joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454b10
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x654
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
test ebx, ebx
je 0x454c7f
mov eax, ebx
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x454b30
sub eax, edx
sar eax, 1
cmp eax, 0x104
jae 0x454c7f
push edi
push 0x30
lea eax, [ebp - 0x34]
push 0
push eax
mov byte [ebp + 0xb], cl
mov dword [ebp - 0x38], 0
call fcn.004b03e0
push 0x4d9d38
push ebx
call fcn.004b13eb
add esp, 0x14
test eax, eax
jne 0x454ba7
lea ecx, [ebp - 4]
push ecx
push ebx
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.0044ef30
test al, al
je 0x454ba7
mov edx, dword [ebp - 4]
push 0x80
push 0x80
push edx
call fcn.0043a4f0
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x454c16
push 0x104
lea eax, [ebp - 0x244]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x454bfd
cmp byte [ebp + 0xc], al
je 0x454bf2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
lea ecx, [ebp - 0x654]
push str.Cant_expand_environment_strings:_r_n_s_r_nError_code0x_08X_r_nImage_loading_failed
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
push 0
push 0
lea edx, [ebp - 0x654]
push 0x40
push edx
call fcn.00420020
add esp, 0x20
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x244]
push ecx
call fcn.0043a9a0
mov edi, eax
add esp, 8
test edi, edi
je 0x454c73
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov dword [esi + 0x12d10], edx
mov dword [esi + 0x12d14], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x12d18], eax
mov eax, dword [esi + 0x12d04]
mov ebx, 1
mov dword [esi + 0x12d08], ebx
test eax, eax
je 0x454c5c
push eax
call fcn.00441300
add esp, 4
mov dword [esi + 0x12d04], 0
mov dword [esi + 0x12d04], edi
pop edi
mov byte [esi + 0x12540], bl
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
mov al, byte [ebp + 0xb]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp byte [ebp + 0xc], 0
je 0x454c98
push 0
push 0
push 0x40
push str.Invalid_inPath_in_Settings::LoadImageFrom
call fcn.00420020
add esp, 0x10
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x454f00
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
test edi, edi
je 0x454f86
cmp word [edi], 0
je 0x454f86
lea esi, [ebx + 0x11c7c]
mov edx, pe_nt_image_headers32
mov eax, esi
sub edi, esi
test edx, edx
je 0x454f42
movzx ecx, word [edi + eax]
test cx, cx
je 0x454f3e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x454f24
jmp 0x454f42
test edx, edx
jne 0x454f45
sub eax, 2
xor ecx, ecx
xor edx, edx
lea edi, [ebx + 0x11a74]
push str.SoftwareConEmu_
mov word [eax], cx
push edi
mov word [ebx + 0x11e5a], dx
call fcn.0040f0b0
add esp, 8
push esi
push 0x104
push edi
call fcn.00401880
push esi
push str.ConEmuConfig
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
pop edi
pop esi
pop ebx
pop ebp
ret 4
lea eax, [ebx + 0x11a74]
push str.SoftwareConEmu.Vanilla
push eax
call fcn.0040f0b0
add esp, 8
lea esi, [ebx + 0x11c7c]
push esi
xor ecx, ecx
push str.ConEmuConfig
mov word [esi], cx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x45e4a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x50b3a0]
sub esp, 0x250
push ebx
xor ebx, ebx
push esi
mov esi, ecx
cmp byte [eax + 0xf41], bl
je 0x45e590
cmp word [eax + 0xf42], bx
je 0x45e590
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x12d18]
cmp eax, 0x1388
jbe 0x45e590
mov eax, dword [0x50b3a0]
add eax, 0xf42
push 0x4d9d38
push eax
call fcn.004b13eb
add esp, 8
test eax, eax
je 0x45e590
push edi
push 0x24c
lea eax, [ebp - 0x24c]
push ebx
push eax
mov dword [ebp - 0x250], ebx
call fcn.004b03e0
mov edx, dword [0x50b3a0]
add esp, 0xc
lea ecx, [ebp - 0x250]
push ecx
add edx, 0xf42
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x45e587
mov eax, dword [ebp - 0x238]
cmp eax, dword [esi + 0x12d14]
jne 0x45e55d
mov ecx, dword [ebp - 0x23c]
cmp ecx, dword [esi + 0x12d10]
je 0x45e580
mov edx, dword [0x50b3a0]
push ebx
add edx, 0xf42
push edx
mov ecx, esi
call fcn.00454b10
mov bl, al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x12d18], eax
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45efa0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi], ebx
je 0x45efe3
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x45efbf
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 4], ebx
mov eax, dword [esi]
cmp eax, ebx
je 0x45efce
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
mov dword [esi], ebx
mov dword [esi + 8], ebx
mov dword [esi + 4], ebx
mov dword [esi + 0xc], 0xffffffff
mov dword [esi + 0x110], ebx
xor ecx, ecx
lea edi, [esi + 0x10]
lea eax, [esi + 0x114]
mov dword [esi + 0x110], ebx
mov word [eax], cx
cmp word [edi], bx
jne 0x45f013
push str.Internal_error._Mapping_file_name_was_not_specified.
push eax
call fcn.0040f030
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
cmp eax, ebx
jg 0x45f01f
mov eax, 0x218
mov edx, dword [ebp + 8]
mov dword [esi + 0xc], eax
cmp edx, ebx
jne 0x45f032
cmp dword [ebp + 0xc], ebx
jne 0x45f032
xor ecx, ecx
jmp 0x45f037
mov ecx, 1
mov dword [esi + 8], ecx
push edi
cmp edx, ebx
je 0x45f053
push eax
push ebx
push 4
call fcn.00441aa0
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
jmp 0x45f05c
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ecx, eax
mov dword [esi], eax
cmp ecx, ebx
jne 0x45f089
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x110], eax
mov ecx, str.create
cmp dword [ebp + 8], ebx
jne 0x45f07f
mov ecx, str.open
push edi
push eax
push ecx
push str.Cant__s_console_data_file_mapping._ErrCode0x_08X_n_s
jmp 0x45f0cd
mov eax, dword [esi + 8]
neg eax
push ebx
sbb eax, eax
push ebx
and eax, 0xf001b
push ebx
add eax, 4
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 4], eax
cmp eax, ebx
jne 0x45f0e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x110], eax
mov ecx, str.ReadWrite
cmp dword [esi + 8], ebx
jne 0x45f0c5
mov ecx, str.Read
push edi
push eax
push ecx
push str.Cant_map_console_info___s_._ErrCode0x_08X_n_s
lea eax, [esi + 0x114]
push 0x208
push eax
call fcn.00441b50
add esp, 0x18
mov eax, dword [esi + 4]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x465170
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 4], ecx
push eax
lea ecx, [ebp - 0x668]
push ecx
call fcn.0040f030
add esp, 8
lea edx, [ebp - 0x668]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [ebp + eax*2 - 0x668]
mov ecx, esi
lea edx, [ebp - 0x668]
sub ecx, edx
sar ecx, 1
mov eax, 0x208
sub eax, ecx
mov dword [ebp - 8], esi
cmp eax, 0x208
ja 0x4651cd
push str..
push eax
push esi
call fcn.00401800
lea eax, [ebp - 0x258]
push eax
lea ecx, [ebp - 0x668]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x46535f
push ebx
mov ebx, dword [sym.imp.USER32.dll_MessageBoxW]
push edi
jmp 0x465203
mov esi, dword [ebp - 8]
test byte [ebp - 0x258], 0x10
jne 0x46533a
lea eax, [ebp - 0x22c]
xor edx, edx
push 0x2e
push eax
mov word [esi + 2], dx
call fcn.004b135e
mov esi, eax
add esp, 8
test esi, esi
je 0x46533a
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str..ttf
push esi
call edi
test eax, eax
je 0x46525f
push str..otf
push esi
call edi
test eax, eax
je 0x46525f
push str..bdf
push esi
call edi
test eax, eax
jne 0x46533a
lea eax, [ebp - 0x22c]
lea edx, [eax + 2]
jmp 0x465270
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x465270
sub eax, edx
sar eax, 1
mov edx, eax
lea eax, [ebp - 0x668]
lea esi, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x465290
sub eax, esi
sar eax, 1
add eax, edx
cmp eax, 0x104
jb 0x46530d
lea eax, [ebp - 0x22c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4652b1
sub eax, edx
sar eax, 1
lea edi, [eax + 0x64]
push 2
push edi
call fcn.004412c0
add esp, 8
push str.Too_long_full_pathname_for_font:_n
mov esi, eax
push edi
push esi
call fcn.00401800
lea ecx, [ebp - 0x22c]
push ecx
push edi
push esi
call fcn.00401880
mov ecx, dword [0x50b39c]
push 0x11
call fcn.004059f0
push eax
push esi
push 0
call ebx
push esi
mov edi, eax
call fcn.00441300
add esp, 4
cmp edi, 2
jmp 0x465338
lea edx, [ebp - 0x22c]
push edx
push 0x208
lea eax, [ebp - 0x668]
push eax
call fcn.00401880
push 0
lea ecx, [ebp - 0x668]
push ecx
mov ecx, dword [ebp - 4]
call fcn.004649c0
test eax, eax
je 0x465353
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x258]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x465200
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x469ee0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x50b3a0]
sub esp, 0x20c
cmp byte [eax + 0xee1], 0
push edi
mov edi, ecx
je 0x469fc3
mov eax, dword [0x50b39c]
cmp byte [eax + 0x42b2], 0
jne 0x469fc3
add eax, 0x3be
push eax
call fcn.00465170
mov eax, dword [0x50b39c]
lea ecx, [eax + 0x5c8]
push ecx
add eax, 0x3be
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x469f4b
mov edx, dword [0x50b39c]
add edx, 0x5c8
push edx
mov ecx, edi
call fcn.00465170
mov ecx, dword [0x50b39c]
push esi
push 0
call fcn.00404e00
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push eax
mov eax, dword [0x50b39c]
add eax, 0x3be
push eax
call esi
test eax, eax
je 0x469fc2
mov edx, dword [0x50b384]
push 0
push 0x14
lea ecx, [ebp - 0x20c]
push ecx
push edx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x469fad
mov ecx, dword [0x50b39c]
push 0
call fcn.00404e00
push eax
lea eax, [ebp - 0x20c]
push eax
call esi
neg eax
sbb eax, eax
add eax, 1
jne 0x469fc2
mov ecx, dword [0x50b39c]
push 0
call fcn.00404e00
push eax
mov ecx, edi
call fcn.00465170
pop esi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x46b6b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x50b3a0]
mov al, byte [ebp + 0xc]
sub esp, 0x10
cmp byte [ecx + 0x11260], 0
mov byte [0x50dbbf], al
sete byte [0x50dbc1]
cmp byte [ecx + 0x11a43], 0
mov byte [0x50dbc0], 0
sete byte [0x50dbbe]
cmp dword [0x50b3c4], 6
jne 0x46b7df
cmp dword [0x50b3c8], 0
jne 0x46b7df
push ebx
push esi
push 0
mov dword [ebp + 0xc], 0
call fcn.00444f50
mov esi, eax
mov ebx, 1
test esi, esi
je 0x46b766
mov edx, dword [esi]
mov eax, dword [edx]
push 0
push 0x20019
push str.SoftwareConEmu
mov ecx, esi
call eax
test al, al
je 0x46b75c
mov edx, dword [esi]
mov edx, dword [edx + 0xc]
push 4
lea eax, [ebp + 0xc]
push eax
push str.StopWarningConIme
mov ecx, esi
call edx
test al, al
jne 0x46b753
mov dword [ebp + 0xc], 0
mov eax, dword [esi]
mov edx, dword [eax + 4]
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x1c]
push ebx
mov ecx, esi
call edx
cmp dword [ebp + 0xc], 0
jne 0x46b7dd
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x4c6d70
push SysReAllocString
mov dword [ebp - 4], 0
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46b7d7
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
push str.LoadConIme
push ecx
mov dword [ebp - 0x10], 4
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x46b7c7
mov dword [ebp - 8], ebx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
je 0x46b7dd
mov byte [0x50dbc0], bl
pop esi
pop ebx
cmp byte [0x50dbc1], 0
jne 0x46b7fa
cmp byte [0x50dbbe], 0
jne 0x46b7fa
cmp byte [0x50dbc0], 0
je 0x46b81c
call fcn.0041fe70
mov eax, dword [ebp + 8]
mov ecx, dword [0x50b380]
push eax
push 0x46afc0
push 0
push 0xd7
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov esp, ebp
pop ebp
ret
Function at 0x46be30
Capabilities:
Impersonate user

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
mov eax, dword [ecx + 0x28]
push 0
push 2
lea edx, [ecx + 0x2c]
mov ecx, dword [ecx + 0x24]
push edx
push eax
push ecx
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_LogonUserW]
test eax, eax
je 0x46be60
mov eax, dword [ebp - 4]
test eax, eax
jne 0x46be62
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x46c650
Capabilities:
Get graphical window text
Impersonate user

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 0x24]
mov dword [esi + 0x234], 0
test eax, eax
je 0x46c71e
cmp word [eax], 0
je 0x46c71e
mov eax, dword [ebp + 8]
push edi
push 0x103
lea edi, [esi + 0x2c]
push edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x46c69c
xor ecx, ecx
mov word [edi], cx
mov dword [esi + 0x234], 1
mov eax, dword [esi + 0x28]
test eax, eax
je 0x46c6b3
push eax
call fcn.00441300
add esp, 4
mov dword [esi + 0x28], 0
mov eax, dword [esi + 0x24]
push 0x5c
push eax
call fcn.004b03ac
add esp, 8
test eax, eax
je 0x46c6df
mov edx, dword [esi + 0x24]
xor ecx, ecx
mov dword [esi + 0x28], edx
mov word [eax], cx
add eax, 2
push eax
call fcn.00441380
add esp, 4
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x28]
mov ecx, dword [esi + 0x24]
lea edx, [ebp + 8]
push edx
push 0
push 2
push edi
push eax
push ecx
mov dword [ebp + 8], 0
call dword [sym.imp.ADVAPI32.dll_LogonUserW]
pop edi
test eax, eax
je 0x46c709
mov esi, dword [ebp + 8]
test esi, esi
jne 0x46c70b
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
test esi, esi
setne al
pop esi
pop ebp
ret 4
xor eax, eax
pop esi
pop ebp
ret 4
Function at 0x46ce70
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf299
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x50]
mov dword [ebp - 0x10], esi
call fcn.0048b850
xor ebx, ebx
lea ecx, [esi + 0x1a28]
mov dword [ebp - 4], ebx
call fcn.004ad570
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push 0xc0
lea edx, [esi + 0x1abc]
push ebx
push edx
mov byte [ebp - 4], 1
mov dword [esi + 0x4c], eax
mov dword [esi], ecx
mov dword [esi + 0x19fc], 0xffffffff
call fcn.004b03e0
add esp, 0xc
push ebx
push 1
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0xffffffffffffffff
push 0xffffffffffffffff
mov dword [esi + 0x1b58], eax
mov dword [esi + 0x1a00], ebx
call fcn.0041f4f0
push 0xffffffffffffffff
mov dword [esi + 0x1a04], eax
lea eax, [ebp - 0x20]
push 0xffffffffffffffff
push eax
call fcn.0041f520
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov edi, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [esi + 4], ecx
mov dword [esi + 0x24], ecx
mov dword [esi + 0x14], ecx
mov dword [esi + 8], edx
mov dword [esi + 0x28], edx
mov dword [esi + 0x18], edx
mov dword [esi + 0xc], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x10], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x20], eax
xor eax, eax
mov dword [esi + 0x48], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x1b7c], eax
mov dword [esi + 0x1b80], eax
mov dword [esi + 0x1b84], eax
mov dword [esi + 0x1b88], eax
mov dword [esi + 0x1b8c], eax
add esp, 0x14
mov dword [esi + 0x1b90], eax
lea ecx, [esi + 0x1a08]
mov dword [esi + 0x1b94], eax
push ecx
mov dword [esi + 0x1b98], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x1a20], ebx
mov dword [esi + 0x1a24], ebx
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x46e270
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x4c]
push 0
mov dword [esi + 0x1b60], 1
mov ecx, dword [eax + 0x47c]
push 1
call fcn.004ab5e0
mov ecx, dword [esi + 0x4c]
mov ecx, dword [ecx + 0x47c]
add ecx, 8
pop esi
jmp fcn.0049d150
Function at 0x4743b0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi], ebx
je 0x4743f3
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x4743cf
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 4], ebx
mov eax, dword [esi]
cmp eax, ebx
je 0x4743de
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
mov dword [esi], ebx
mov dword [esi + 8], ebx
mov dword [esi + 4], ebx
mov dword [esi + 0xc], 0xffffffff
mov dword [esi + 0x110], ebx
xor ecx, ecx
lea edi, [esi + 0x10]
lea eax, [esi + 0x114]
mov dword [esi + 0x110], ebx
mov word [eax], cx
cmp word [edi], bx
jne 0x474423
push str.Internal_error._Mapping_file_name_was_not_specified.
push eax
call fcn.0040f030
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
cmp eax, ebx
jg 0x47442f
mov eax, 0xce
mov edx, dword [ebp + 8]
mov dword [esi + 0xc], eax
cmp edx, ebx
jne 0x474442
cmp dword [ebp + 0xc], ebx
jne 0x474442
xor ecx, ecx
jmp 0x474447
mov ecx, 1
mov dword [esi + 8], ecx
push edi
cmp edx, ebx
je 0x474463
push eax
push ebx
push 4
call fcn.00441aa0
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
jmp 0x47446c
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ecx, eax
mov dword [esi], eax
cmp ecx, ebx
jne 0x474499
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x110], eax
mov ecx, str.create
cmp dword [ebp + 8], ebx
jne 0x47448f
mov ecx, str.open
push edi
push eax
push ecx
push str.Cant__s_console_data_file_mapping._ErrCode0x_08X_n_s
jmp 0x4744dd
mov eax, dword [esi + 8]
neg eax
push ebx
sbb eax, eax
push ebx
and eax, 0xf001b
push ebx
add eax, 4
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 4], eax
cmp eax, ebx
jne 0x4744f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x110], eax
mov ecx, str.ReadWrite
cmp dword [esi + 8], ebx
jne 0x4744d5
mov ecx, str.Read
push edi
push eax
push ecx
push str.Cant_map_console_info___s_._ErrCode0x_08X_n_s
lea eax, [esi + 0x114]
push 0x208
push eax
call fcn.00441b50
add esp, 0x18
mov eax, dword [esi + 4]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x474500
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi], ebx
je 0x474543
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x47451f
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 4], ebx
mov eax, dword [esi]
cmp eax, ebx
je 0x47452e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
mov dword [esi], ebx
mov dword [esi + 8], ebx
mov dword [esi + 4], ebx
mov dword [esi + 0xc], 0xffffffff
mov dword [esi + 0x110], ebx
xor ecx, ecx
lea edi, [esi + 0x10]
lea eax, [esi + 0x114]
mov dword [esi + 0x110], ebx
mov word [eax], cx
cmp word [edi], bx
jne 0x474573
push str.Internal_error._Mapping_file_name_was_not_specified.
push eax
call fcn.0040f030
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
cmp eax, ebx
jg 0x47457f
mov eax, 0x56
mov edx, dword [ebp + 8]
mov dword [esi + 0xc], eax
cmp edx, ebx
jne 0x474592
cmp dword [ebp + 0xc], ebx
jne 0x474592
xor ecx, ecx
jmp 0x474597
mov ecx, 1
mov dword [esi + 8], ecx
push edi
cmp edx, ebx
je 0x4745b3
push eax
push ebx
push 4
call fcn.00441aa0
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
jmp 0x4745bc
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ecx, eax
mov dword [esi], eax
cmp ecx, ebx
jne 0x4745e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x110], eax
mov ecx, str.create
cmp dword [ebp + 8], ebx
jne 0x4745df
mov ecx, str.open
push edi
push eax
push ecx
push str.Cant__s_console_data_file_mapping._ErrCode0x_08X_n_s
jmp 0x47462d
mov eax, dword [esi + 8]
neg eax
push ebx
sbb eax, eax
push ebx
and eax, 0xf001b
push ebx
add eax, 4
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 4], eax
cmp eax, ebx
jne 0x474641
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x110], eax
mov ecx, str.ReadWrite
cmp dword [esi + 8], ebx
jne 0x474625
mov ecx, str.Read
push edi
push eax
push ecx
push str.Cant_map_console_info___s_._ErrCode0x_08X_n_s
lea eax, [esi + 0x114]
push 0x208
push eax
call fcn.00441b50
add esp, 0x18
mov eax, dword [esi + 4]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x476a50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx + 0x3bf8]
pop ebp
jmp fcn.0046d140

Function at 0x476ce0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0xc8
mov dword [ecx + 0x488], eax
test eax, eax
je 0x476d19
push eax
lea eax, [ebp - 0xc8]
push str.ConEmu:_ConHost_was_created_PID_u_n
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0xc8]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov esp, ebp
pop ebp
ret 4

Function at 0x477360
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], 0
call ebx
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
cmp esi, 0x2710
jbe 0x47738f
mov esi, 0x2710
jmp 0x477398
test esi, esi
jne 0x477398
mov esi, 0x64
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [edi + 0x373c]
jne 0x4773b1
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
test esi, esi
jbe 0x4773f6
mov ecx, dword [edi + 0x3bec]
call fcn.0046d5b0
cmp dword [ebp + 8], eax
je 0x4773ef
mov eax, dword [edi + 0x3740]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
call ebx
sub eax, dword [ebp - 8]
cmp eax, esi
jb 0x4773b5
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x477b90
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
test ecx, ecx
je 0x477bb3
cmp byte [ecx + 0x3bfc], 0
je 0x477ba7
mov byte [ecx + 0x3bfc], 0
mov ecx, dword [ecx + 0x3bf8]
pop ebp
jmp fcn.00474f80
pop ebp
ret 0x10

Function at 0x4781b0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
push esi
mov esi, ecx
cmp dword [esi + 0x42ec], 0
je 0x478230
mov ecx, dword [esi + 0x4484]
test ecx, ecx
je 0x478230
mov eax, dword [esi + 0x448c]
test eax, eax
jl 0x4781dd
cmp eax, ecx
jl 0x4781e2
cmp ecx, 1
jne 0x478230
mov ecx, dword [esi]
push 0x3ff
lea eax, [ebp - 0x800]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x478209
xor edx, edx
mov word [esi + 0x2f1c], dx
pop esi
mov esp, ebp
pop ebp
ret
mov ax, word [ebp - 0x800]
cmp ax, 0x7b
je 0x47821c
cmp ax, 0x28
jne 0x478230
lea eax, [ebp - 0x800]
push eax
add esi, 0x2f1c
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
pop esi
mov esp, ebp
pop ebp
ret