joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425810
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5a0c88
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5f4964]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov eax, dword [esp + 0x24]
test eax, eax
je 0x42590c
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x1c], 0
cmp dword [0x5f6424], ebx
je 0x42590c
test ebx, ebx
je 0x42590c
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
jne 0x4258ae
cmp dword [0x5f6424], ebx
je 0x425899
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
mov edi, dword [esp + 0x28]
call fcn.00425980
test eax, eax
je 0x425903
push 0
lea ecx, [esp + 0x14]
push ecx
push esi
push eax
push ebx
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4258fc
mov esi, edi
call fcn.0041b010
lea ecx, [esp + 0x24]
call fcn.004257c0
mov al, 1
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
mov ecx, edi
call fcn.00418b50
lea ecx, [esp + 0x24]
call fcn.004257c0
xor al, al
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x425930
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x14], 0
push esi
je 0x425966
cmp dword [eax + 0x18], 8
jb 0x425946
mov esi, dword [eax + 4]
jmp 0x425949
lea esi, [eax + 4]
test esi, esi
je 0x425966
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x42596a
push esi
push 0
call dword [0x5a43d4]
test eax, eax
je 0x42596e
xor eax, eax
pop esi
ret
test al, 0x10
je 0x425966
mov eax, 1
pop esi
ret

Function at 0x4270d0
Capabilities:
Read file on windows

Disassembly:
push ecx
push 0
lea eax, [esp + 4]
push eax
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x427102
push str.ReadFile__
push 0xfc
push str..QHImageHlp.c
xor edx, edx
call fcn.0042ab30
add esp, 0xc
xor eax, eax
pop ecx
ret
cmp esi, dword [esp]
je 0x427127
push 0x5caa30
push 0xfe
push str..QHImageHlp.c
mov edx, 1
call fcn.0042ac60
add esp, 0xc
xor eax, eax
pop ecx
ret
mov eax, 1
pop ecx
ret
Function at 0x42bd89
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ecx
push esi
push ebx
add esp, 4
or esi, 0x2c84
pop esi
mov ecx, dword [ebp - 0x504]
mov edx, dword [ecx]
mov dword [ebp - 0x504], edx
mov eax, dword [ebp - 0x504]
cmp eax, dword [ebp - 0xc98]
je 0x42bdc5
mov ecx, dword [ebp - 0x504]
cmp dword [ecx + 0x30], 0
jne 0x42bb7b
mov dword [ebp - 0x31c], 0
Function at 0x42d154
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
and ecx, 0xb3e4
jmp 0x42d147
call fcn.0042d154
add byte [edx + 0x36], al
dec edi
cmp dword [edx + 0x46], eax
cmp al, byte [ebx + 0x4eb04c4]
add esp, 4
jmp 0x42d15d
cmp esi, dword [edi + 0x57525936]
add esp, 4
jmp 0x42d15d
pop ecx
push edx
push edi
add esp, 4
or edx, 0x13673
pop edx
mov ecx, dword [ebp - 0xcbc]
mov dx, word [ecx]
mov word [ebp - 0x103e], dx
mov eax, dword [ebp - 0xcbc]
add eax, 2
mov dword [ebp - 0xcbc], eax
mov cx, word [ebp - 0x103e]
mov word [ebp - 0x21c], cx
mov edx, dword [ebp - 0xcc0]
mov ax, word [edx]
mov word [ebp - 0x1040], ax
mov ecx, dword [ebp - 0xcc0]
add ecx, 2
mov dword [ebp - 0xcc0], ecx
mov dx, word [ebp - 0x1040]
mov word [ebp - 0x38], dx
push edx
call 0x42d1d1
add byte [ebp + 0x47], al
dec edi
cmp eax, 0x3545334a
add esp, 4
or edx, 0x17a50
pop edx
push ebx
push esi
add esp, 4
add ebx, 0x11d87
sub ebx, 0xeefb
add ebx, 0x502e
pop ebx
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x42d210
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x161c], ecx
jmp 0x42d26a
movzx eax, word [ebp - 0x21c]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x42d138
movzx edx, word [ebp - 0x21c]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x42d138
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x42d254
mov dword [ebp - 0x1618], 0xffffffff
jmp 0x42d25e
mov dword [ebp - 0x1618], 1
mov eax, dword [ebp - 0x1618]
mov dword [ebp - 0x161c], eax
cmp dword [ebp - 0x161c], 0
jne 0x42d2b3
push esi
call 0x42d280
add byte [0x32493749], dh
inc esp
add esp, 4
jmp 0x42d28a
pop esi
push edx
push eax
add esp, 4
sub edx, 0x174e2
pop edx
push ecx
and ecx, 0x150c9
add ecx, 0x19fd
pop ecx
mov ecx, dword [ebp - 0x514]
mov dword [ebp - 0x2fc], ecx
jmp 0x42d31b
push ebx
add ebx, 0x9561
or ebx, 0x3277
and ebx, 0x32e2
pop ebx
push ecx
jmp 0x42d2d0
pop ecx
push esi
or esi, 0x170e2
or esi, 0x4740
and esi, 0x98f9
pop esi
mov edx, dword [ebp - 0x514]
mov eax, dword [edx]
mov dword [ebp - 0x514], eax
mov ecx, dword [ebp - 0x514]
cmp ecx, dword [ebp - 0xcc4]
je 0x42d311
mov edx, dword [ebp - 0x514]
cmp dword [edx + 0x30], 0
jne 0x42d0dc
mov dword [ebp - 0x2fc], 0
Function at 0x42d1d1
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
and ecx, 0xb3e4
jmp 0x42d147
call fcn.0042d154
add byte [edx + 0x36], al
dec edi
cmp dword [edx + 0x46], eax
cmp al, byte [ebx + 0x4eb04c4]
add esp, 4
jmp 0x42d15d
cmp esi, dword [edi + 0x57525936]
add esp, 4
jmp 0x42d15d
pop ecx
push edx
push edi
add esp, 4
or edx, 0x13673
pop edx
mov ecx, dword [ebp - 0xcbc]
mov dx, word [ecx]
mov word [ebp - 0x103e], dx
mov eax, dword [ebp - 0xcbc]
add eax, 2
mov dword [ebp - 0xcbc], eax
mov cx, word [ebp - 0x103e]
mov word [ebp - 0x21c], cx
mov edx, dword [ebp - 0xcc0]
mov ax, word [edx]
mov word [ebp - 0x1040], ax
mov ecx, dword [ebp - 0xcc0]
add ecx, 2
mov dword [ebp - 0xcc0], ecx
mov dx, word [ebp - 0x1040]
mov word [ebp - 0x38], dx
push edx
call 0x42d1d1
add byte [ebp + 0x47], al
dec edi
cmp eax, 0x3545334a
add esp, 4
or edx, 0x17a50
pop edx
push ebx
push esi
add esp, 4
add ebx, 0x11d87
sub ebx, 0xeefb
add ebx, 0x502e
pop ebx
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x42d210
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x161c], ecx
jmp 0x42d26a
movzx eax, word [ebp - 0x21c]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x42d138
movzx edx, word [ebp - 0x21c]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x42d138
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x42d254
mov dword [ebp - 0x1618], 0xffffffff
jmp 0x42d25e
mov dword [ebp - 0x1618], 1
mov eax, dword [ebp - 0x1618]
mov dword [ebp - 0x161c], eax
cmp dword [ebp - 0x161c], 0
jne 0x42d2b3
push esi
call 0x42d280
add byte [0x32493749], dh
inc esp
add esp, 4
jmp 0x42d28a
pop esi
push edx
push eax
add esp, 4
sub edx, 0x174e2
pop edx
push ecx
and ecx, 0x150c9
add ecx, 0x19fd
pop ecx
mov ecx, dword [ebp - 0x514]
mov dword [ebp - 0x2fc], ecx
jmp 0x42d31b
push ebx
add ebx, 0x9561
or ebx, 0x3277
and ebx, 0x32e2
pop ebx
push ecx
jmp 0x42d2d0
pop ecx
push esi
or esi, 0x170e2
or esi, 0x4740
and esi, 0x98f9
pop esi
mov edx, dword [ebp - 0x514]
mov eax, dword [edx]
mov dword [ebp - 0x514], eax
mov ecx, dword [ebp - 0x514]
cmp ecx, dword [ebp - 0xcc4]
je 0x42d311
mov edx, dword [ebp - 0x514]
cmp dword [edx + 0x30], 0
jne 0x42d0dc
mov dword [ebp - 0x2fc], 0
Function at 0x42d280
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ecx
and ecx, 0xb3e4
jmp 0x42d147
call fcn.0042d154
add byte [edx + 0x36], al
dec edi
cmp dword [edx + 0x46], eax
cmp al, byte [ebx + 0x4eb04c4]
add esp, 4
jmp 0x42d15d
cmp esi, dword [edi + 0x57525936]
add esp, 4
jmp 0x42d15d
pop ecx
push edx
push edi
add esp, 4
or edx, 0x13673
pop edx
mov ecx, dword [ebp - 0xcbc]
mov dx, word [ecx]
mov word [ebp - 0x103e], dx
mov eax, dword [ebp - 0xcbc]
add eax, 2
mov dword [ebp - 0xcbc], eax
mov cx, word [ebp - 0x103e]
mov word [ebp - 0x21c], cx
mov edx, dword [ebp - 0xcc0]
mov ax, word [edx]
mov word [ebp - 0x1040], ax
mov ecx, dword [ebp - 0xcc0]
add ecx, 2
mov dword [ebp - 0xcc0], ecx
mov dx, word [ebp - 0x1040]
mov word [ebp - 0x38], dx
push edx
call 0x42d1d1
add byte [ebp + 0x47], al
dec edi
cmp eax, 0x3545334a
add esp, 4
or edx, 0x17a50
pop edx
push ebx
push esi
add esp, 4
add ebx, 0x11d87
sub ebx, 0xeefb
add ebx, 0x502e
pop ebx
movzx eax, word [ebp - 0x38]
test eax, eax
jne 0x42d210
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
sub ecx, edx
mov dword [ebp - 0x161c], ecx
jmp 0x42d26a
movzx eax, word [ebp - 0x21c]
movzx ecx, word [ebp - 0x38]
cmp eax, ecx
je 0x42d138
movzx edx, word [ebp - 0x21c]
xor edx, 0x20
movzx eax, word [ebp - 0x38]
cmp edx, eax
je 0x42d138
movzx ecx, word [ebp - 0x21c]
movzx edx, word [ebp - 0x38]
cmp ecx, edx
jge 0x42d254
mov dword [ebp - 0x1618], 0xffffffff
jmp 0x42d25e
mov dword [ebp - 0x1618], 1
mov eax, dword [ebp - 0x1618]
mov dword [ebp - 0x161c], eax
cmp dword [ebp - 0x161c], 0
jne 0x42d2b3
push esi
call 0x42d280
add byte [0x32493749], dh
inc esp
add esp, 4
jmp 0x42d28a
pop esi
push edx
push eax
add esp, 4
sub edx, 0x174e2
pop edx
push ecx
and ecx, 0x150c9
add ecx, 0x19fd
pop ecx
mov ecx, dword [ebp - 0x514]
mov dword [ebp - 0x2fc], ecx
jmp 0x42d31b
push ebx
add ebx, 0x9561
or ebx, 0x3277
and ebx, 0x32e2
pop ebx
push ecx
jmp 0x42d2d0
pop ecx
push esi
or esi, 0x170e2
or esi, 0x4740
and esi, 0x98f9
pop esi
mov edx, dword [ebp - 0x514]
mov eax, dword [edx]
mov dword [ebp - 0x514], eax
mov ecx, dword [ebp - 0x514]
cmp ecx, dword [ebp - 0xcc4]
je 0x42d311
mov edx, dword [ebp - 0x514]
cmp dword [edx + 0x30], 0
jne 0x42d0dc
mov dword [ebp - 0x2fc], 0
Function at 0x42d5c3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
call fcn.0042d5c3
add byte [edi + 0x4f], al
inc edx
cmp dword [0x4c4834a], edi
add esp, 4
add esp, 4
and eax, 0x1774c
xor eax, 0xa0f6
jmp 0x42d5db
pop eax
push esi
push ebx
add esp, 4
xor esi, 0x16389
pop esi
mov edx, dword [ebp - 0xcc8]
mov ax, word [edx]
mov word [ebp - 0x1042], ax
mov ecx, dword [ebp - 0xcc8]
add ecx, 2
mov dword [ebp - 0xcc8], ecx
mov dx, word [ebp - 0x1042]
mov word [ebp - 0x220], dx
mov eax, dword [ebp - 0xccc]
mov cx, word [eax]
mov word [ebp - 0x1044], cx
mov edx, dword [ebp - 0xccc]
add edx, 2
mov dword [ebp - 0xccc], edx
mov ax, word [ebp - 0x1044]
mov word [ebp - 0x3c], ax
push eax
push esi
add esp, 4
xor eax, 0x14fae
sub eax, 0x8a37
pop eax
push ecx
push ebx
add esp, 4
add ecx, 0x10a57
pop ecx
push ecx
and ecx, 0x17891
pop ecx
push edi
push esi
add esp, 4
and edi, 0x6147
pop edi
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x42d68e
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1668], edx
jmp 0x42d6e8
movzx ecx, word [ebp - 0x220]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x42d5b6
movzx eax, word [ebp - 0x220]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x42d5b6
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x42d6d2
mov dword [ebp - 0x1624], 0xffffffff
jmp 0x42d6dc
mov dword [ebp - 0x1624], 1
mov ecx, dword [ebp - 0x1624]
mov dword [ebp - 0x1668], ecx
cmp dword [ebp - 0x1668], 0
jne 0x42d731
push edi
push edx
add esp, 4
jmp 0x42d6ff
add edi, 0x61a2
and edi, 0x13fef
pop edi
push esi
add esi, 0x155b1
call 0x42d71f
add byte [edx + ecx*2 + 0x4b], al
dec esp
cmp al, byte [edi - 0x7d]
les eax, [esi + ebx*2]
mov edx, dword [ebp - 0x518]
mov dword [ebp - 0x774], edx
jmp 0x42d799
push esi
push eax
add esp, 4
call 0x42d744
add byte [edx + 0x45], al
cmp eax, 0x4e504e4f
inc edx
add esp, 4
xor esi, 0xd0d5
pop esi
push edx
push edi
add esp, 4
and edx, 0x5884
jmp 0x42d762
pop edx
mov eax, dword [ebp - 0x518]
mov ecx, dword [eax]
mov dword [ebp - 0x518], ecx
mov edx, dword [ebp - 0x518]
cmp edx, dword [ebp - 0xcd0]
je 0x42d78f
mov eax, dword [ebp - 0x518]
cmp dword [eax + 0x30], 0
jne 0x42d55a
mov dword [ebp - 0x774], 0
Function at 0x42d71f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
call fcn.0042d5c3
add byte [edi + 0x4f], al
inc edx
cmp dword [0x4c4834a], edi
add esp, 4
add esp, 4
and eax, 0x1774c
xor eax, 0xa0f6
jmp 0x42d5db
pop eax
push esi
push ebx
add esp, 4
xor esi, 0x16389
pop esi
mov edx, dword [ebp - 0xcc8]
mov ax, word [edx]
mov word [ebp - 0x1042], ax
mov ecx, dword [ebp - 0xcc8]
add ecx, 2
mov dword [ebp - 0xcc8], ecx
mov dx, word [ebp - 0x1042]
mov word [ebp - 0x220], dx
mov eax, dword [ebp - 0xccc]
mov cx, word [eax]
mov word [ebp - 0x1044], cx
mov edx, dword [ebp - 0xccc]
add edx, 2
mov dword [ebp - 0xccc], edx
mov ax, word [ebp - 0x1044]
mov word [ebp - 0x3c], ax
push eax
push esi
add esp, 4
xor eax, 0x14fae
sub eax, 0x8a37
pop eax
push ecx
push ebx
add esp, 4
add ecx, 0x10a57
pop ecx
push ecx
and ecx, 0x17891
pop ecx
push edi
push esi
add esp, 4
and edi, 0x6147
pop edi
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x42d68e
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1668], edx
jmp 0x42d6e8
movzx ecx, word [ebp - 0x220]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x42d5b6
movzx eax, word [ebp - 0x220]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x42d5b6
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x42d6d2
mov dword [ebp - 0x1624], 0xffffffff
jmp 0x42d6dc
mov dword [ebp - 0x1624], 1
mov ecx, dword [ebp - 0x1624]
mov dword [ebp - 0x1668], ecx
cmp dword [ebp - 0x1668], 0
jne 0x42d731
push edi
push edx
add esp, 4
jmp 0x42d6ff
add edi, 0x61a2
and edi, 0x13fef
pop edi
push esi
add esi, 0x155b1
call 0x42d71f
add byte [edx + ecx*2 + 0x4b], al
dec esp
cmp al, byte [edi - 0x7d]
les eax, [esi + ebx*2]
mov edx, dword [ebp - 0x518]
mov dword [ebp - 0x774], edx
jmp 0x42d799
push esi
push eax
add esp, 4
call 0x42d744
add byte [edx + 0x45], al
cmp eax, 0x4e504e4f
inc edx
add esp, 4
xor esi, 0xd0d5
pop esi
push edx
push edi
add esp, 4
and edx, 0x5884
jmp 0x42d762
pop edx
mov eax, dword [ebp - 0x518]
mov ecx, dword [eax]
mov dword [ebp - 0x518], ecx
mov edx, dword [ebp - 0x518]
cmp edx, dword [ebp - 0xcd0]
je 0x42d78f
mov eax, dword [ebp - 0x518]
cmp dword [eax + 0x30], 0
jne 0x42d55a
mov dword [ebp - 0x774], 0
Function at 0x42d744
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
call fcn.0042d5c3
add byte [edi + 0x4f], al
inc edx
cmp dword [0x4c4834a], edi
add esp, 4
add esp, 4
and eax, 0x1774c
xor eax, 0xa0f6
jmp 0x42d5db
pop eax
push esi
push ebx
add esp, 4
xor esi, 0x16389
pop esi
mov edx, dword [ebp - 0xcc8]
mov ax, word [edx]
mov word [ebp - 0x1042], ax
mov ecx, dword [ebp - 0xcc8]
add ecx, 2
mov dword [ebp - 0xcc8], ecx
mov dx, word [ebp - 0x1042]
mov word [ebp - 0x220], dx
mov eax, dword [ebp - 0xccc]
mov cx, word [eax]
mov word [ebp - 0x1044], cx
mov edx, dword [ebp - 0xccc]
add edx, 2
mov dword [ebp - 0xccc], edx
mov ax, word [ebp - 0x1044]
mov word [ebp - 0x3c], ax
push eax
push esi
add esp, 4
xor eax, 0x14fae
sub eax, 0x8a37
pop eax
push ecx
push ebx
add esp, 4
add ecx, 0x10a57
pop ecx
push ecx
and ecx, 0x17891
pop ecx
push edi
push esi
add esp, 4
and edi, 0x6147
pop edi
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x42d68e
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1668], edx
jmp 0x42d6e8
movzx ecx, word [ebp - 0x220]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x42d5b6
movzx eax, word [ebp - 0x220]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x42d5b6
movzx edx, word [ebp - 0x220]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x42d6d2
mov dword [ebp - 0x1624], 0xffffffff
jmp 0x42d6dc
mov dword [ebp - 0x1624], 1
mov ecx, dword [ebp - 0x1624]
mov dword [ebp - 0x1668], ecx
cmp dword [ebp - 0x1668], 0
jne 0x42d731
push edi
push edx
add esp, 4
jmp 0x42d6ff
add edi, 0x61a2
and edi, 0x13fef
pop edi
push esi
add esi, 0x155b1
call 0x42d71f
add byte [edx + ecx*2 + 0x4b], al
dec esp
cmp al, byte [edi - 0x7d]
les eax, [esi + ebx*2]
mov edx, dword [ebp - 0x518]
mov dword [ebp - 0x774], edx
jmp 0x42d799
push esi
push eax
add esp, 4
call 0x42d744
add byte [edx + 0x45], al
cmp eax, 0x4e504e4f
inc edx
add esp, 4
xor esi, 0xd0d5
pop esi
push edx
push edi
add esp, 4
and edx, 0x5884
jmp 0x42d762
pop edx
mov eax, dword [ebp - 0x518]
mov ecx, dword [eax]
mov dword [ebp - 0x518], ecx
mov edx, dword [ebp - 0x518]
cmp edx, dword [ebp - 0xcd0]
je 0x42d78f
mov eax, dword [ebp - 0x518]
cmp dword [eax + 0x30], 0
jne 0x42d55a
mov dword [ebp - 0x774], 0
Function at 0x44b750
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58f528
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x5f4964]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
cmp dword [ebp + 8], 0
je 0x44b786
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
jmp 0x44b78f
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
jne 0x44b7a2
xor al, al
jmp 0x44b92d
mov dword [ebp - 0x10], 0
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [0x5a43b4]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x44b7c7
xor al, al
jmp 0x44b92d
mov dword [ebp - 0x1c], 0
jmp 0x44b7d9
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ebp - 0x10]
jge 0x44b91a
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + eax*4]
movzx eax, word [edx]
cmp eax, 0x2f
je 0x44b7f8
jmp 0x44b7d0
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + ecx*4]
add eax, 2
push eax
lea ecx, [ebp - 0x28]
call fcn.00415010
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.004161f0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.004161f0
mov byte [ebp - 4], 2
push 0
movzx ecx, word [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00422890
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffff
je 0x44b8b3
mov edx, dword [ebp - 0x20]
add edx, 1
push edx
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x28]
call fcn.0041d840
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x44], ecx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x44]
push edx
lea ecx, [ebp - 0x24]
call fcn.004150c0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x30]
call fcn.00423040
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x34]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00420f20
mov dword [ebp - 0x48], eax
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x4c], edx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004150c0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x34]
call fcn.00423040
jmp 0x44b8bf
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.004150c0
push 0x22
push 0x22
lea ecx, [ebp - 0x24]
call fcn.0044bae0
mov ecx, eax
call fcn.0044ba50
lea edx, [ebp - 0x24]
push edx
lea ecx, [ebp - 0x2c]
call fcn.00417130
push eax
mov ecx, dword [ebp - 0x38]
call fcn.004232e0
mov ecx, eax
call fcn.004150c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.00423040
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00423040
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00423040
jmp 0x44b7d0
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x18], 0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x45c640
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x590220
mov eax, dword fs:[0]
push eax
sub esp, 0x1ec
mov eax, dword [0x5f4964]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1f8], ecx
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
push 0
call fcn.0048ec50
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x45c6a1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004744a0
jmp 0x45c7f5
lea ecx, [ebp + 8]
call fcn.00484710
mov ecx, eax
call fcn.00464540
movzx edx, ax
cmp edx, 0x19d6
jne 0x45c7e6
lea ecx, [ebp + 8]
call fcn.00484710
mov ecx, eax
call fcn.004646e0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x1e4]
push ecx
mov ecx, dword [ebp - 0x1f8]
add ecx, 0x158
call fcn.00423880
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x1ec]
push ecx
mov ecx, dword [ebp - 0x1f8]
add ecx, 0x158
call fcn.00423510
push eax
lea ecx, [ebp - 0x14]
call fcn.004239a0
movzx edx, al
test edx, edx
je 0x45c7e6
lea ecx, [ebp - 0x14]
call fcn.00462090
add eax, 4
mov ecx, eax
call fcn.00422f30
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
jne 0x45c75b
lea ecx, [ebp - 0x14]
call fcn.00462090
add eax, 4
push eax
call fcn.0045c610
add esp, 4
jmp 0x45c7e6
lea ecx, [ebp - 0x1dc]
call fcn.004bb430
mov byte [ebp - 4], 1
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x1f0], esp
push 0
call fcn.004843f0
push 0
push 0
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x1f4], esp
push 0
call fcn.004843f0
mov eax, dword [ebp - 0x1f8]
mov ecx, dword [eax - 0x24]
push ecx
lea ecx, [ebp - 0x1b0]
call fcn.00462590
test eax, eax
je 0x45c7d7
push 0xffffffffffffffff
push 1
push 0
push str.IDI_WARNING
lea ecx, [ebp - 0x1dc]
call fcn.004be570
push 0
push 0
push 1
push str.IDS_FILE_NOT_FOUND
lea ecx, [ebp - 0x1dc]
call fcn.004bd620
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1dc]
call fcn.00461d60
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004744a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0056ab51
mov esp, ebp
pop ebp
ret 4
Function at 0x4600c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x30]
push ecx
call fcn.004afd70
add esp, 4
mov dword [ebp - 4], 3
push 9
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x30]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
push ecx
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x30]
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x30]
push edx
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x30]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 1
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x30]
push eax
call dword [sym.imp.USER32.dll_SwitchToThisWindow]
mov ecx, dword [ebp - 4]
push ecx
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x30]
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10