joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44da10
Capabilities:
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x4871cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
push ebp
push esi
xor esi, esi
mov dword [esp + 8], esi
mov dword [esp + 0x10], esi
mov edx, dword [esp + 0x130]
lea eax, [esp + 0x14]
push eax
mov eax, dword [ecx]
push 0x20019
push esi
push edx
push eax
mov dword [esp + 0x13c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebp, dword [esp + 0x134]
test eax, eax
jne 0x44dbd3
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push 0x104
push ecx
push esi
push edx
mov dword [esp + 0x28], 1
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x44dbc8
push ebx
push edi
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x44dad7
lea edi, [esp + 0x24]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x14]
call fcn.00405020
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
jmp 0x44db01
push 1
lea ecx, [esp + 0x14]
call fcn.00405020
mov edi, 0x4aa6c0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
push eax
call fcn.00469630
push eax
call fcn.00466700
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push edx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x1c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00466190
mov esi, dword [ebp]
mov edi, dword [esp + 0x1c]
add esp, 0xc
cmp esi, 0x1f4
mov ebx, edi
jae 0x44db9b
lea ecx, [esi + 1]
cmp esi, 0xffffffff
mov dword [ebp], ecx
je 0x44db9b
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 4
push ecx
call fcn.00479e3c
mov edx, eax
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
add esp, 4
mov dword [ebp + esi*4 + 0x1f8], edx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
mov eax, ecx
inc ecx
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x24]
push 0x104
push ecx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x44da91
pop edi
xor esi, esi
pop ebx
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 8]
mov ebp, dword [ebp]
cmp eax, esi
mov dword [esp + 0x128], 0xffffffff
je 0x44dc00
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00479e65
mov edx, dword [esp + 0xc]
push edx
call fcn.00479e65
add esp, 8
mov ecx, dword [esp + 0x120]
mov eax, ebp
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x124
ret 8
Function at 0x44ef00
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4873c3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x14], edi
mov dword [edi], method.CWinApp.virtual_0
xor ebx, ebx
mov dword [esp + 0x24], ebx
lea esi, [edi + 0x148]
mov dword [esp + 0x18], esi
mov dword [esi], 0x48bda4
mov ebp, dword [esi + 4]
mov byte [esp + 0x24], 5
cmp ebp, ebx
mov dword [esp + 0x10], ebp
je 0x44ef7a
jmp 0x44ef56
mov ebp, dword [esp + 0x10]
xor ebx, ebx
add ebp, 8
mov ecx, ebp
call fcn.00475ea8
add ebp, 8
mov eax, ebx
dec ebx
test eax, eax
jne 0x44ef59
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx]
test eax, eax
mov dword [esp + 0x10], eax
jne 0x44ef50
xor ebx, ebx
mov ecx, dword [esi + 0x14]
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 8], ebx
mov dword [esi + 4], ebx
call fcn.004758ff
lea ecx, [edi + 0x144]
mov dword [esi + 0x14], ebx
mov byte [esp + 0x24], 3
call fcn.00475ea8
lea esi, [edi + 0xcc]
mov dword [esp + 0x18], esi
lea ebx, [esi + 0x48]
mov dword [esp + 0x10], ebx
lea ecx, [ebx + 4]
mov byte [esp + 0x24], 0x18
call fcn.00475ea8
mov ecx, ebx
mov byte [esp + 0x24], 0x17
call fcn.00475ea8
lea ecx, [esi + 0x44]
mov byte [esp + 0x24], 0x16
call fcn.00475ea8
lea ecx, [esi + 0x40]
mov byte [esp + 0x24], 0x15
call fcn.00475ea8
lea ecx, [esi + 0x3c]
mov byte [esp + 0x24], 0x14
call fcn.00475ea8
lea ecx, [esi + 0x38]
mov byte [esp + 0x24], 0x13
call fcn.00475ea8
lea ecx, [esi + 0x34]
mov byte [esp + 0x24], 0x12
call fcn.00475ea8
lea ecx, [esi + 0x30]
mov byte [esp + 0x24], 0x11
call fcn.00475ea8
lea ecx, [esi + 0x2c]
mov byte [esp + 0x24], 0x10
call fcn.00475ea8
lea ecx, [esi + 0x28]
mov byte [esp + 0x24], 0xf
call fcn.00475ea8
lea ecx, [esi + 0x24]
mov byte [esp + 0x24], 0xe
call fcn.00475ea8
lea ecx, [esi + 0x20]
mov byte [esp + 0x24], 0xd
call fcn.00475ea8
lea ecx, [esi + 0x1c]
mov byte [esp + 0x24], 0xc
call fcn.00475ea8
lea ecx, [esi + 0x18]
mov byte [esp + 0x24], 0xb
call fcn.00475ea8
lea ecx, [esi + 0x14]
mov byte [esp + 0x24], 0xa
call fcn.00475ea8
lea ecx, [esi + 0x10]
mov byte [esp + 0x24], 9
call fcn.00475ea8
lea ecx, [esi + 0xc]
mov byte [esp + 0x24], 8
call fcn.00475ea8
lea ecx, [esi + 8]
mov byte [esp + 0x24], 7
call fcn.00475ea8
lea ecx, [esi + 4]
mov byte [esp + 0x24], 6
call fcn.00475ea8
mov ecx, esi
mov byte [esp + 0x24], 2
call fcn.00475ea8
lea ecx, [edi + 0xc8]
mov byte [esp + 0x24], 1
call fcn.00475ea8
lea ecx, [edi + 0xc4]
mov byte [esp + 0x24], 0
call fcn.00475ea8
mov ecx, edi
mov dword [esp + 0x24], 0xffffffff
call fcn.0047e71a
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x454cb0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x488120
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x4a6844]
push esi
push edi
mov esi, ecx
mov dword [esp + 8], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 8]
push eax
mov byte [esp + 0x1c], 1
call fcn.00475fe5
lea ecx, [esp + 8]
call fcn.0047635e
mov edi, 1
lea ecx, [esp + 0xc]
push edi
push ecx
push 0xffffffffffffffff
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x4a4fbc
call fcn.00475f16
lea edx, [esp + 0x18]
mov ecx, esi
push edx
call fcn.0044fe70
test eax, eax
je 0x454d2b
lea eax, [esp + 0xc]
push 1
push eax
push 0xffffffffffffffff
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x4a4fb8
call fcn.00475f16
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.0044fe70
test eax, eax
je 0x454d57
xor edi, edi
lea ecx, [esp + 0xc]
mov byte [esp + 0x18], 0
call fcn.00475ea8
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0xffffffff
call fcn.00475ea8
mov ecx, dword [esp + 0x10]
mov eax, edi
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x14
ret 4
Function at 0x456ad0
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 0x304
push ebx
push esi
push edi
mov ebx, ecx
call fcn.00441cf0
test eax, eax
je 0x456b74
push ebp
push 0
lea eax, [esp + 0x114]
push str.CSetupApp::CloseMMSYSWindow_n
push eax
call fcn.00465850
mov edi, str.ENTRY:
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x10]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x110]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00441c80
mov ecx, eax
call fcn.00441d20
lea eax, [esp + 0x10]
push eax
call fcn.00441c80
mov ecx, eax
call fcn.00442090
pop ebp
lea ecx, [esp + 0x20c]
push ecx
mov ecx, ebx
call fcn.00456900
lea edx, [esp + 0x20c]
push edx
push 0x4567c0
call dword [sym.imp.USER32.dll_EnumWindows]
call fcn.00441cf0
test eax, eax
je 0x456c2d
push 0
lea eax, [esp + 0x110]
push str.CSetupApp::CloseMMSYSWindow_n
push eax
call fcn.00465850
mov edi, str.EXIT:
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x10c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00441c80
mov ecx, eax
call fcn.00442090
call fcn.00441c80
mov ecx, eax
call fcn.00441d30
pop edi
pop esi
pop ebx
add esp, 0x304
ret
Function at 0x45e910
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x48931f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x4a6844]
push esi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [esp + 0x14], 1
call esi
test eax, 0x80000000
jne 0x45e97a
call esi
and eax, 0xff
cmp eax, 5
jb 0x45e97a
mov eax, dword [esp + 0x20]
test eax, eax
je 0x45e96c
push str.Global_
jmp 0x45e971
push str.Local_
lea ecx, [esp + 8]
call fcn.00475fe5
mov esi, dword [esp + 0x1c]
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call fcn.00475c1d
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.00475ea8
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x460170
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x48957b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
mov eax, dword [0x4a6844]
push ebx
mov dword [esp + 4], eax
lea ecx, [esp + 0xc]
xor ebx, ebx
push ecx
push 0x20019
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
mov dword [esp + 0x130], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x46029b
mov ecx, dword [esp + 0xc]
lea edx, [esp + 8]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x14]
push edx
push eax
push ebx
push ebx
push 0x49e628
push ecx
mov dword [esp + 0x24], 0x104
call esi
test eax, eax
jne 0x460229
lea edx, [esp + 0x14]
lea ecx, [esp + 8]
push edx
call fcn.00475fe5
lea ecx, [esp + 8]
call fcn.0047635e
push str.MILLENNIUM
lea ecx, [esp + 0xc]
call fcn.00474e80
cmp eax, 0xffffffff
jne 0x46028a
push 0x49efd4
lea ecx, [esp + 0xc]
call fcn.00474e80
cmp eax, 0xffffffff
jne 0x46028a
mov edx, dword [esp + 0x10]
lea eax, [esp + 0xc]
lea ecx, [esp + 0x14]
push eax
push ecx
push ebx
push ebx
push str.ProductName
push edx
mov dword [esp + 0x24], 0x104
call esi
test eax, eax
jne 0x46028f
lea eax, [esp + 0x14]
lea ecx, [esp + 8]
push eax
call fcn.00475fe5
lea ecx, [esp + 8]
call fcn.0047635e
push str.MILLENNIUM
lea ecx, [esp + 0xc]
call fcn.00474e80
cmp eax, 0xffffffff
jne 0x46028a
push 0x49efd4
lea ecx, [esp + 0xc]
call fcn.00474e80
cmp eax, 0xffffffff
je 0x46028f
mov ebx, 1
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
lea ecx, [esp + 4]
mov dword [esp + 0x11c], 0xffffffff
call fcn.00475ea8
mov ecx, dword [esp + 0x114]
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
add esp, 0x11c
ret
Function at 0x4602d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
mov eax, dword [0x4a6844]
lea ecx, [esp]
push esi
xor esi, esi
push ecx
push 0x20019
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionSetupUpdates
push 0x80000002
mov dword [esp + 0x20], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x460339
mov ecx, dword [esp + 4]
lea edx, [esp + 8]
lea eax, [esp + 0x10]
push edx
push eax
push esi
push esi
push str.Windows_98_Second_Edition
push ecx
mov dword [esp + 0x20], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x46032e
mov esi, 1
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0xc]
call fcn.00475ea8
mov eax, esi
pop esi
add esp, 0x110
ret

Function at 0x4603e0
Capabilities:
Check os version

Disassembly:
sub esp, 0x9c
push ebx
push esi
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [esp + 0xc]
push eax
xor esi, esi
mov dword [esp + 0x10], 0x9c
call edi
mov ebx, eax
test ebx, ebx
jne 0x460430
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x94
push ecx
call edi
test eax, eax
jne 0x460430
pop edi
pop esi
pop ebx
add esp, 0x9c
ret
mov eax, dword [esp + 0x1c]
dec eax
je 0x460500
dec eax
jne 0x460531
call fcn.00460350
mov ecx, dword [esp + 0x10]
cmp ecx, 4
ja 0x460461
mov esi, 5
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x9c
ret
cmp ecx, 5
jne 0x4604db
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x46047f
mov esi, 6
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x9c
ret
cmp ecx, 1
jne 0x460495
mov esi, 7
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x9c
ret
cmp ecx, 2
jne 0x460531
test eax, eax
je 0x4604ca
test ebx, ebx
mov esi, 0xa
je 0x460531
cmp byte [esp + 0xa6], 1
jne 0x460531
mov esi, 8
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x9c
ret
mov esi, 9
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x9c
ret
cmp ecx, 6
jne 0x460531
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x460531
xor edx, edx
pop edi
test eax, eax
setne dl
add edx, 0xb
mov esi, edx
mov eax, esi
pop esi
pop ebx
add esp, 0x9c
ret
cmp dword [esp + 0x10], 4
jne 0x460531
call fcn.00460170
test eax, eax
je 0x460521
mov esi, 4
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x9c
ret
call fcn.004602d0
mov esi, eax
neg esi
sbb esi, esi
neg esi
add esi, 2
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x9c
ret

Function at 0x460540
Capabilities:
Check os version

Disassembly:
sub esp, 0x9c
push esi
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 8]
xor esi, esi
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x9c
call edi
test eax, eax
jne 0x46058c
lea ecx, [esp + 8]
mov dword [esp + 8], 0x94
push ecx
call edi
test eax, eax
jne 0x46058c
pop edi
pop esi
add esp, 0x9c
ret
cmp dword [esp + 0x18], 2
jne 0x4605a7
cmp dword [esp + 0xc], 6
jne 0x4605a7
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x4605a7
mov esi, 1
mov eax, esi
pop edi
pop esi
add esp, 0x9c
ret
Function at 0x460650
Capabilities:
Create directory
Get common file path

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, str.TEMP
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x18]
mov ecx, edx
and ecx, 3
test eax, eax
rep movsb byte es:[edi], byte [esi]
je 0x46069e
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edi, 0x49b19c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
ret
Function at 0x461120
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 0x20c
push ebx
push esi
push edi
call fcn.00441cf0
test eax, eax
je 0x4611c0
push 0
lea eax, [esp + 0x11c]
push str.SendExitMsgToApp_n
push eax
call fcn.00465850
mov edi, str.ENTRY:
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x118]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00441c80
mov ecx, eax
call fcn.00441d20
lea eax, [esp + 0x18]
push eax
call fcn.00441c80
mov ecx, eax
call fcn.00442090
call fcn.00441cf0
mov edi, dword [esp + 0x220]
mov esi, dword [esp + 0x21c]
test eax, eax
je 0x461204
mov ecx, dword [esi]
push edi
push ecx
lea edx, [esp + 0x120]
push str.csAppName___s__uExitMsg___d_n
push edx
call fcn.00465850
add esp, 0x10
lea eax, [esp + 0x118]
push eax
call fcn.00441c80
mov ecx, eax
call fcn.00442090
lea ecx, [esp + 0xc]
push ecx
push esi
call fcn.00460e60
add esp, 8
test eax, eax
je 0x46123d
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push 0x4610c0
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edi
call dword [sym.imp.USER32.dll_EnumWindows]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00441cf0
test eax, eax
je 0x4612d4
push 0
lea ecx, [esp + 0x11c]
push str.SendExitMsgToApp_n
push ecx
call fcn.00465850
mov edi, str.EXIT:
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x118]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x18]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00441c80
mov ecx, eax
call fcn.00442090
call fcn.00441c80
mov ecx, eax
call fcn.00441d30
pop edi
pop esi
pop ebx
add esp, 0x20c
ret
Function at 0x466a70
Capabilities:
Move file

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x466a8c
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x466a8e
xor eax, eax
test eax, eax
je 0x466a9f
push eax
call fcn.00468a60
add esp, 4
or eax, 0xffffffff
ret
xor eax, eax
ret

Function at 0x467200
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48d688
push 0x46bfc8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov dl, ah
mov dword [0x4ac8a4], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x4ac8a0], ecx
shl ecx, 8
add ecx, edx
mov dword [0x4ac89c], ecx
shr eax, 0x10
mov dword [0x4ac898], eax
call fcn.0046c580
test eax, eax
jne 0x46726a
push 0x1c
call fcn.004673e0
add esp, 4
call fcn.0046ba20
test eax, eax
jne 0x46727d
push 0x10
call fcn.004673e0
add esp, 4
mov dword [ebp - 4], 0
call fcn.0046f070
call fcn.0046a3c0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4adfdc], eax
call fcn.0046ef10
mov dword [0x4ac888], eax
test eax, eax
je 0x4672b0
mov eax, dword [0x4adfdc]
test eax, eax
jne 0x4672ba
push 0xffffffffffffffff
call fcn.004696b0
add esp, 4
call fcn.0046ec60
call fcn.0046eb70
call fcn.00469680
mov esi, dword [0x4adfdc]
mov dword [ebp - 0x64], esi
cmp byte [esi], 0x22
jne 0x467399
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
cmp al, 0x22
je 0x467301
test al, al
je 0x467301
and eax, 0xff
push eax
call fcn.0046eb10
add esp, 4
test eax, eax
je 0x4672db
inc esi
mov dword [ebp - 0x64], esi
jmp 0x4672db
cmp byte [esi], 0x22
jne 0x46730a
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
test al, al
je 0x46731a
cmp al, 0x20
ja 0x46731a
inc esi
mov dword [ebp - 0x64], esi
jmp 0x46730a
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x46733b
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x467340
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x60], eax
push eax
call fcn.004696b0
jmp 0x46737e
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x46730a
inc esi
mov dword [ebp - 0x64], esi
jmp 0x467399

Function at 0x4673e0
Capabilities:
Terminate process

Disassembly:
cmp dword [0x4ac890], 1
jne 0x4673ee
call fcn.00552000
mov eax, dword [esp + 4]
push eax
call fcn.0046f2c0
add esp, 4
push 0xff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x468230
Capabilities:
Create thread

Disassembly:
push esi
push edi
push 0x74
push 1
xor edi, edi
call fcn.0046f960
mov esi, eax
add esp, 8
test esi, esi
je 0x468290
push esi
call fcn.0046ba80
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
add esp, 4
mov dword [esi + 0x48], eax
mov eax, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x10]
mov dword [esi + 0x4c], ecx
mov ecx, dword [esp + 0x14]
push eax
push esi
push 0x4682b0
push ecx
push edx
mov dword [esi + 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x4682a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push esi
call fcn.00466190
add esp, 4
test edi, edi
je 0x4682a6
push edi
call fcn.00468a60
add esp, 4
xor eax, eax
pop edi
pop esi
ret

Function at 0x4696f0
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
push esi
call fcn.004697b0
mov eax, dword [0x4ac8d4]
mov ebp, dword [esp + 0x10]
cmp eax, 1
jne 0x469714
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
test eax, eax
mov dword [0x4ac8d0], 1
mov byte [0x4ac8cc], bl
jne 0x46976e
mov ecx, dword [0x4adfd8]
test ecx, ecx
je 0x46975c
mov esi, dword [0x4adfd4]
sub esi, 4
cmp esi, ecx
jb 0x46975c
mov eax, dword [esi]
test eax, eax
je 0x469755
call eax
mov ecx, dword [0x4adfd8]
sub esi, 4
cmp esi, ecx
jae 0x469747
push 0x49b0a4
push 0x49b09c
call fcn.004697d0
add esp, 8
push 0x49b0b0
push 0x49b0a8
call fcn.004697d0
add esp, 8
test ebx, ebx
je 0x46978d
call fcn.004697c0
pop esi
pop ebp
pop ebx
ret
push ebp
mov dword [0x4ac8d4], 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x46ba20
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push esi
call fcn.0046c0a0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x4a7280], eax
je 0x46ba78
push 0x74
push 1
call fcn.0046f960
mov esi, eax
add esp, 8
test esi, esi
je 0x46ba78
mov eax, dword [0x4a7280]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x46ba78
push esi
call fcn.0046ba80
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
mov dword [esi + 4], 0xffffffff
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret