joyce8/EMBER2024-capa huggingface dataset:
Function at 0x478260
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
push edi
lea eax, [ebp - 0x190]
push eax
push 0xc8
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x4782d3
push esi
mov esi, dword [ebp + 8]
push esi
push edi
push 0x4dd7dc
lea ecx, [ebp - 0x190]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x4782c9
push edi
push 0x80
push 2
push edi
push 1
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x4782c1
xor edx, edx
mov word [esi], dx
xor eax, eax
pop esi
pop edi
mov esp, ebp
pop ebp
ret 4
pop esi
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 4
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x4782e0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [0x50b39c]
push esi
call fcn.00406a10
test al, al
je 0x47833a
mov eax, dword [esi + 0x3c08]
test eax, eax
je 0x47833e
cmp eax, dword [esi + 0x480]
jne 0x47833e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x3c0c]
cmp eax, 0x7d0
jb 0x47833e
mov eax, dword [esi + 0x484]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x47833a
mov ecx, dword [esi + 0x484]
push 0x64
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov al, 1
pop esi
ret
cmp dword [esi], 0
je 0x47833a
cmp dword [esi + 0x44c8], 0
jne 0x47833a
xor al, al
pop esi
ret

Function at 0x479550
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
test edi, edi
je 0x479618
mov eax, dword [edi + 0x264]
test eax, eax
je 0x4795aa
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x47958e
mov eax, dword [edi + 0x264]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x264], 0
jmp 0x4795aa
mov ecx, dword [edi + 0x264]
push 0x64
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [edi + 0x264]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
lea eax, [ebx + 0x14]
push eax
push 1
call fcn.004412c0
mov ecx, dword [ebp + 8]
mov esi, eax
mov eax, dword [ebp + 0x10]
add esp, 8
mov dword [esi], edi
mov dword [esi + 4], 1
mov dword [esi + 0xc], ecx
mov dword [esi + 8], ebx
test eax, eax
je 0x4795ea
test ebx, ebx
je 0x4795ea
push ebx
push eax
lea edx, [esi + 0x10]
push edx
call fcn.004b0bb0
add esp, 0xc
lea eax, [edi + 0x268]
push eax
push 0
push esi
push 0x479450
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x264], eax
test eax, eax
jne 0x479616
push esi
call fcn.00441300
add esp, 4
pop esi
pop ebx
pop edi
pop ebp
ret 0xc
Function at 0x479680
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
push ebx
mov ebx, ecx
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x479730
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_FindWindowExW]
push 0
push 0x8002
push 0
push 0
call edi
mov esi, eax
test esi, esi
je 0x479719
mov ebx, dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x4796c0
push 0xff
lea eax, [ebp - 0x204]
push eax
push esi
call ebx
test eax, eax
je 0x479704
mov eax, 0x22
cmp word [ebp - 0x204], ax
jne 0x479704
cmp word [ebp - 0x1f6], ax
jne 0x479704
push 6
lea ecx, [ebp - 0x202]
push str.ConEmu
push ecx
call fcn.0043b120
add esp, 0xc
test eax, eax
je 0x479735
push 0
push 0x8002
push esi
push 0
call edi
mov esi, eax
test esi, esi
jne 0x4796c0
mov ebx, dword [ebp - 4]
mov edx, dword [ebx]
push 0
push 0xfff7
push 0x112
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call fcn.004acc10
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x479d80
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
push esi
mov esi, ecx
test esi, esi
je 0x479e9c
cmp dword [esi + 0x48c], 0
je 0x479e9c
mov ecx, dword [esi + 0x44d4]
test ecx, ecx
je 0x479dbb
push 1
push 0
push 1
push str.Prepare_searching_for_conhost
call fcn.004adc30
mov eax, dword [esi + 0x48c]
mov ecx, dword [eax]
test ecx, ecx
je 0x479de1
mov eax, dword [eax + 4]
test eax, eax
je 0x479de1
lea eax, [eax + eax*2]
add eax, eax
add eax, eax
push eax
push 0
push ecx
call fcn.004b03e0
add esp, 0xc
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
test edi, edi
je 0x479e81
cmp edi, 0xffffffff
je 0x479e81
push 0x228
lea ecx, [ebp - 0x22c]
push 0
push ecx
mov dword [ebp - 0x230], 0x22c
call fcn.004b03e0
add esp, 0xc
lea edx, [ebp - 0x230]
push edx
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x479e7a
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov dword [ebp - 4], 1
lea ecx, [ecx]
push str.conhost.exe
lea eax, [ebp - 0x20c]
push eax
call ebx
test eax, eax
jne 0x479e68
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [esi + 0x48c]
lea edx, [ebp - 0x228]
push edx
call fcn.00409670
lea eax, [ebp - 0x230]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x479e40
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esi + 0x44d4]
pop edi
test ecx, ecx
je 0x479e9c
push 1
push 0
push 1
push str.Prepare_searching_for_conhost___Done
call fcn.004adc30
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x47a170
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, ecx
test ebx, ebx
je 0x47a1d1
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x47a1d1
mov byte [ebp + 0xb], 0
test esi, esi
je 0x47a1d1
mov eax, dword [esi + 0x484]
test eax, eax
je 0x47a1b3
cmp eax, 0xffffffff
je 0x47a1b3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
sete al
test al, al
jne 0x47a1dc
mov esi, dword [esi + 0x44d4]
test esi, esi
je 0x47a1d1
push 0
push 1
push 0
push 0
push str.PostConsoleEventPipe_skipped_due_to_server_not_alive
mov ecx, esi
call fcn.004ae810
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 0x6b0]
test eax, eax
je 0x47a1eb
cmp eax, 0xffffffff
jne 0x47a21c
mov ecx, esi
call fcn.00479fc0
test eax, eax
jne 0x47a21c
mov esi, dword [esi + 0x44d4]
test esi, esi
je 0x47a1d1
push eax
push 1
push eax
push eax
push str.PostConsoleEventPipe_skipped_due_to_OpenConsoleEventPipe_failed
mov ecx, esi
call fcn.004ae810
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
push 0
lea ecx, [ebp - 4]
push ecx
lea edi, [edi + edi*2 - 3]
lea edi, [edi*8 + 0x20]
push edi
mov dword [ebx], edi
mov dword [ebx + 4], eax
mov edx, dword [esi + 0x6b0]
push ebx
push edx
mov dword [0x50dc18], 1
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x47a2a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, esi
mov dword [ebp + 0xc], eax
call fcn.004782e0
test al, al
jne 0x47a2aa
mov eax, dword [ebp + 0xc]
cmp eax, 0xe8
je 0x47a277
cmp eax, 0xe9
jne 0x47a2aa
mov ecx, esi
call fcn.00477050
test al, al
je 0x47a2aa
mov ecx, esi
call fcn.00479fc0
test eax, eax
je 0x47a2aa
mov ecx, dword [esi + 0x6b0]
push 0
lea eax, [ebp - 4]
push eax
push edi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x47a2aa
mov byte [ebp + 0xb], 1
mov al, byte [ebp + 0xb]
pop edi
pop esi
mov dword [0x50dc18], 0
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x47a530
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x47a558
cmp dword [esi + 0x47c], 0
je 0x47a558
call fcn.00476e20
test eax, eax
je 0x47a558
mov ecx, dword [esi + 0x47c]
add ecx, 8
pop esi
jmp 0x49d4c0
xor al, al
pop esi
ret
push esi
mov esi, ecx
cmp dword [esi + 0x70], 0
je 0x49d4e7
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
je 0x49d4e7
mov dword [esi + 0x70], 0
xor eax, eax
cmp dword [esi + 0x70], eax
pop esi
setne al
ret
Function at 0x47a920
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_IsWindow]
mov esi, ecx
je 0x47a96d
mov eax, dword [esi + 4]
test eax, eax
je 0x47a96d
push eax
call edi
test eax, eax
je 0x47a96d
mov eax, dword [esi + 4]
push 1
push 5
push eax
mov ecx, esi
call fcn.00477bc0
mov ecx, dword [esi + 0x47c]
add ecx, 8
call fcn.0049ca00
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
ret 4
test esi, esi
jne 0x47a975
xor eax, eax
jmp 0x47a983
mov ecx, dword [esi + 0x47c]
add ecx, 8
call fcn.0049ca00
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 4]
test eax, eax
je 0x47a9a9
push eax
call edi
test eax, eax
je 0x47a9a9
mov ecx, dword [esi + 4]
push 1
push 0
push ecx
mov ecx, esi
call fcn.00477bc0
mov ecx, dword [esi + 0x47c]
add ecx, 8
call fcn.0049d200
pop edi
pop esi
pop ebp
ret 4
Function at 0x47ce50
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf478
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x310
push esi
xor esi, esi
mov dword [ebp - 0x10], ecx
cmp ecx, esi
je 0x47d05d
cmp dword [ecx + 0x48c], esi
je 0x47d05d
cmp dword [ecx + 0x488], esi
jne 0x47ce96
mov dword [ecx + 0x488], esi
mov ecx, dword [ecx + 0x44d4]
cmp ecx, esi
je 0x47ceaf
push 1
push esi
push 1
push str.Searching_for_conhost
call fcn.004adc30
push ebx
push edi
mov dword [ebp - 0x14], esi
jmp 0x47ceb8
xor esi, esi
xor edi, edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x28], 0x22c
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0xcccccccc
push esi
push 2
mov dword [ebp - 4], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
test ebx, ebx
je 0x47cfd1
cmp ebx, 0xffffffff
je 0x47cfd1
push 0x228
lea eax, [ebp - 0x250]
push edi
push eax
mov dword [ebp - 0x254], 0x22c
call fcn.004b03e0
add esp, 0xc
lea ecx, [ebp - 0x254]
push ecx
push ebx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x47cf90
nop
push str.conhost.exe
lea edx, [ebp - 0x230]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x47cf79
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x48c]
mov eax, dword [ecx]
test eax, eax
je 0x47cf6a
mov edx, dword [ecx + 4]
test edx, edx
je 0x47cf6a
xor ecx, ecx
test edx, edx
jbe 0x47cf6a
mov esi, dword [ebp - 0x24c]
cmp byte [eax], 0
je 0x47cf62
cmp esi, dword [eax + 4]
je 0x47cf79
inc ecx
add eax, 0xc
cmp ecx, edx
jb 0x47cf58
lea ecx, [ebp - 0x254]
push ecx
lea ecx, [ebp - 0x28]
call fcn.0047c630
lea edx, [ebp - 0x254]
push edx
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x47cf20
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x24]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jle 0x47cfd1
cmp edi, 1
jle 0x47cfde
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x47cfbf
push esi
call fcn.00441300
add esp, 4
mov eax, dword [ebp - 0x14]
inc eax
cmp eax, 1
mov dword [ebp - 0x14], eax
jle 0x47ceb6
jmp 0x47cffa
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x47cffa
jmp 0x47cff1
mov eax, dword [esi + 8]
mov ecx, dword [ebp - 0x10]
push eax
call fcn.00476ce0
mov dword [ebp - 4], 0xffffffff
push esi
call fcn.00441300
add esp, 4
mov ecx, dword [0x50b3a4]
cmp byte [ecx + 0x127d2], 0
mov esi, dword [ebp - 0x10]
pop edi
pop ebx
je 0x47d046
mov edx, dword [esi + 0x488]
push edx
lea eax, [ebp - 0x31c]
push str.ConHostPID_u
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [esi + 0x44d4]
add esp, 0xc
test ecx, ecx
je 0x47d046
push 1
push 0
push 1
lea edx, [ebp - 0x31c]
push edx
call fcn.004adc30
mov eax, dword [esi + 0x488]
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x47daa0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [ebp + 0xc], 0x286
mov dword [ebp - 0x14], ecx
jne 0x47dc29
mov eax, dword [ecx + 4]
test eax, eax
je 0x47dad6
mov edx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 0x10]
push edx
push 0x286
push eax
call fcn.0047a2c0
mov esp, ebp
pop ebp
ret 0x10
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov eax, 1
push edi
mov word [ebp - 0x28], ax
xor eax, eax
push 0x14
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
call esi
and ax, 1
push 0x90
movzx ebx, ax
call esi
and ax, 1
movzx ecx, ax
push 0x91
mov dword [ebp + 0xc], ecx
call esi
and ax, 1
movzx edx, ax
push 0xa4
mov dword [ebp - 4], edx
call esi
mov ecx, 0x8000
and ax, cx
push 0xa5
movzx edi, ax
call esi
mov edx, 0x8000
and ax, dx
movzx eax, ax
push 0xa2
mov dword [ebp - 8], eax
call esi
mov ecx, 0x8000
and ax, cx
movzx edx, ax
push 0xa3
mov dword [ebp - 0xc], edx
call esi
mov ecx, 0x8000
and ax, cx
movzx edx, ax
push 0x10
mov dword [ebp - 0x10], edx
call esi
mov edx, 0x8000
mov ecx, edx
and ax, cx
movzx ecx, ax
mov eax, 1
mov word [ebp - 0x20], ax
mov eax, 0xe5
mov word [ebp - 0x1e], ax
mov ax, word [ebp + 0x10]
mov word [ebp - 0x1a], ax
mov eax, dword [ebp + 0x14]
mov esi, eax
shr esi, 0x10
and esi, 0xff
mov dword [ebp - 0x24], 1
mov word [ebp - 0x1c], si
mov dword [ebp - 0x18], 0
test eax, 0x1000000
je 0x47dbcd
mov dword [ebp - 0x18], 0x100
test bl, 1
je 0x47dbd9
or dword [ebp - 0x18], 0x80
test byte [ebp + 0xc], 1
je 0x47dbe3
or dword [ebp - 0x18], 0x20
test byte [ebp - 4], 1
je 0x47dbed
or dword [ebp - 0x18], 0x40
test edx, edi
pop edi
pop esi
pop ebx
je 0x47dbf8
or dword [ebp - 0x18], 2
test dword [ebp - 8], edx
je 0x47dc01
or dword [ebp - 0x18], 1
test dword [ebp - 0xc], edx
je 0x47dc0a
or dword [ebp - 0x18], 8
test dword [ebp - 0x10], edx
je 0x47dc13
or dword [ebp - 0x18], 4
test edx, ecx
je 0x47dc1b
or dword [ebp - 0x18], 0x10
push 1
lea ecx, [ebp - 0x28]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.0047cc40
mov esp, ebp
pop ebp
ret 0x10
Function at 0x47f330
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov ebx, dword [esi + 0x4498]
mov dword [ebp - 8], ebx
and ebx, 0xffff0000
cmp dword [esi + 0x40d0], 0
je 0x47f360
mov eax, dword [esi + 0x4494]
test al, 4
je 0x47f360
test al, 0x10
je 0x47f367
xor ebx, ebx
jmp 0x47f54c
mov ecx, dword [esi + 0x42ec]
test ecx, ecx
je 0x47f3a4
mov eax, dword [esi + 0x448c]
test eax, eax
jl 0x47f3a4
cmp eax, dword [esi + 0x4484]
jge 0x47f3a4
imul eax, eax, 0x818
mov eax, dword [eax + ecx + 8]
cmp eax, 1
je 0x47f3a4
cmp eax, 2
jne 0x47f39c
or ebx, 0x20
jmp 0x47f3a4
cmp eax, 3
jne 0x47f3a4
or ebx, 0x10
movzx eax, bx
test eax, eax
jne 0x47f48c
lea edx, [esi + 0x6568]
mov eax, edx
push edi
lea edi, [eax + 2]
jmp 0x47f3c0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x47f3c0
sub eax, edi
sar eax, 1
push eax
push edx
lea edi, [esi + 0xcd4]
push edi
call fcn.004b19ad
add esp, 0xc
test eax, eax
je 0x47f488
lea edx, [esi + 0x65a8]
mov eax, edx
lea ecx, [eax + 2]
mov dword [ebp - 4], ecx
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x47f3f6
sub eax, dword [ebp - 4]
sar eax, 1
push eax
push edx
push edi
call fcn.004b19ad
add esp, 0xc
test eax, eax
je 0x47f488
lea edx, [esi + 0x65e8]
mov eax, edx
lea ecx, [eax + 2]
mov dword [ebp - 4], ecx
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x47f423
sub eax, dword [ebp - 4]
sar eax, 1
push eax
push edx
push edi
call fcn.004b19ad
add esp, 0xc
test eax, eax
je 0x47f483
lea edx, [esi + 0x6628]
mov eax, edx
lea ecx, [eax + 2]
mov dword [ebp - 4], ecx
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x47f450
sub eax, dword [ebp - 4]
sar eax, 1
push eax
push edx
push edi
call fcn.004b19ad
add esp, 0xc
test eax, eax
je 0x47f483
push 1
push 1
mov ecx, esi
call fcn.0047bbb0
test al, al
je 0x47f48b
or ebx, 1
jmp 0x47f48b
or ebx, 0x20
jmp 0x47f48b
or ebx, 0x10
pop edi
test bl, 0x30
je 0x47f497
and ebx, 0xfff8ffff
test bl, 1
je 0x47f4a8
and ebx, 0xfff9ffff
or ebx, 0x10000
movzx eax, word [esi + 0x371c]
test ax, ax
jl 0x47f4f8
cmp ax, 0x64
jg 0x47f4f8
cmp word [esi + 0x3728], ax
jne 0x47f4db
or edx, 0xffffffff
and ebx, 0xfffbffff
mov word [esi + 0x3720], dx
or ebx, 0x20000
jmp 0x47f54c
mov word [esi + 0x3720], ax
test ebx, 0x10000
je 0x47f4f0
or ebx, 0x20000
and ebx, 0xfffbffff
jmp 0x47f54c
mov eax, ebx
and eax, 0x30000
cmp eax, 0x30000
jne 0x47f54c
cmp word [esi + 0x3720], 0xffff
je 0x47f54c
cmp dword [esi + 0x3724], 0
jne 0x47f527
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x3724], eax
jmp 0x47f54c
test dword [esi + 0x4498], 0x40000
jne 0x47f546
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x3724]
cmp eax, 0x7d0
jbe 0x47f54c
or ebx, 0x40000
or eax, 0xffffffff
cmp word [esi + 0x371c], ax
jne 0x47f590
cmp word [esi + 0x3720], ax
je 0x47f590
test ebx, 0x20000
je 0x47f574
test bl, 1
je 0x47f590
and ebx, 0xfff9ffff
mov word [esi + 0x3720], ax
mov dword [esi + 0x3724], 0
mov ecx, dword [0x50b39c]
call fcn.0040c600
cmp ebx, dword [ebp - 8]
je 0x47f5a8
mov dword [esi + 0x4498], ebx
mov ecx, dword [0x50b39c]
push 0
call fcn.00411df0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4801b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x4801f7
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, dword [0x50dccc]
sub ecx, eax
cmp ecx, 0x3e8
jae 0x4801e6
push 0
push 0
push 0x40
push str.Space_bounce_recieved_from_unknown_window
call fcn.00420020
add esp, 0x10
pop edi
pop esi
ret
call edi
push 0xffffffffffffffff
mov ecx, esi
mov dword [0x50dccc], eax
call fcn.0047e7f0
pop edi
pop esi
ret

Function at 0x480200
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi], ebx
je 0x480243
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x48021f
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 4], ebx
mov eax, dword [esi]
cmp eax, ebx
je 0x48022e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
mov dword [esi], ebx
mov dword [esi + 8], ebx
mov dword [esi + 4], ebx
mov dword [esi + 0xc], 0xffffffff
mov dword [esi + 0x110], ebx
xor ecx, ecx
lea edi, [esi + 0x10]
lea eax, [esi + 0x114]
mov dword [esi + 0x110], ebx
mov word [eax], cx
cmp word [edi], bx
jne 0x480273
push str.Internal_error._Mapping_file_name_was_not_specified.
push eax
call fcn.0040f030
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
cmp eax, ebx
jg 0x48027f
mov eax, 0x538
mov edx, dword [ebp + 8]
mov dword [esi + 0xc], eax
cmp edx, ebx
jne 0x480292
cmp dword [ebp + 0xc], ebx
jne 0x480292
xor ecx, ecx
jmp 0x480297
mov ecx, 1
mov dword [esi + 8], ecx
push edi
cmp edx, ebx
je 0x4802b3
push eax
push ebx
push 4
call fcn.00441aa0
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
jmp 0x4802bc
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ecx, eax
mov dword [esi], eax
cmp ecx, ebx
jne 0x4802e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x110], eax
mov ecx, str.create
cmp dword [ebp + 8], ebx
jne 0x4802df
mov ecx, str.open
push edi
push eax
push ecx
push str.Cant__s_console_data_file_mapping._ErrCode0x_08X_n_s
jmp 0x48032d
mov eax, dword [esi + 8]
neg eax
push ebx
sbb eax, eax
push ebx
and eax, 0xf001b
push ebx
add eax, 4
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 4], eax
cmp eax, ebx
jne 0x480341
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x110], eax
mov ecx, str.ReadWrite
cmp dword [esi + 8], ebx
jne 0x480325
mov ecx, str.Read
push edi
push eax
push ecx
push str.Cant_map_console_info___s_._ErrCode0x_08X_n_s
lea eax, [esi + 0x114]
push 0x208
push eax
call fcn.00441b50
add esp, 0x18
mov eax, dword [esi + 4]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x480350
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi], ebx
je 0x480393
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x48036f
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 4], ebx
mov eax, dword [esi]
cmp eax, ebx
je 0x48037e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
mov dword [esi], ebx
mov dword [esi + 8], ebx
mov dword [esi + 4], ebx
mov dword [esi + 0xc], 0xffffffff
mov dword [esi + 0x110], ebx
xor ecx, ecx
lea edi, [esi + 0x10]
lea eax, [esi + 0x114]
mov dword [esi + 0x110], ebx
mov word [eax], cx
cmp word [edi], bx
jne 0x4803c3
push str.Internal_error._Mapping_file_name_was_not_specified.
push eax
call fcn.0040f030
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
cmp eax, ebx
jg 0x4803cf
mov eax, 0x10
mov edx, dword [ebp + 8]
mov dword [esi + 0xc], eax
cmp edx, ebx
jne 0x4803e2
cmp dword [ebp + 0xc], ebx
jne 0x4803e2
xor ecx, ecx
jmp 0x4803e7
mov ecx, 1
mov dword [esi + 8], ecx
push edi
cmp edx, ebx
je 0x480403
push eax
push ebx
push 4
call fcn.00441aa0
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
jmp 0x48040c
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ecx, eax
mov dword [esi], eax
cmp ecx, ebx
jne 0x480439
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x110], eax
mov ecx, str.create
cmp dword [ebp + 8], ebx
jne 0x48042f
mov ecx, str.open
push edi
push eax
push ecx
push str.Cant__s_console_data_file_mapping._ErrCode0x_08X_n_s
jmp 0x48047d
mov eax, dword [esi + 8]
neg eax
push ebx
sbb eax, eax
push ebx
and eax, 0xf001b
push ebx
add eax, 4
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 4], eax
cmp eax, ebx
jne 0x480491
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x110], eax
mov ecx, str.ReadWrite
cmp dword [esi + 8], ebx
jne 0x480475
mov ecx, str.Read
push edi
push eax
push ecx
push str.Cant_map_console_info___s_._ErrCode0x_08X_n_s
lea eax, [esi + 0x114]
push 0x208
push eax
call fcn.00441b50
add esp, 0x18
mov eax, dword [esi + 4]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x483c70
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, ecx
call edi
push 0
push 1
push str.Initializing_ConEmu__4_
mov ecx, esi
mov ebx, eax
call fcn.00479200
lea eax, [esi + 0x373c]
push eax
push 0
push esi
push 0x483ac0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 1
push str.Initializing_ConEmu__5_
mov ecx, esi
mov dword [esi + 0x3738], eax
call fcn.00479200
call edi
sub eax, ebx
cmp eax, 0x9c4
jbe 0x483d04
push eax
lea ecx, [ebp - 0xa0]
push str._DBG__Very_high_CPU_load__CreateThread_takes__u_ms
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [esi + 0x44d4]
add esp, 0xc
test ecx, ecx
je 0x483d04
push 1
push 0
push 0
lea edx, [ebp - 0xa0]
push edx
call fcn.004adc30
cmp dword [esi + 0x3738], 0
pop edi
pop esi
pop ebx
jne 0x483d2b
push 0
push 0
push 0
push 0
push str.Cant_create_console_thread_
call fcn.004200b0
add esp, 0x14
xor eax, eax
mov esp, ebp
pop ebp
ret
mov eax, 1
mov esp, ebp
pop ebp
ret