joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4354e8
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edx
xor edx, 0x140ff
pop edx
push ebx
push edx
add esp, 4
sub ebx, 0x6792
or ebx, 0x102ee
pop ebx
push edx
and edx, 0xc22e
call fcn.0043534a
add byte [edx], bh
dec ebx
dec esp
xor al, byte ss:[eax + 0x40]
add esp, 4
pop edx
lea edx, [ebp - 0x16cc]
mov dword [ebp - 0xc28], edx
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc24], ecx
xor edx, edx
mov word [ebp - 0x1fc], dx
xor eax, eax
mov word [ebp - 0x104], ax
push ebx
push esi
add esp, 4
or ebx, 0xd774
sub ebx, 0x12d06
pop ebx
push edi
push ecx
add esp, 4
or edi, 0x123d8
and edi, 0xba8b
pop edi
push ebx
or ebx, 0xf36b
or ebx, 0x7d8b
pop ebx
mov ecx, dword [ebp - 0xc24]
mov dx, word [ecx]
mov word [ebp - 0xf82], dx
mov eax, dword [ebp - 0xc24]
add eax, 2
mov dword [ebp - 0xc24], eax
mov cx, word [ebp - 0xf82]
mov word [ebp - 0x1fc], cx
mov edx, dword [ebp - 0xc28]
mov ax, word [edx]
mov word [ebp - 0xf84], ax
mov ecx, dword [ebp - 0xc28]
add ecx, 2
mov dword [ebp - 0xc28], ecx
mov dx, word [ebp - 0xf84]
mov word [ebp - 0x104], dx
push esi
push eax
add esp, 4
or esi, 0x10e6a
pop esi
push eax
call 0x435423
add byte [eax + 0x49], cl
xor al, 0x3a
inc esp
cmp dword [edi + 0x3e], ecx
xor al, byte [ebx - 0x377efb3c]
rcl byte [ecx], 0
add byte [eax + 0x51], bl
push edx
add esp, 4
xor ecx, 0x868
pop ecx
movzx eax, word [ebp - 0x104]
test eax, eax
jne 0x43545c
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
sub ecx, edx
mov dword [ebp - 0x14e4], ecx
jmp 0x4354bf
movzx eax, word [ebp - 0x1fc]
movzx ecx, word [ebp - 0x104]
cmp eax, ecx
je 0x43537b
movzx edx, word [ebp - 0x1fc]
xor edx, 0x20
movzx eax, word [ebp - 0x104]
cmp edx, eax
je 0x43537b
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
cmp ecx, edx
jge 0x4354a9
mov dword [ebp - 0x14e0], 0xffffffff
jmp 0x4354b3
mov dword [ebp - 0x14e0], 1
mov eax, dword [ebp - 0x14e0]
mov dword [ebp - 0x14e4], eax
cmp dword [ebp - 0x14e4], 0
jne 0x435508
push esi
jmp 0x4354d0
add esi, 0xa38d
pop esi
push ecx
push ecx
add esp, 4
call 0x4354e8
add byte [edi + 0x41], cl
cmp dh, byte [edx]
inc eax
cmp eax, dword [ebx + 0x525904c4]
and edx, 0x7bb
and edx, 0x140c0
pop edx
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp - 0x6ec], ecx
jmp 0x435570
push edx
push esi
add esp, 4
call 0x43551b
add byte [0x40384036], bh
inc eax
dec edx
xor al, 0x83
les eax, [edx + ebx*2]
push edi
jmp 0x435528
jmp 0x43552d
and edi, 0x17f65
xor edi, 0x158ae
pop edi
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx]
mov dword [ebp - 0x4d8], eax
mov ecx, dword [ebp - 0x4d8]
cmp ecx, dword [ebp - 0xc2c]
je 0x435566
mov edx, dword [ebp - 0x4d8]
cmp dword [edx + 0x30], 0
jne 0x43531c
mov dword [ebp - 0x6ec], 0
Function at 0x43551b
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push edx
xor edx, 0x140ff
pop edx
push ebx
push edx
add esp, 4
sub ebx, 0x6792
or ebx, 0x102ee
pop ebx
push edx
and edx, 0xc22e
call fcn.0043534a
add byte [edx], bh
dec ebx
dec esp
xor al, byte ss:[eax + 0x40]
add esp, 4
pop edx
lea edx, [ebp - 0x16cc]
mov dword [ebp - 0xc28], edx
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc24], ecx
xor edx, edx
mov word [ebp - 0x1fc], dx
xor eax, eax
mov word [ebp - 0x104], ax
push ebx
push esi
add esp, 4
or ebx, 0xd774
sub ebx, 0x12d06
pop ebx
push edi
push ecx
add esp, 4
or edi, 0x123d8
and edi, 0xba8b
pop edi
push ebx
or ebx, 0xf36b
or ebx, 0x7d8b
pop ebx
mov ecx, dword [ebp - 0xc24]
mov dx, word [ecx]
mov word [ebp - 0xf82], dx
mov eax, dword [ebp - 0xc24]
add eax, 2
mov dword [ebp - 0xc24], eax
mov cx, word [ebp - 0xf82]
mov word [ebp - 0x1fc], cx
mov edx, dword [ebp - 0xc28]
mov ax, word [edx]
mov word [ebp - 0xf84], ax
mov ecx, dword [ebp - 0xc28]
add ecx, 2
mov dword [ebp - 0xc28], ecx
mov dx, word [ebp - 0xf84]
mov word [ebp - 0x104], dx
push esi
push eax
add esp, 4
or esi, 0x10e6a
pop esi
push eax
call 0x435423
add byte [eax + 0x49], cl
xor al, 0x3a
inc esp
cmp dword [edi + 0x3e], ecx
xor al, byte [ebx - 0x377efb3c]
rcl byte [ecx], 0
add byte [eax + 0x51], bl
push edx
add esp, 4
xor ecx, 0x868
pop ecx
movzx eax, word [ebp - 0x104]
test eax, eax
jne 0x43545c
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
sub ecx, edx
mov dword [ebp - 0x14e4], ecx
jmp 0x4354bf
movzx eax, word [ebp - 0x1fc]
movzx ecx, word [ebp - 0x104]
cmp eax, ecx
je 0x43537b
movzx edx, word [ebp - 0x1fc]
xor edx, 0x20
movzx eax, word [ebp - 0x104]
cmp edx, eax
je 0x43537b
movzx ecx, word [ebp - 0x1fc]
movzx edx, word [ebp - 0x104]
cmp ecx, edx
jge 0x4354a9
mov dword [ebp - 0x14e0], 0xffffffff
jmp 0x4354b3
mov dword [ebp - 0x14e0], 1
mov eax, dword [ebp - 0x14e0]
mov dword [ebp - 0x14e4], eax
cmp dword [ebp - 0x14e4], 0
jne 0x435508
push esi
jmp 0x4354d0
add esi, 0xa38d
pop esi
push ecx
push ecx
add esp, 4
call 0x4354e8
add byte [edi + 0x41], cl
cmp dh, byte [edx]
inc eax
cmp eax, dword [ebx + 0x525904c4]
and edx, 0x7bb
and edx, 0x140c0
pop edx
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp - 0x6ec], ecx
jmp 0x435570
push edx
push esi
add esp, 4
call 0x43551b
add byte [0x40384036], bh
inc eax
dec edx
xor al, 0x83
les eax, [edx + ebx*2]
push edi
jmp 0x435528
jmp 0x43552d
and edi, 0x17f65
xor edi, 0x158ae
pop edi
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx]
mov dword [ebp - 0x4d8], eax
mov ecx, dword [ebp - 0x4d8]
cmp ecx, dword [ebp - 0xc2c]
je 0x435566
mov edx, dword [ebp - 0x4d8]
cmp dword [edx + 0x30], 0
jne 0x43531c
mov dword [ebp - 0x6ec], 0
Function at 0x4363bd
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor ebx, 0x149ae
pop ebx
cmp dword [ebp - 0xc4c], 0
jne 0x4363df
mov dword [ebp - 0x2a8], 0
jmp 0x43662a
mov ecx, dword [ebp - 0xc4c]
mov dword [ebp - 0x4e4], ecx
push edx
push ebx
add esp, 4
add edx, 0x177a7
add edx, 0xfa29
xor edx, 0x463a
pop edx
push edi
and edi, 0x80f6
xor edi, 0x371c
pop edi
push eax
push eax
add esp, 4
xor eax, 0x76a4
pop eax
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc48], edx
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc44], ecx
xor edx, edx
mov word [ebp - 0x204], dx
xor eax, eax
mov word [ebp - 0x38], ax
push eax
or eax, 0x98ea
xor eax, 0xee49
pop eax
push eax
push ecx
add esp, 4
add eax, 0x7172
pop eax
push esi
push edi
add esp, 4
add esi, 0x13469
or esi, 0x57e1
or esi, 0xb337
pop esi
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xf8a], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
add ecx, 2
mov dword [ebp - 0xc48], ecx
mov dx, word [ebp - 0xf8c]
mov word [ebp - 0x38], dx
push edi
call 0x4364df
add byte [ebx + 0x3b], cl
aas
xor eax, 0x3b3c3a4d
add esp, 4
pop edi
push edx
push eax
add esp, 4
or edx, 0x17975
jmp 0x4364f3
pop edx
push ecx
and ecx, 0x124d0
add ecx, 0x2d7b
pop ecx
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x43651f
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1514], ecx
jmp 0x436579
movzx eax, word [ebp - 0x204]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x436447
movzx edx, word [ebp - 0x204]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x436447
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x436563
mov dword [ebp - 0x1510], 0xffffffff
jmp 0x43656d
mov dword [ebp - 0x1510], 1
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x1514], eax
cmp dword [ebp - 0x1514], 0
jne 0x4365c2
push edi
push ebx
add esp, 4
and edi, 0x1660f
pop edi
push edx
call 0x43659d
add byte [eax + edx*2], dh
inc ecx
dec ecx
aas
dec ebp
inc ebx
cmp byte [ebx + 0x515a04c4], al
call 0x4365b0
add byte [edx], bh
cmp dword [edi + 0x4a], ecx
dec esi
dec edi
cmp eax, dword ss:[ebx - 0x74a6fb3c]
lea ebx, [ebx + edi*8]
invalid
push edi
push eax
add esp, 4
xor edi, 0x2bfd
call 0x4365dc
add byte [esi + 0x43], al
dec edx
dec ebx
inc esi
push eax
xor eax, 0xc4834545
add al, 0x5f
push ebx
or ebx, 0xceff
pop ebx
push ecx
push ebx
add esp, 4
xor ecx, 0x57d5
pop ecx
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x436620
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x4363eb
mov dword [ebp - 0x2a8], 0
Function at 0x4364df
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor ebx, 0x149ae
pop ebx
cmp dword [ebp - 0xc4c], 0
jne 0x4363df
mov dword [ebp - 0x2a8], 0
jmp 0x43662a
mov ecx, dword [ebp - 0xc4c]
mov dword [ebp - 0x4e4], ecx
push edx
push ebx
add esp, 4
add edx, 0x177a7
add edx, 0xfa29
xor edx, 0x463a
pop edx
push edi
and edi, 0x80f6
xor edi, 0x371c
pop edi
push eax
push eax
add esp, 4
xor eax, 0x76a4
pop eax
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc48], edx
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc44], ecx
xor edx, edx
mov word [ebp - 0x204], dx
xor eax, eax
mov word [ebp - 0x38], ax
push eax
or eax, 0x98ea
xor eax, 0xee49
pop eax
push eax
push ecx
add esp, 4
add eax, 0x7172
pop eax
push esi
push edi
add esp, 4
add esi, 0x13469
or esi, 0x57e1
or esi, 0xb337
pop esi
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xf8a], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
add ecx, 2
mov dword [ebp - 0xc48], ecx
mov dx, word [ebp - 0xf8c]
mov word [ebp - 0x38], dx
push edi
call 0x4364df
add byte [ebx + 0x3b], cl
aas
xor eax, 0x3b3c3a4d
add esp, 4
pop edi
push edx
push eax
add esp, 4
or edx, 0x17975
jmp 0x4364f3
pop edx
push ecx
and ecx, 0x124d0
add ecx, 0x2d7b
pop ecx
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x43651f
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1514], ecx
jmp 0x436579
movzx eax, word [ebp - 0x204]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x436447
movzx edx, word [ebp - 0x204]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x436447
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x436563
mov dword [ebp - 0x1510], 0xffffffff
jmp 0x43656d
mov dword [ebp - 0x1510], 1
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x1514], eax
cmp dword [ebp - 0x1514], 0
jne 0x4365c2
push edi
push ebx
add esp, 4
and edi, 0x1660f
pop edi
push edx
call 0x43659d
add byte [eax + edx*2], dh
inc ecx
dec ecx
aas
dec ebp
inc ebx
cmp byte [ebx + 0x515a04c4], al
call 0x4365b0
add byte [edx], bh
cmp dword [edi + 0x4a], ecx
dec esi
dec edi
cmp eax, dword ss:[ebx - 0x74a6fb3c]
lea ebx, [ebx + edi*8]
invalid
push edi
push eax
add esp, 4
xor edi, 0x2bfd
call 0x4365dc
add byte [esi + 0x43], al
dec edx
dec ebx
inc esi
push eax
xor eax, 0xc4834545
add al, 0x5f
push ebx
or ebx, 0xceff
pop ebx
push ecx
push ebx
add esp, 4
xor ecx, 0x57d5
pop ecx
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x436620
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x4363eb
mov dword [ebp - 0x2a8], 0
Function at 0x4365b0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor ebx, 0x149ae
pop ebx
cmp dword [ebp - 0xc4c], 0
jne 0x4363df
mov dword [ebp - 0x2a8], 0
jmp 0x43662a
mov ecx, dword [ebp - 0xc4c]
mov dword [ebp - 0x4e4], ecx
push edx
push ebx
add esp, 4
add edx, 0x177a7
add edx, 0xfa29
xor edx, 0x463a
pop edx
push edi
and edi, 0x80f6
xor edi, 0x371c
pop edi
push eax
push eax
add esp, 4
xor eax, 0x76a4
pop eax
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc48], edx
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc44], ecx
xor edx, edx
mov word [ebp - 0x204], dx
xor eax, eax
mov word [ebp - 0x38], ax
push eax
or eax, 0x98ea
xor eax, 0xee49
pop eax
push eax
push ecx
add esp, 4
add eax, 0x7172
pop eax
push esi
push edi
add esp, 4
add esi, 0x13469
or esi, 0x57e1
or esi, 0xb337
pop esi
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xf8a], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
add ecx, 2
mov dword [ebp - 0xc48], ecx
mov dx, word [ebp - 0xf8c]
mov word [ebp - 0x38], dx
push edi
call 0x4364df
add byte [ebx + 0x3b], cl
aas
xor eax, 0x3b3c3a4d
add esp, 4
pop edi
push edx
push eax
add esp, 4
or edx, 0x17975
jmp 0x4364f3
pop edx
push ecx
and ecx, 0x124d0
add ecx, 0x2d7b
pop ecx
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x43651f
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1514], ecx
jmp 0x436579
movzx eax, word [ebp - 0x204]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x436447
movzx edx, word [ebp - 0x204]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x436447
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x436563
mov dword [ebp - 0x1510], 0xffffffff
jmp 0x43656d
mov dword [ebp - 0x1510], 1
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x1514], eax
cmp dword [ebp - 0x1514], 0
jne 0x4365c2
push edi
push ebx
add esp, 4
and edi, 0x1660f
pop edi
push edx
call 0x43659d
add byte [eax + edx*2], dh
inc ecx
dec ecx
aas
dec ebp
inc ebx
cmp byte [ebx + 0x515a04c4], al
call 0x4365b0
add byte [edx], bh
cmp dword [edi + 0x4a], ecx
dec esi
dec edi
cmp eax, dword ss:[ebx - 0x74a6fb3c]
lea ebx, [ebx + edi*8]
invalid
push edi
push eax
add esp, 4
xor edi, 0x2bfd
call 0x4365dc
add byte [esi + 0x43], al
dec edx
dec ebx
inc esi
push eax
xor eax, 0xc4834545
add al, 0x5f
push ebx
or ebx, 0xceff
pop ebx
push ecx
push ebx
add esp, 4
xor ecx, 0x57d5
pop ecx
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x436620
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x4363eb
mov dword [ebp - 0x2a8], 0
Function at 0x4365dc
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
xor ebx, 0x149ae
pop ebx
cmp dword [ebp - 0xc4c], 0
jne 0x4363df
mov dword [ebp - 0x2a8], 0
jmp 0x43662a
mov ecx, dword [ebp - 0xc4c]
mov dword [ebp - 0x4e4], ecx
push edx
push ebx
add esp, 4
add edx, 0x177a7
add edx, 0xfa29
xor edx, 0x463a
pop edx
push edi
and edi, 0x80f6
xor edi, 0x371c
pop edi
push eax
push eax
add esp, 4
xor eax, 0x76a4
pop eax
lea edx, [ebp - 0x1628]
mov dword [ebp - 0xc48], edx
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xc44], ecx
xor edx, edx
mov word [ebp - 0x204], dx
xor eax, eax
mov word [ebp - 0x38], ax
push eax
or eax, 0x98ea
xor eax, 0xee49
pop eax
push eax
push ecx
add esp, 4
add eax, 0x7172
pop eax
push esi
push edi
add esp, 4
add esi, 0x13469
or esi, 0x57e1
or esi, 0xb337
pop esi
mov ecx, dword [ebp - 0xc44]
mov dx, word [ecx]
mov word [ebp - 0xf8a], dx
mov eax, dword [ebp - 0xc44]
add eax, 2
mov dword [ebp - 0xc44], eax
mov cx, word [ebp - 0xf8a]
mov word [ebp - 0x204], cx
mov edx, dword [ebp - 0xc48]
mov ax, word [edx]
mov word [ebp - 0xf8c], ax
mov ecx, dword [ebp - 0xc48]
add ecx, 2
mov dword [ebp - 0xc48], ecx
mov dx, word [ebp - 0xf8c]
mov word [ebp - 0x38], dx
push edi
call 0x4364df
add byte [ebx + 0x3b], cl
aas
xor eax, 0x3b3c3a4d
add esp, 4
pop edi
push edx
push eax
add esp, 4
or edx, 0x17975
jmp 0x4364f3
pop edx
push ecx
and ecx, 0x124d0
add ecx, 0x2d7b
pop ecx
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x43651f
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x1514], ecx
jmp 0x436579
movzx eax, word [ebp - 0x204]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x436447
movzx edx, word [ebp - 0x204]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x436447
movzx ecx, word [ebp - 0x204]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x436563
mov dword [ebp - 0x1510], 0xffffffff
jmp 0x43656d
mov dword [ebp - 0x1510], 1
mov eax, dword [ebp - 0x1510]
mov dword [ebp - 0x1514], eax
cmp dword [ebp - 0x1514], 0
jne 0x4365c2
push edi
push ebx
add esp, 4
and edi, 0x1660f
pop edi
push edx
call 0x43659d
add byte [eax + edx*2], dh
inc ecx
dec ecx
aas
dec ebp
inc ebx
cmp byte [ebx + 0x515a04c4], al
call 0x4365b0
add byte [edx], bh
cmp dword [edi + 0x4a], ecx
dec esi
dec edi
cmp eax, dword ss:[ebx - 0x74a6fb3c]
lea ebx, [ebx + edi*8]
invalid
push edi
push eax
add esp, 4
xor edi, 0x2bfd
call 0x4365dc
add byte [esi + 0x43], al
dec edx
dec ebx
inc esi
push eax
xor eax, 0xc4834545
add al, 0x5f
push ebx
or ebx, 0xceff
pop ebx
push ecx
push ebx
add esp, 4
xor ecx, 0x57d5
pop ecx
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x4e4], eax
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [ebp - 0xc4c]
je 0x436620
mov edx, dword [ebp - 0x4e4]
cmp dword [edx + 0x30], 0
jne 0x4363eb
mov dword [ebp - 0x2a8], 0
Function at 0x437180
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov esp, 0xf590000
mov bh, 0x4d
rol byte [ebp + 0xf1575c9], 0xb7
xchg ebp, eax
hlt
Function at 0x44f6ee
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
push edi
mov dword [esi + 8], eax
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x50], ebx
call fcn.0047eea3
test eax, eax
setne al
mov byte [esi + 0x58], al
lea eax, [ebp - 4]
push eax
push 1
push ebx
push str.Control_PanelDesktop
push SysReAllocString
mov dword [esi + 0xfc], ebx
mov byte [esi + 0x100], 1
mov dword [esi + 0x5c], ebx
mov byte [esi + 0x10c], bl
mov dword [esi + 0x110], 0x1f4
mov byte [esi + 0x114], bl
mov byte [esi + 0x115], bl
mov byte [esi + 0x116], bl
xor edi, edi
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x44f76a
mov edi, dword [ebp - 4]
xor eax, eax
cmp eax, ebx
jl 0x44f7ac
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push str.DragFullWindows
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x44f79d
cmp dword [ebp - 0x10], 4
jne 0x44f79f
xor eax, eax
cmp eax, ebx
jl 0x44f7ac
cmp dword [ebp - 8], 0x31
sete al
mov byte [esi + 0x116], al
cmp edi, ebx
mov dword [esi + 0x118], ebx
mov dword [esi + 0x11c], ebx
mov dword [esi + 0x120], ebx
je 0x44f7c9
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
leave
ret

Function at 0x44fb11
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x304
mov eax, dword [0x4d4028]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x100
lea eax, [ebp - 0x104]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
mov ecx, str.Button
lea eax, [ebp - 0x104]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x44fb68
test dx, dx
je 0x44fb64
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x44fb68
add eax, 4
add ecx, 4
test dx, dx
jne 0x44fb42
xor eax, eax
jmp 0x44fb6d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x44fbb7
push 0xfffffffffffffff0
push esi
call dword [sym.imp.USER32.dll_GetWindowLongW]
test al, 7
je 0x44fbb7
test eax, 0x10000000
jne 0x44fbb7
push 0x200
lea eax, [ebp - 0x304]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xa
lea eax, [ebp - 0x304]
push str._Geometry:
push eax
call dword [0x4a3140]
add esp, 0xc
neg eax
sbb al, al
inc al
jmp 0x44fbb9
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00490f79
leave
ret
Function at 0x44fc76
Capabilities:
Get graphical window text

Disassembly:
push 0x314
mov eax, 0x49c9d9
call fcn.00492097
mov eax, dword [edi + 8]
test eax, eax
je 0x44fc8f
mov eax, dword [eax + 0x20]
mov ebx, dword [sym.imp.USER32.dll_GetWindow]
push 5
push eax
jmp 0x44fe24
mov esi, dword [ebp - 0x218]
call fcn.0044fb11
test al, al
je 0x44fe1c
push 0x100
lea eax, [ebp - 0x214]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x214]
push str._Geometry:
push eax
call dword [0x4a3144]
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x220], eax
je 0x44fce8
add dword [ebp - 0x220], 0x14
mov eax, dword [edi + 8]
test eax, eax
je 0x44fcf2
mov eax, dword [eax + 0x20]
push 5
push eax
jmp 0x44fe0c
mov esi, dword [ebp - 0x21c]
call fcn.0044fb11
test al, al
jne 0x44fe04
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x250]
push eax
push dword [ebp - 0x218]
call esi
lea eax, [ebp - 0x240]
push eax
push dword [ebp - 0x21c]
call esi
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.USER32.dll_IntersectRect]
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.USER32.dll_EqualRect]
test eax, eax
je 0x44fe04
xor eax, eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], eax
push dword [ebp - 0x220]
lea esi, [ebp - 0x320]
mov dword [ebp - 4], eax
call fcn.00416ab0
mov byte [ebp - 4], 1
push dword [eax]
lea eax, [ebp - 0x29c]
push eax
lea ebx, [ebp - 0x230]
call fcn.00403d20
mov esi, eax
push dword [ebp - 0x21c]
mov byte [ebp - 4], 2
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push dword [edi + 8]
lea ecx, [edi + 0x2c]
push esi
push ecx
mov ecx, eax
call fcn.0045044c
lea esi, [ebp - 0x29c]
call fcn.00403ff0
lea eax, [ebp - 0x31c]
cmp dword [ebp - 0x320], eax
je 0x44fdef
push dword [ebp - 0x320]
call dword [0x4a308c]
pop ecx
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0x230]
call fcn.00440760
mov ebx, dword [sym.imp.USER32.dll_GetWindow]
push 2
push dword [ebp - 0x21c]
call ebx
test eax, eax
mov dword [ebp - 0x21c], eax
jne 0x44fcfa
push 2
push dword [ebp - 0x218]
call ebx
test eax, eax
mov dword [ebp - 0x218], eax
jne 0x44fc9d
call fcn.0049211a
ret
Function at 0x45b513
Capabilities:
Check if file exists
Get common file path
Get disk information
Get file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x5a4]
sub esp, 0x624
mov eax, dword [0x4d4028]
xor eax, ebp
mov dword [ebp + 0x5a0], eax
mov eax, dword [ebp + 0x5ac]
push ebx
push esi
push edi
xor ebx, ebx
mov edi, 0x206
push edi
mov dword [ebp - 0x7c], eax
lea eax, [ebp + 0x39a]
push ebx
push eax
mov dword [ebp - 0x80], ebx
mov word [ebp + 0x398], bx
call fcn.00491fe0
add esp, 0xc
lea eax, [ebp + 0x398]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
lea eax, [ebp + 0x398]
push eax
je 0x45b62a
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x45b5d0
lea eax, [ebp + 0x398]
push eax
call fcn.0045b10d
test eax, eax
pop ecx
jne 0x45b5d0
push 0x4ae5e4
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45b623
xor eax, eax
movzx ecx, word [eax + 0x4ae5e8]
mov word [ebp + eax + 0x398], cx
inc eax
inc eax
cmp cx, bx
jne 0x45b5ab
lea eax, [ebp + 0x398]
push eax
call fcn.0045b10d
pop ecx
jmp 0x45b631
push edi
lea eax, [ebp + 0x192]
push ebx
push eax
mov word [ebp + 0x190], bx
call fcn.00491fe0
add esp, 0xc
push esi
lea eax, [ebp + 0x190]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edi, eax
lea eax, [ebp + 0x190]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
cmp edi, ebx
je 0x45b631
lea eax, [ebp + 0x190]
push eax
lea eax, [ebp + 0x398]
push eax
call dword [0x4a3120]
test eax, eax
pop ecx
pop ecx
jne 0x45b631
lea eax, [ebp + 0x398]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor eax, eax
movzx ecx, word [ebp + eax + 0x398]
mov word [ebp + eax - 0x78], cx
inc eax
inc eax
cmp cx, bx
jne 0x45b633
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.SHLWAPI.dll_PathStripToRootW]
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x45b67f
cmp eax, 6
je 0x45b67f
xor eax, eax
movzx ecx, word [eax + 0x4ae5e8]
mov word [ebp + eax + 0x398], cx
inc eax
inc eax
cmp cx, bx
jne 0x45b667
jmp 0x45b68c
lea eax, [ebp + 0x398]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov ecx, dword [ebp - 0x7c]
lea eax, [ebp + 0x398]
push eax
call dword [0x4a2ed8]
mov ecx, dword [ebp + 0x5a0]
mov eax, dword [ebp - 0x7c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00490f79
add ebp, 0x5a4
leave
ret