dword [ebp - 0x838], 0x208
jae 0x4685be
push dword [ebp - 0x838]
lea eax, [ebp - 0x82c]
push eax
push dword [ebp + 8]
call fcn.004d7559
add esp, 0xc
test eax, eax
jne 0x46857e
mov dword [ebp - 0x83c], 1
jmp 0x468585
and dword [ebp - 0x83c], 0
mov eax, dword [ebp - 0x83c]
mov dword [ebp - 0x834], eax
cmp dword [ebp - 0x834], 0
je 0x4685be
mov eax, dword [ebp - 0x838]
mov ecx, dword [ebp + 8]
lea eax, [ecx + eax*2]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x531260
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004077b0
add esp, 0x14
mov eax, dword [ebp - 0x830]
movzx eax, word [eax]
test eax, eax
je 0x4685db
mov eax, dword [ebp - 0x830]
inc eax
inc eax
mov dword [ebp - 0x830], eax
jmp 0x4685be
mov eax, dword [ebp - 0x830]
inc eax
inc eax
mov dword [ebp - 0x830], eax
jmp 0x4684e7
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret 0xc
Function at 0x4688d0
Capabilities:
Enumerate processes
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe74
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xe68], ecx
and dword [ebp - 0xe64], 0
push 0x410
push 0
lea eax, [ebp - 0x414]
push eax
call fcn.004b0090
add esp, 0xc
cmp dword [ebp - 0xe68], 0
je 0x468920
mov eax, dword [ebp - 0xe68]
sub eax, 4
mov dword [ebp - 0xe70], eax
jmp 0x468927
and dword [ebp - 0xe70], 0
push 0x208
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 8]
mov ecx, dword [ebp - 0xe70]
call fcn.004685fc
cmp dword [ebp - 0xe68], 0
je 0x46895b
mov eax, dword [ebp - 0xe68]
sub eax, 4
mov dword [ebp - 0xe74], eax
jmp 0x468962
and dword [ebp - 0xe74], 0
push 0x208
lea eax, [ebp - 0x414]
push eax
mov ecx, dword [ebp - 0xe74]
call fcn.00468d20
push 0x410
push 0
lea eax, [ebp - 0x824]
push eax
call fcn.004b0090
add esp, 0xc
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0xe6c], eax
cmp dword [ebp - 0xe6c], 0xffffffff
je 0x468aca
push 0x22c
push 0
lea eax, [ebp - 0xe60]
push eax
call fcn.004b0090
add esp, 0xc
mov dword [ebp - 0xe60], 0x22c
lea eax, [ebp - 0xe60]
push eax
push dword [ebp - 0xe6c]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x468ab7
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0xe3c]
push eax
call fcn.004d5f0c
pop ecx
pop ecx
test eax, eax
jne 0x468a9d
push dword [ebp - 0xe58]
push 0
push 0x100411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0xe64], eax
cmp dword [ebp - 0xe64], 0
je 0x468a9d
push 0x208
lea eax, [ebp - 0x824]
push eax
push dword [ebp - 0xe64]
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x468a8a
push 0x410
push 0
lea eax, [ebp - 0xc34]
push eax
call fcn.004b0090
add esp, 0xc
push 0x208
lea eax, [ebp - 0xc34]
push eax
lea eax, [ebp - 0x824]
push eax
mov ecx, dword [ebp - 0xe68]
call fcn.004682a8
push dword [ebp + 8]
lea eax, [ebp - 0xc34]
push eax
call fcn.004d5f0c
pop ecx
pop ecx
test eax, eax
jne 0x468a8a
jmp 0x468ab7
push dword [ebp - 0xe64]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0xe64], 0
lea eax, [ebp - 0xe60]
push eax
push dword [ebp - 0xe6c]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4689e5
push dword [ebp - 0xe6c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 0xe6c], 0xffffffff
mov eax, dword [ebp - 0xe64]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret 4
Function at 0x46d0a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5262db
mov eax, dword fs:[0]
push eax
sub esp, 0x880
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x874], ecx
cmp dword [ebp + 8], 0
je 0x46d256
push dword [ebp + 8]
call fcn.004cc4f3
pop ecx
mov dword [ebp - 0x878], eax
cmp dword [ebp - 0x878], 0
je 0x46d256
push 0x800
push 0
lea eax, [ebp - 0x840]
push eax
call fcn.004b0090
add esp, 0xc
push dword [ebp + 8]
push str._TCLS_HOST__s_n
push 0x400
lea eax, [ebp - 0x840]
push eax
call fcn.004077b0
add esp, 0x10
mov eax, dword [ebp - 0x874]
cmp dword [eax], 0
je 0x46d256
call fcn.004d8f99
push 0x30
push 0
lea eax, [ebp - 0x40]
push eax
call fcn.004b0090
add esp, 0xc
push 0x18
lea eax, [ebp - 0x40]
push eax
call fcn.004d808c
pop ecx
pop ecx
push dword [ebp + 8]
lea eax, [ebp - 0x40]
push eax
push str.__s__s_r_n
push 0x400
lea eax, [ebp - 0x840]
push eax
call fcn.004077b0
add esp, 0x14
lea eax, [ebp - 0x840]
push eax
lea ecx, [ebp - 0x870]
call fcn.00409053
and dword [ebp - 4], 0
lea eax, [ebp - 0x870]
push eax
lea eax, [ebp - 0x858]
push eax
call fcn.0044b1a6
pop ecx
pop ecx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x870]
call fcn.0040a62b
mov byte [ebp - 4], 4
mov byte [ebp - 4], 2
lea eax, [ebp - 0x870]
mov dword [ebp - 0x888], eax
mov byte [ebp - 4], 5
mov byte [ebp - 4], 6
mov byte [ebp - 4], 2
and dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0x848]
mov dword [ebp - 0x880], eax
lea ecx, [ebp - 0x858]
call fcn.004059a0
mov dword [ebp - 0x884], eax
push 0
lea eax, [ebp - 0x87c]
push eax
push dword [ebp - 0x880]
push dword [ebp - 0x884]
mov eax, dword [ebp - 0x874]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 4], 7
lea ecx, [ebp - 0x858]
call fcn.00405a40
mov dword [ebp - 4], 8
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x858]
mov dword [ebp - 0x88c], eax
mov dword [ebp - 4], 9
mov dword [ebp - 4], 0xa
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ad99f
leave
ret 4
Function at 0x4752bc
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84c
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x828], ecx
mov dword [ebp - 0x840], 1
and dword [ebp - 0x830], 0
and dword [ebp - 0x82c], 0
and dword [ebp - 0x848], 0
push 0x410
push 0
lea eax, [ebp - 0x824]
push eax
call fcn.004b0090
add esp, 0xc
push 0x410
push 0
lea eax, [ebp - 0x414]
push eax
call fcn.004b0090
add esp, 0xc
and dword [ebp - 0x838], 0
cmp dword [ebp + 8], 0
je 0x4754a2
push 0
push str.singleinstance
push 0x53a12c
mov ecx, dword [ebp - 0x828]
add ecx, 0x619b0
call fcn.00468814
mov dword [ebp - 0x838], eax
cmp dword [ebp - 0x838], 1
jne 0x4754a2
push 0x208
lea eax, [ebp - 0x824]
push eax
push dword [ebp + 8]
mov ecx, dword [ebp - 0x828]
add ecx, 0x58
call fcn.0047b743
push dword [ebp + 8]
mov ecx, dword [ebp - 0x828]
add ecx, 0x6a
call fcn.0047d3e1
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x82c], 0
je 0x4754a2
push 0
push dword [ebp - 0x82c]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x1388
push dword [ebp - 0x82c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x84c], eax
and dword [ebp - 0x830], 0
and dword [ebp - 0x83c], 0
push dword [ebp + 8]
mov ecx, dword [ebp - 0x828]
add ecx, 0x6a
call fcn.0047beff
mov dword [ebp - 0x834], eax
cmp dword [ebp - 0x834], 0
je 0x475412
mov dword [ebp - 0x83c], 1
push dword [ebp - 0x834]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x834], 0
cmp dword [ebp - 0x83c], 0
je 0x475496
cmp dword [ebp - 0x830], 0x14
jle 0x475479
push dword [ebp + 8]
push 0x539f64
push 0
push 0x208
lea eax, [ebp - 0x414]
push eax
mov eax, dword [ebp - 0x828]
add eax, 0x68
push eax
call fcn.0047e608
add esp, 0x18
push 5
push 0
lea eax, [ebp - 0x414]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0x844], eax
cmp dword [ebp - 0x844], 2
jne 0x475477
and dword [ebp - 0x840], 0
jmp 0x475496
jmp 0x475491
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x830]
inc eax
mov dword [ebp - 0x830], eax
jmp 0x4753ce
push dword [ebp - 0x82c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x840]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret 4
Function at 0x478b15
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x5770a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x418], ecx
push 0x410
push 0
lea eax, [ebp - 0x414]
push eax
call fcn.004b0090
add esp, 0xc
push 0x53c4cc
mov eax, dword [ebp - 0x418]
add eax, 0x623fc
push eax
push 0x53c58c
push 1
push 0x208
lea eax, [ebp - 0x414]
push eax
mov eax, dword [ebp - 0x418]
add eax, 0x68
push eax
call fcn.0047e608
add esp, 0x1c
lea eax, [ebp - 0x414]
push eax
push 0
push str.UserSelect
push str.IspInfo
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ad99f
leave
ret

Function at 0x479418
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0xc]
call fcn.0040a5f1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
call fcn.0040a5f1
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x479484
mov ecx, dword [ebp + 0xc]
call fcn.0040a5f1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
call fcn.0040a5f1
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push str._Launch__TCLS_Launcher::SetEnvironmentVariable_failed__key:_s__value:_s__error:_d
mov eax, dword [ebp - 4]
add eax, 0x69
push eax
call fcn.0047d5fa
add esp, 0x14
xor eax, eax
jmp 0x4794b2
mov ecx, dword [ebp + 0xc]
call fcn.0040a5f1
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
call fcn.0040a5f1
push eax
push str._Launch__TCLS_Launcher::SetEnvironmentVariable_succ__key:_s__value:_s
mov eax, dword [ebp - 4]
add eax, 0x69
push eax
call fcn.0047d5fa
add esp, 0x10
xor eax, eax
inc eax
leave
ret 8
Function at 0x47a3f9
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52721b
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push esi
push edi
mov eax, dword [0x5770a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.Tenio::IEvent.0
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.Tenio::ITimeoutEvent.0
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.PartialTemplateSpecializationForEvent::IDefaultEventImpl_class_Tenio::ITimeoutEvent_.0
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.IEventImpl_class_Tenio::ITimeoutEvent__1_.0
mov eax, dword [ebp - 0x10]
add eax, 4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], vtable.Tenio::IEvent.0
mov eax, dword [ebp - 0x14]
mov dword [eax], vtable.Tenio::IIntervalEvent.0
mov eax, dword [ebp - 0x14]
mov dword [eax], vtable.PartialTemplateSpecializationForEvent::IDefaultEventImpl_class_Tenio::IIntervalEvent_.0
mov eax, dword [ebp - 0x14]
mov dword [eax], vtable.IEventImpl_class_Tenio::IIntervalEvent__1_.0
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.Tenio::TTimerHelper_class_Tenio::TCLS_Launcher__0_.0
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], vtable.Tenio::TTimerHelper_class_Tenio::TCLS_Launcher__0_.1.0
mov eax, dword [ebp - 0x10]
add eax, 0x30
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
call fcn.0047a508
and dword [ebp - 4], 0
mov dword [ebp - 4], 1
mov dword [ebp - 4], 2
and dword [ebp - 0x28], 0
and dword [ebp - 0x24], 0
and dword [ebp - 0x20], 0
or dword [ebp - 0x1c], 0xffffffff
mov edi, dword [ebp - 0x10]
add edi, 0x10
lea esi, [ebp - 0x28]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
and dword [ebp - 0x38], 0
and dword [ebp - 0x34], 0
and dword [ebp - 0x30], 0
or dword [ebp - 0x2c], 0xffffffff
mov edi, dword [ebp - 0x10]
add edi, 0x20
lea esi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x10]
and dword [eax + 0xc], 0
mov eax, dword [ebp - 0x10]
and dword [eax + 8], 0
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
leave
ret