joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420ef0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x440
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x437150
mov dword [ebp - 0x28], ecx
mov esi, 0x200
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x30], 0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 2
mov dword [ebp - 0x34], 0
cmp esi, 0x201
jae 0x420f80
jmp 0x420f6e
jbe 0x42100c
cmp esi, 0x201
jae 0x420f80
mov dword [ebp - 0x2c], 0x200
lea ebx, [ebp - 0x44c]
mov edi, esi
jmp 0x420fbb
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
sub esi, edi
sub eax, edi
cmp eax, esi
jae 0x420fac
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x3c]
mov edx, edi
push esi
call fcn.00446ae0
add esp, 4
mov edi, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x20], edi
push 0
call dword [sym.imp.kernel32.dll_SetLastError]
push ebx
push edi
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov esi, eax
test eax, eax
jne 0x420fdb
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x421044
cmp esi, edi
jne 0x420f60
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x421082
lea esi, [edi + edi]
test edi, edi
mov eax, 0xffffffff
cmovs esi, eax
cmp esi, 0x201
jb 0x420f6e
jmp 0x420f80
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x10], 0
cmp esi, edx
ja 0x4210a2
lea ecx, [ebp - 0x4c]
mov edx, ebx
push esi
call fcn.00421750
add esp, 4
movsd xmm0, qword [ebp - 0x4c]
mov eax, dword [ebp - 0x28]
movsd xmm1, qword [ebp - 0x44]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
jmp 0x42105a
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [ebp - 0x28]
mov byte [ecx + 4], 0
mov dword [ecx + 8], eax
mov dword [ecx], 0x80000000
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x42106e
mov ecx, dword [ebp - 0x24]
mov edx, 2
call fcn.0040c3d0
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x440
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
mov ecx, str.internal_error:_entered_unreachable_code
mov edx, 0x28
push 0x453670
call fcn.00445e50
add esp, 4
jmp 0x4210b1
mov ecx, esi
push 0x453660
call fcn.00445df0
add esp, 4
ud2
Function at 0x4292b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
push esi
mov eax, dword [0x45c06c]
test eax, eax
je 0x429368
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 2
jb 0x4292dc
cmp dword [eax + 4], 0
mov edi, eax
je 0x4292dc
add edi, 8
jmp 0x429363
mov eax, dword [0x45c06c]
test eax, eax
je 0x429377
dec eax
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp eax, 1
je 0x429361
mov esi, eax
test eax, eax
jne 0x429337
movzx eax, byte [0x45ca98]
mov ecx, 0xc
mov edx, 4
call fcn.0040c370
test eax, eax
je 0x429392
mov dword [eax], 0x45c06c
mov dword [eax + 4], 0
mov esi, eax
mov eax, dword [0x45c06c]
test eax, eax
je 0x429386
dec eax
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, dword [esi + 8]
cmp dword [esi + 4], 0
lea edi, [esi + 8]
mov dword [esi + 4], 1
mov dword [esi + 8], 0
je 0x429363
test ecx, ecx
je 0x429363
lock dec dword [ecx]
jne 0x429363
call fcn.004293b0
jmp 0x429363
xor edi, edi
mov eax, edi
pop esi
pop edi
ret
mov ecx, 0x45c06c
call fcn.00446880
jmp 0x4292c0
mov ecx, 0x45c06c
call fcn.00446880
jmp 0x4292ea
mov ecx, 0x45c06c
call fcn.00446880
jmp 0x42932f
mov ecx, 4
mov edx, 0xc
call fcn.00445bf0
int3
Function at 0x42f940
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
lea ecx, [esp + 0xc]
push dword [esp + 0x38]
call fcn.0041f870
add esp, 4
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
cmp edx, 0x80000000
jne 0x42f97e
mov dword [esp + 4], eax
mov dword [esp + 8], ecx
mov dword [esp], 0x80000000
jmp 0x42f9a0
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], ecx
mov ecx, esp
lea edx, [esp + 0x18]
mov dword [esp + 0x1c], eax
call fcn.0042f870
mov ebx, dword [esp]
cmp ebx, 0x80000000
jne 0x42f9b5
mov ecx, esp
call fcn.0041fa20
mov dword [esi], 0x80000000
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov edi, dword [esp + 4]
mov ebp, dword [esp + 8]
push edi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42f9d3
mov dword [esi], ebx
mov dword [esi + 4], edi
mov dword [esi + 8], ebp
jmp 0x42f9ad
test ebx, ebx
mov dword [esi], 0x80000000
je 0x42f9ad
mov ecx, edi
mov edx, 2
call fcn.0040c3d0
jmp 0x42f9ad
Function at 0x431b90
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1038
call fcn.00437720
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x4373b0
mov edi, ecx
lea eax, [ebp - 0x18]
mov dword [ebp - 0x24], edx
lea esi, [ebp - 0x1044]
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
push 0x1000
push 0
push esi
call fcn.00438840
add esp, 0xc
xorps xmm0, xmm0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x44]
push 0x429c60
push eax
push 0x1000
push esi
push edi
call dword [sym.imp.kernel32.dll_ReadFileEx]
test eax, eax
je 0x431ce4
mov ebx, dword [sym.imp.kernel32.dll_SleepEx]
mov dword [ebp - 0x20], edi
push 1
push 0xffffffffffffffff
call ebx
cmp dword [ebp - 0x30], 0
je 0x431c1a
cmp dword [ebp - 0x2c], 0
jne 0x431cf5
mov esi, dword [ebp - 0x28]
test esi, esi
je 0x431cf5
cmp esi, 0x1000
ja 0x431d31
xor edi, edi
nop dword [eax]
mov eax, esi
sub eax, edi
jb 0x431d17
xorps xmm0, xmm0
lea edx, [ebp - 0x30]
lea ecx, [ebp + edi - 0x1044]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], edx
push 0x429c60
lea edx, [ebp - 0x44]
push edx
push eax
push ecx
push dword [ebp - 0x24]
call dword [sym.imp.kernel32.dll_WriteFileEx]
test eax, eax
je 0x431cec
nop dword [eax]
push 1
push 0xffffffffffffffff
call ebx
cmp dword [ebp - 0x30], 0
je 0x431c90
cmp dword [ebp - 0x2c], 0
jne 0x431cf2
add edi, dword [ebp - 0x28]
cmp edi, esi
jne 0x431c50
xorps xmm0, xmm0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], eax
push 0x429c60
lea eax, [ebp - 0x44]
push eax
push 0x1000
lea eax, [ebp - 0x1044]
push eax
mov edi, dword [ebp - 0x20]
push edi
call dword [sym.imp.kernel32.dll_ReadFileEx]
test eax, eax
jne 0x431c1a
call dword [sym.imp.kernel32.dll_GetLastError]
jmp 0x431cf5
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, dword [ebp - 0x20]
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
push edi
call esi
push dword [ebp - 0x24]
call esi
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x1038
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x10], 0
mov ecx, edi
mov edx, esi
push 0x45314c
call fcn.00445fe0
add esp, 4
jmp 0x431d4c
mov dword [ebp - 0x10], 0
mov ecx, esi
mov edx, 0x1000
push 0x45314c
call fcn.00445df0
add esp, 4
ud2
Function at 0x431e20
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov esi, esp
mov dword [esi + 0x38], ebp
mov dword [esi + 0x3c], esp
mov dword [esi + 0x48], 0xffffffff
mov dword [esi + 0x44], 0x4373d0
lea eax, [esi + 0x40]
xorps xmm0, xmm0
mov ecx, dword fs:[0]
mov dword [esi + 0x40], ecx
mov dword fs:[0], eax
movaps xmmword [esi + 0x10], xmm0
lea eax, [esi + 0x10]
push 0x10
push eax
call dword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x431e84
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
mov edx, esi
lea ecx, [esi + 8]
mov dword [esi + 0x20], 0x453260
mov dword [esi + 0x24], 1
mov dword [esi + 0x30], 0
mov byte [esi], 0
mov dword [esi + 4], eax
mov dword [esi + 0x48], 0
mov dword [esi + 8], edx
mov dword [esi + 0x28], ecx
lea ecx, [esi + 0x20]
mov edx, 0x45328c
mov dword [esi + 0xc], fcn.00425580
mov dword [esi + 0x2c], 1
call fcn.00445d00
ud2
Function at 0x436010
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov ebp, dword [esp + 0x48]
mov ebx, edx
mov edx, dword [ebp + 4]
mov edi, dword [ebp + 8]
mov eax, edx
sub eax, edi
jb 0x4360c2
mov esi, ecx
mov ecx, dword [ebp]
mov dword [esp + 8], 0
mov dword [esp + 4], 0x103
lea edx, [esp + 4]
add ecx, edi
push 0
push 0
push eax
push ecx
push edx
push 0
push 0
push 0
push ebx
call dword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x436070
push 0xffffffffffffffff
push ebx
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 4]
xor ecx, ecx
cmp eax, 0xc0000011
je 0x436088
cmp eax, 0x103
je 0x4360ce
test eax, eax
js 0x4360a3
mov ecx, dword [esp + 8]
add ecx, edi
mov dword [ebp + 8], ecx
mov eax, dword [ebp + 0xc]
cmp eax, ecx
cmova ecx, eax
mov dword [ebp + 0xc], ecx
mov byte [esi], 4
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
mov edi, eax
call fcn.00420130
cmp al, 0xb
je 0x436098
mov dword [esi], 0
mov dword [esi + 4], edi
jmp 0x43609b
mov ecx, edi
push 0x451048
call fcn.00445d30
mov eax, esp
mov dword [esp + 0x1c], 0x452f14
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x10], 0
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x28], 0
push eax
push ecx
push edx
call fcn.0041d550
add esp, 0xc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
call fcn.0041d680
mov ecx, 7
int 0x29
ud2

Function at 0x436130
Capabilities:
Delete file

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov ecx, esp
push dword [esp + 0x28]
call fcn.0041f870
add esp, 4
mov ecx, dword [esp]
mov edi, dword [esp + 4]
mov eax, dword [esp + 8]
cmp ecx, 0x80000000
je 0x436188
mov dword [esp], ecx
mov dword [esp + 4], edi
mov dword [esp + 8], eax
lea ecx, [esp + 0xc]
mov edx, esp
push 1
call fcn.004267d0
add esp, 4
mov ebx, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
cmp ebx, 0x80000000
jne 0x436194
mov eax, dword [esp + 0x14]
mov dword [esi + 4], eax
mov dword [esi], edi
add esp, 0x18
pop esi
pop edi
pop ebx
ret
push edi
call dword [sym.imp.kernel32.dll_DeleteFileW]
test eax, eax
je 0x4361a8
mov byte [esi], 4
test ebx, ebx
jne 0x4361b8
jmp 0x43618d
call dword [sym.imp.kernel32.dll_GetLastError]
mov byte [esi], 0
mov dword [esi + 4], eax
test ebx, ebx
je 0x43618d
mov ecx, edi
mov edx, 2
call fcn.0040c3d0
jmp 0x43618d

Function at 0x437e49
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
je 0x437e88
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x437e88
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x437e88
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x437e88
cmp dword [ecx + 0x74], 0xe
jbe 0x437e88
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x43f063
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.kernel32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x43f100
push ebx
push esi
call fcn.0043f02c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0043efc0
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x43f0ad
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x43f0ff
push edi
push eax
call fcn.0043fc80
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x43f0cd
call fcn.0043db21
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x43f0fe
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0043efc0
add esp, 0x20
test eax, eax
jne 0x43f0ec
push edi
call fcn.0043db21
jmp 0x43f0f4
push ebx
call fcn.0043db21
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4403fd
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x455ec0
push 0x455eb8
push str.FlsAlloc
push 0x1f
call fcn.004402bc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x440431
push dword [ebp + 8]
mov ecx, esi
call dword [0x4481e8]
call esi
jmp 0x440437
call dword [sym.imp.kernel32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x44047b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x455ed0
push 0x455ec8
push str.FlsGetValue
push 0x21
call fcn.004402bc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4404b2
push dword [ebp + 8]
mov ecx, esi
call dword [0x4481e8]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.kernel32.dll_TlsGetValue]

Function at 0x4404ba
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x455ed8
push 0x455ed0
push str.FlsSetValue
push 0x22
call fcn.004402bc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4404f4
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x4481e8]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.kernel32.dll_TlsSetValue]
Function at 0x445960
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x44598d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x44598d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x446880
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
cmp dword [ecx + 4], 0
mov esi, ecx
je 0x4468f1
lea ebx, [esi + 0xc]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0
push eax
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [esp], eax
jne 0x446928
cmp dword [esp + 4], 0
je 0x44690f
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x44693b
mov edi, eax
inc eax
mov dword [esi], eax
mov eax, dword [0x45ca4c]
nop dword [eax]
mov dword [esi + 8], eax
lock cmpxchg dword [0x45ca4c], esi
jne 0x4468d0
mov byte [0x45ca48], 1
push 0
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
jmp 0x44691f
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x44697c
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
jne 0x446913
mov edi, dword [esp]
jmp 0x44691f
mov edi, dword [esi]
jmp 0x44691e
mov edi, eax
push dword [esp]
call dword [sym.imp.kernel32.dll_TlsFree]
dec edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0
call fcn.004469b0
push 0
push 4
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
lea ecx, [esp + 8]
mov edx, 0x453580
mov dword [esp + 8], 0x453548
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0x453d98
mov dword [esp + 0x14], 0
call fcn.00445d00
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0x453548
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 0x453d98
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.004469e0
int3
Function at 0x405e70
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
movsx eax, byte [esi]
test eax, eax
jne 0x405ea4
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea esi, [ebp - 0x10c]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0
push esi
call fcn.00405c80
add esp, 0x14
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
lea eax, [edx + eax*4]
push eax
call fcn.004063c0
pop ecx
mov ebx, eax
test eax, eax
jne 0x405ed7
push 1
call fcn.00405960
pop ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
lea eax, [ebx + eax*4]
push eax
push ebx
push esi
call fcn.00405c80
add esp, 0x14
mov eax, dword [ebp - 4]
dec eax
mov dword [0x456740], eax
mov dword [0x45673c], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x405f10
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov ebx, dword [ebp - 8]
jmp 0x405f48
or eax, 0xffffffff
inc eax
cmp byte [ebx + eax], 0
jne 0x405f31
inc eax
mov esi, eax
movsx eax, byte [ebx]
cmp eax, 0x3d
je 0x405f46
add dword [ebp - 4], esi
add ebx, esi
cmp byte [ebx], 0
jne 0x405f2e
mov eax, dword [ebp - 4]
inc eax
push eax
call fcn.004063c0
pop ecx
mov edi, eax
mov dword [0x456848], eax
test eax, eax
jne 0x405f6b
push 1
call fcn.00405960
pop ecx
mov ebx, dword [ebp - 8]
jmp 0x405f92
or eax, 0xffffffff
inc eax
cmp byte [ebx + eax], 0
jne 0x405f73
inc eax
mov esi, eax
movsx eax, byte [ebx]
cmp eax, 0x3d
je 0x405f90
push ebx
push edi
call fcn.00406c40
pop ecx
pop ecx
add edi, esi
add ebx, esi
movsx eax, byte [ebx]
test eax, eax
jne 0x405f70
mov byte [edi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x444682
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
nop dword [ecx]
test ax, ax
jne 0x47e0ab
jmp 0x44c150
add eax, dword [ebx + 0x1c]
add eax, edi
xchg cl, cl
jmp 0x4673b4
mov ecx, dword fs:[0x30]
mov dl, dl
mov ecx, dword [ecx + 0xc]
jmp 0x43b5e7
push edx
push edi
push esi
jmp 0x47a127
xchg al, al
mov ch, ch
mov edi, dword [ebp + 8]
jmp 0x4834f6
add ebx, dword [ebx + 0x3c]
lea ebx, [ebx + 0x78]
mov eax, dword [ebx + 8]
jmp 0x42bad8
mov ebx, dword [ebx]
add ebx, edi
push dword [ebx + 0x10]
jmp 0x4962e6
push ecx
nop dword [ebp]
xchg cl, cl
jmp 0x419952
add esp, 0xfffffef4
xchg dh, dh
push ebx
jmp 0x47aa51
nop
jne 0x47e0a9
nop dword [ecx]
jmp 0x45dc39
leave
nop dword [edi]
ret 0x10
nop dword [ebx]
mov eax, ecx
shl eax, 1
jmp 0x470de7
nop
xchg ch, ch
add esi, edi
jmp 0x4621f1
sub eax, dword [ebp - 0x10c]
jmp 0x40bad5
sub ecx, 1
jmp 0x45d31e
mov ecx, dword [ecx + 0xc]
mov ecx, dword [ecx]
lea edi, [ebp - 0x104]
jmp 0x48c4b7
cmp al, 0x5b
jg 0x44edb1
nop dword [ebp]
jmp 0x4920a9
push ebp
mov ebp, esp
mov bl, bl
jmp 0x42dcaf
add eax, edi
pop esi
nop dword [esi]
jmp 0x47c0f6
test eax, eax
je 0x43a697
cmp dword [ebp - 0x108], ecx
jmp 0x4514ff
pop eax
call fcn.00440f35
xor eax, dword [ebp + 0xc]
jmp 0x45ff67
nop dword [ecx]
push edi
lea edx, [ecx + 0x30]
jmp 0x459880
stosb byte es:[edi], al
xchg al, al
xchg al, al
jmp 0x45fc28
xor eax, eax
jmp 0x44941c
nop
xchg ah, ah
xchg bh, bh
jmp 0x493f64
shl eax, 2
nop
nop dword [edx]
jmp 0x40bad5
jne 0x4621f8
jmp 0x44f005
pop edx
pop ecx
pop ebx
jmp 0x43220b
mov edx, dword [edx]
or edx, edx
mov ah, ah
jmp 0x431bf2
xchg ch, ch
call fcn.00440f35
xor eax, dword [ebp + 0x10]
jmp 0x44bb90
mov dl, dl
nop dword [ebp]
xchg bh, bh
jmp 0x438502
mov edi, dword [ebp + 0xc]
nop dword [edi]
jmp 0x45ff70
mov eax, dword [ebp + 0x10]
xchg bh, bh
jmp 0x43a68c
inc ebx
nop
nop
jmp 0x40ba6d
jne 0x43b5ea
mov edi, dword [ecx + 0x18]
mov ebx, edi
jmp 0x421a91
xor ecx, ecx
jmp 0x44bb98
mov eax, dword [esi]
jmp 0x44f8e4
xchg bh, bh
mov eax, dword [eax]
mov ch, ch
jmp 0x44941a
nop
add esi, 4
inc ecx
jmp 0x45a6f8
add eax, dword [ebx + 0x24]
add eax, edi
movzx eax, word [eax]
jmp 0x4837c3
push dword [ebx + 0x18]
nop
pop dword [ebp - 0x108]
jmp 0x4833fe
cmp al, 0x40
jl 0x44edb1
xchg dl, dl
jmp 0x442cc6
xchg dh, dh
cmp dword [ebp + 8], 0
je 0x41395b
jmp 0x41f765
pop dword [ebp - 0x10c]
cmp dword [ebp + 0x14], 0
jne 0x45f123
jmp 0x476466
mov ah, ah
mov bh, bh
mov dl, dl
jmp 0x42c328
pop edi
xchg dl, dl
nop
jmp 0x457c03
xor ebx, ebx
mov ax, word [edx + ebx*2]
jmp 0x4764fd
nop
mov al, al
mov esi, dword [ebx + 0x20]
jmp 0x438830
jmp 0x45ff70
nop dword [esp]
mov bl, bl
xchg bh, bh
jmp 0x450f41
nop
nop dword [edi]
xchg ah, ah
jmp 0x44c47a
add al, 0x20
xchg bh, bh
mov cl, cl
jmp 0x44edb1
or eax, eax
jne 0x497a06
nop dword [ebx]
jmp 0x497a00
mov ah, ah
xchg bl, bl
mov ch, ch
jmp 0x47a757
nop
jmp 0x44f005
add eax, edi
jmp 0x4698b9
Function at 0x4e6350
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push 0
push 0x5faa30
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4e639f
push 0
push str.TrayNotifyWnd
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4e639f
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x4e64c3
mov dword [ebp - 0x30], 0x24
lea eax, [ebp - 0x30]
push eax
push 5
call dword [sym.imp.SHELL32.dll_SHAppBarMessage]
test eax, eax
je 0x4e6425
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 3
ja case.default.0x4e63c5
mov edx, dword [ebp - 0xc]
jmp dword [edx*4 + 0x4e64c8]
mov eax, dword [ebp - 0x14]
sub eax, 0x64
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x14]
sub edx, 0x10
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x20]
mov dword [ecx], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 8], ecx
jmp case.default.0x4e63c5
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1c]
mov dword [edx + 4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x14]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 0x18]
sub eax, 0x64
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp - 0x18]
sub edx, 0x10
mov eax, dword [ebp + 8]
mov dword [eax + 8], edx
jmp 0x4e64c3
push 0
push str.Shell_TrayWnd
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4e6493
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 8]
sub edx, dword [ecx]
cmp edx, 0x96
jle 0x4e6471
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
sub ecx, 0x96
mov edx, dword [ebp + 8]
mov dword [edx], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 0xc]
sub edx, dword [ecx + 4]
cmp edx, 0x1e
jle 0x4e6491
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
sub ecx, 0x1e
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
jmp 0x4e64c3
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
sub edx, 0x96
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
sub edx, 0x1e
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
mov esp, ebp
pop ebp
ret