joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424fb6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x500144]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
push 2
pop edx
mov dword [ebp - 0x414], ecx
xor ecx, ecx
push edx
push ecx
push eax
mov dword [ebp - 0x418], ecx
mov dword [ebp - 0x410], ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x425009
call fcn.00423c7f
mov esi, eax
jmp 0x4250d8
push 0
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov esi, eax
test esi, esi
jne 0x425024
call fcn.00423c7f
jmp 0x4250cf
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x42501a
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x42504d
mov esi, 0x8007000e
jmp 0x4250d8
push 2
pop ecx
mul ecx
test edx, edx
ja 0x425104
jb 0x425065
cmp eax, 0xffffffff
ja 0x425104
cmp eax, 0x400
jbe 0x425080
push eax
lea ecx, [ebp - 0x410]
call fcn.00423c51
mov eax, dword [ebp - 0x410]
jmp 0x42508c
lea eax, [ebp - 0x40c]
mov dword [ebp - 0x410], eax
test eax, eax
jne 0x425097
mov esi, 0x8007000e
jmp 0x4250d1
push esi
push eax
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x42501a
mov eax, dword [ebp - 0x410]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x418]
push dword [ebp - 0x410]
call fcn.00424e67
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x40c]
cmp dword [ebp - 0x410], eax
je 0x4250f1
lea ecx, [ebp - 0x410]
call fcn.00423c41
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fb5e0
leave
ret 0x10
mov ecx, 0x80070057
call fcn.00424428
int3
Function at 0x428495
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov ebx, ecx
test edi, edi
je 0x428580
cmp dword [edi], eax
je 0x428580
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x428580
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0044e441
mov esi, eax
test esi, esi
jns 0x42852c
mov eax, dword [section..data]
cmp eax, section..data
je 0x428511
test byte [eax + 0x1c], 1
je 0x428511
cmp byte [eax + 0x19], 2
jb 0x428511
call fcn.0042386b
push esi
push eax
mov eax, dword [section..data]
mov edx, 0x407fe4
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x32
pop ecx
call fcn.00421fda
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, eax
call fcn.0046905b
jmp 0x4285c7
push dword [edi + 4]
mov ecx, ebx
call fcn.00427d87
mov esi, eax
test esi, esi
jns 0x42857a
mov eax, dword [section..data]
cmp eax, section..data
je 0x4285c5
test byte [eax + 0x1c], 8
je 0x4285c5
cmp byte [eax + 0x19], 2
jb 0x4285c5
call fcn.0042386b
push esi
push 0x407f68
push eax
mov eax, dword [section..data]
mov edx, 0x407fe4
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x33
pop ecx
call fcn.0042371b
jmp 0x4285c5
xor ebx, ebx
mov esi, ebx
jmp 0x4285c7
mov eax, dword [section..data]
mov esi, 0x80070057
cmp eax, section..data
je 0x4285c1
test byte [eax + 0x1c], 8
je 0x4285c1
cmp byte [eax + 0x19], 2
jb 0x4285c1
call fcn.0042386b
push esi
push 0x407f50
push eax
mov eax, dword [section..data]
mov edx, 0x407fe4
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x31
pop ecx
call fcn.0042371b
test edi, edi
je 0x4285de
xor ebx, ebx
mov eax, dword [edi]
test eax, eax
je 0x4285de
add eax, 0x1060
cmp word [eax], bx
je 0x4285de
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call fcn.004289c2
not esi
shr esi, 0x1f
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x428d97
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x500144]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x50111c], 0
je 0x428dc5
xor eax, eax
cmp dword [0x501128], eax
setne al
jmp 0x428efe
push esi
push edi
push 0x90
xor esi, esi
lea eax, [ebp - 0x94]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x98], 0x94
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor eax, eax
cmp dword [ebp - 0x88], 2
push 0x407ff4
sete al
mov dword [0x501118], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x428ec6
push 0x408004
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x501138], eax
test eax, eax
je 0x428ec6
push 0x408018
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x501134], eax
test eax, eax
je 0x428ec6
push 0x40802c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x501130], eax
test eax, eax
je 0x428ec6
push 0x40803c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x50112c], eax
test eax, eax
je 0x428ec6
push 0x408050
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x501124], eax
test eax, eax
je 0x428ec6
push 0x408064
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x501120], eax
test eax, eax
je 0x428ec6
cmp dword [0x501118], esi
je 0x428eac
push 0x408078
jmp 0x428eb1
push 0x408088
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x501128], eax
test eax, eax
je 0x428ec6
xor esi, esi
inc esi
jmp 0x428ef0
mov dword [0x501138], esi
mov dword [0x501134], esi
mov dword [0x501130], esi
mov dword [0x50112c], esi
mov dword [0x501128], esi
mov dword [0x501124], esi
mov dword [0x501120], esi
pop edi
mov eax, esi
mov dword [0x50111c], 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fb5e0
leave
ret
Function at 0x4313d2
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x500144]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp dword [esi + 4], 0
je 0x431412
push 0xfffffffffffffff0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x20000000
je 0x431412
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x34]
lea eax, [ebp - 0x208]
push 0x100
push eax
mov edx, 0xbb7
call fcn.004eada2
mov ebx, section..data
test eax, eax
jne 0x431475
mov eax, dword [section..data]
cmp eax, ebx
je 0x43145e
test byte [eax + 0x1c], 1
je 0x43145e
cmp byte [eax + 0x19], 1
jb 0x43145e
push dword [eax + 0x14]
mov edx, 0x408e54
mov ecx, 0xd9
push dword [eax + 0x10]
call fcn.00433258
push ecx
push 0x408cd0
push ecx
mov edx, 0x100
lea ecx, [ebp - 0x208]
call fcn.0041f7ed
push dword [ebp + 0xc]
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x408]
push 0x100
push eax
call fcn.0041f7a9
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x408]
add esp, 0x10
mov edx, edi
push 0x10010
push eax
call fcn.004eaac9
mov esi, eax
mov eax, dword [section..data]
cmp eax, ebx
je 0x4314e6
test byte [eax + 0x1c], 1
je 0x4314e6
cmp byte [eax + 0x19], 4
jb 0x4314e6
call fcn.0042386b
push esi
push eax
mov eax, dword [section..data]
mov edx, 0x408e54
mov ecx, 0xda
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00421fda
mov eax, dword [section..data]
sub esi, 1
je 0x431530
dec esi
sub esi, 1
je 0x431530
sub esi, 1
je 0x431528
cmp eax, ebx
je 0x43153f
test byte [eax + 0x1c], 1
je 0x43153f
cmp byte [eax + 0x19], 3
jb 0x43153f
call fcn.0042386b
push eax
mov eax, dword [section..data]
mov edx, 0x408e54
mov ecx, 0xdb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.004238e7
jmp 0x43153f
call dword [sym.imp.KERNEL32.dll_DebugBreak]
jmp 0x43153f
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fb5e0
leave
ret 8
Function at 0x436cd0
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x20]
mov edi, dword [eax + 4]
mov eax, dword [section..data]
cmp eax, section..data
je 0x436d23
test byte [eax + 0x1c], 1
je 0x436d23
cmp byte [eax + 0x19], 4
jb 0x436d23
call fcn.0042386b
xor ecx, ecx
mov edx, 0x4093c0
cmp dword [ebp + 8], ecx
setne cl
push ecx
push eax
mov eax, dword [section..data]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x4c
pop ecx
call fcn.00421fda
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x436d3e
call fcn.0049de98
mov eax, dword [esi + 0xc]
mov ecx, esi
push edi
and dword [eax + 0x28], 0
call fcn.00437130
cmp dword [esi + 0x20], 0
je 0x436ed1
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x436ed1
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
mov eax, ebx
and al, 3
cmp al, 2
jne 0x436db3
mov eax, dword [section..data]
cmp eax, section..data
je 0x436dae
test byte [eax + 0x1c], 1
je 0x436dae
cmp byte [eax + 0x19], 4
jb 0x436dae
call fcn.0042386b
mov ecx, ebx
mov edx, 0x4093c0
and ecx, 2
push ecx
xor ecx, ecx
cmp dword [ebp + 8], ecx
setne cl
push ecx
push eax
mov eax, dword [section..data]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x4d
pop ecx
call fcn.00429397
mov eax, dword [section..data]
xor ecx, ecx
inc ecx
jmp 0x436db8
mov eax, dword [section..data]
cmp dword [ebp + 8], 0
jne 0x436eb7
test ecx, ecx
jne 0x436eb7
cmp eax, section..data
je 0x436dfe
test byte [eax + 0x1c], 1
je 0x436dfe
cmp byte [eax + 0x19], 5
jb 0x436dfe
call fcn.0042386b
push ebx
push 0
push eax
mov eax, dword [section..data]
mov edx, 0x4093c0
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x4e
pop ecx
call fcn.00429397
and bl, 1
mov ecx, esi
movzx eax, bl
neg eax
sbb eax, eax
and eax, 3
inc eax
mov dword [esi + 0x72c], eax
call fcn.00437188
mov eax, dword [esi + 0x20]
mov ecx, esi
push dword [eax + 4]
call fcn.004370d2
mov ecx, dword [esi + 0x20]
and dword [esi + 0x730], 0xfffffffd
call fcn.0042fa75
xor ebx, ebx
mov ecx, esi
inc ebx
push ebx
call fcn.004351bb
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x20]
push edi
mov dword [eax + 0x298], ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
mov ecx, esi
call fcn.004379c7
mov ecx, esi
call fcn.004367a0
push eax
call dword [sym.imp.USER32.dll_SetFocus]
test eax, eax
jne 0x436ed1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x436ed1
test byte [ecx + 0x1c], 8
je 0x436ed1
cmp byte [ecx + 0x19], 2
jb 0x436ed1
call fcn.0042386b
push edi
push eax
mov eax, dword [section..data]
mov edx, 0x4093c0
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x4f
pop ecx
call fcn.00421fda
jmp 0x436ed1
push 0
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x20]
or dword [esi + 0x730], 2
and dword [eax + 0x298], 0
mov ecx, esi
call fcn.00438bf6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x43b496
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor eax, eax
xor ebx, ebx
push edi
mov edi, ecx
inc ebx
mov esi, eax
call fcn.0043ac75
test eax, eax
jne 0x43b5e9
test edi, edi
je 0x43b5e9
push 0x5c
pop edx
cmp word [edi], dx
jne 0x43b536
cmp word [edi + 2], dx
jne 0x43b536
push 2
pop esi
movzx eax, word [edi + esi*2]
test ax, ax
je 0x43b4dd
inc esi
cmp ax, dx
jne 0x43b4ce
xor eax, eax
cmp word [edi + esi*2], ax
jne 0x43b522
mov eax, dword [section..data]
cmp eax, section..data
je 0x43b627
test byte [eax + 0x1c], 1
je 0x43b627
cmp byte [eax + 0x19], 2
jb 0x43b627
call fcn.0042386b
push edi
push eax
mov eax, dword [section..data]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x34
jmp 0x43b61c
cmp word [edi + esi*2 + 2], 0x24
jne 0x43b55c
cmp word [edi + esi*2 + 4], dx
jne 0x43b55c
add esi, 3
jmp 0x43b55c
movzx eax, word [edi + esi*2]
test ax, ax
je 0x43b545
inc esi
cmp eax, 0x3a
jne 0x43b536
movzx eax, word [edi + esi*2]
test ax, ax
je 0x43b5f0
cmp ax, dx
jne 0x43b5f0
inc esi
lea eax, [edi + esi*2]
mov dword [ebp - 4], eax
movzx ecx, word [eax]
test cx, cx
je 0x43b5e9
cmp cx, dx
jne 0x43b5a7
xor ecx, ecx
mov word [eax], cx
mov ecx, edi
call fcn.0043ac75
test eax, eax
jne 0x43b59e
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x43b59e
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0xb7
neg eax
sbb eax, eax
not eax
and ebx, eax
mov eax, dword [ebp - 4]
push 0x5c
pop edx
mov word [eax], dx
add eax, 2
mov esi, ebx
mov dword [ebp - 4], eax
test ebx, ebx
jne 0x43b562
mov eax, dword [section..data]
cmp eax, section..data
je 0x43b5e9
test byte [eax + 0x1c], 1
je 0x43b5e9
cmp byte [eax + 0x19], 2
jb 0x43b5e9
call fcn.0042386b
push eax
mov eax, dword [section..data]
mov edx, 0x409694
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x36
pop ecx
call fcn.004238e7
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [section..data]
cmp eax, section..data
je 0x43b627
test byte [eax + 0x1c], 1
je 0x43b627
cmp byte [eax + 0x19], 2
jb 0x43b627
call fcn.0042386b
push edi
push eax
mov eax, dword [section..data]
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x35
mov edx, 0x409694
pop ecx
call fcn.004330da
xor eax, eax
jmp 0x43b5eb
Function at 0x43bf4a
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x500144]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x114
push eax
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x43bf96
cmp dword [ebp - 0x11c], 5
jb 0x43bf91
jne 0x43bfd6
cmp dword [ebp - 0x118], edi
jne 0x43bfd6
xor edi, edi
inc edi
jmp 0x43bfd6
mov eax, dword [section..data]
cmp eax, section..data
je 0x43bfd6
test byte [eax + 0x1c], 1
je 0x43bfd6
cmp byte [eax + 0x19], 2
jb 0x43bfd6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.0042386b
mov ecx, dword [section..data]
mov edx, 0x409694
push esi
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0x42
pop ecx
call fcn.00421fda
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.004fb5e0
leave
ret
Function at 0x4526e0
Capabilities:
Check for software breakpoints

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
sub ecx, dword [esi]
sub edx, dword [esi + 4]
xor edi, edi
mov dword [ebp - 8], ecx
mov eax, edi
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], edi
cmp ecx, dword [eax + 0x40dd14]
jne 0x452716
cmp edx, dword [eax + 0x40dd18]
je 0x452722
add eax, 0xc
cmp eax, 0xcc
jb 0x452706
jmp 0x452729
mov dword [ebp - 0xc], 1
mov ebx, dword [ebp + 0x14]
mov edx, dword [ebx]
cmp edx, 0x20
jae 0x45282b
test edx, edx
je 0x4527b0
mov ecx, edi
lea eax, [ebx + 8]
mov esi, dword [ebp - 8]
cmp dword [eax - 4], esi
mov esi, dword [ebp + 0x10]
jne 0x45275b
mov esi, dword [ebp - 4]
cmp dword [eax], esi
je 0x45282b
mov esi, dword [ebp + 0x10]
jmp 0x452764
mov ebx, dword [ebp - 8]
cmp dword [eax - 4], ebx
mov ebx, dword [ebp + 0x14]
ja 0x452770
inc ecx
add eax, 0xc
cmp ecx, edx
jb 0x452740
jmp 0x452773
xor edi, edi
inc edi
mov eax, ecx
mov dword [ebp - 4], eax
test edi, edi
je 0x4527b5
mov dword [ebp - 4], eax
cmp edx, ecx
jbe 0x4527b5
imul eax, edx, 0xc
add eax, 4
add eax, ebx
sub edx, ecx
mov dword [ebp - 8], eax
mov eax, ecx
mov ebx, dword [ebp - 8]
mov dword [ebp - 4], eax
mov edi, ebx
lea esi, [ebx - 0xc]
sub ebx, 0xc
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub edx, 1
jne 0x452798
mov ebx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
jmp 0x4527b5
mov eax, edi
mov dword [ebp - 4], edi
mov edx, dword [ebp - 0xc]
imul ecx, eax, 0xc
mov eax, dword [esi + 8]
sub eax, dword [esi]
mov dword [ecx + ebx + 4], eax
mov eax, dword [esi + 0xc]
sub eax, dword [esi + 4]
mov dword [ecx + ebx + 8], eax
mov dword [ecx + ebx + 0xc], edx
mov eax, dword [section..data]
cmp eax, section..data
je 0x452829
test byte [eax + 0x1c], 1
je 0x452829
cmp byte [eax + 0x19], 5
jb 0x452829
mov dword [ebp - 0xc], 0x40dc64
test edx, edx
jne 0x4527fc
mov dword [ebp - 0xc], 0x40dc78
mov edi, dword [esi + 0xc]
mov eax, dword [ebp + 0x10]
sub edi, dword [esi + 4]
mov esi, dword [esi + 8]
sub esi, dword [eax]
call fcn.0042386b
push dword [ebp - 4]
mov ecx, dword [section..data]
push dword [ebp - 0xc]
push edi
push esi
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.00451e1b
inc dword [ebx]
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret 0x10
Function at 0x467ab7
Capabilities:
Get keyboard layout

Disassembly:
mov edi, edi
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x58
push esi
push edi
mov byte [0x501260], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [0x501258], eax
lea edi, [ebp - 0x58]
sub eax, dword [0x501248]
mov esi, 0x5011f0
push 0x14
pop ecx
mov dword [0x50125c], edx
sbb edx, dword [0x50124c]
rep movsd dword es:[edi], dword [esi]
push 0
mov dword [0x501240], eax
mov dword [0x501244], edx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 0x50
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov edx, dword [ebp - 4]
lea esi, [ebp - 0x58]
sub esp, 0x50
push 0x14
pop ecx
mov edi, esp
push dword [0x501244]
rep movsd dword es:[edi], dword [esi]
push dword [0x501240]
mov ecx, eax
call fcn.00467eb8
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x467be3
Capabilities:
Get keyboard layout

Disassembly:
mov edi, edi
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x68
push esi
push edi
mov dword [ebp - 0x14], edx
mov dword [ebp - 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov esi, eax
mov edi, edx
mov eax, dword [ebp - 0xc]
xor edx, edx
movzx ecx, al
mov dword [ebp - 8], ecx
mov ecx, eax
shr ecx, 0x18
mov dword [0x501250], esi
mov dword [0x501254], edi
test ecx, ecx
jne 0x467c72
inc ecx
mov dword [ebp - 4], ecx
cmp eax, 0xb08
je 0x467c4f
cmp dword [ebp - 8], 2
je 0x467c4f
cmp dword [ebp - 8], ecx
je 0x467c4f
cmp eax, 0x1f07
je 0x467c4f
mov byte [ebp - 4], dl
cmp byte [0x501260], dl
je 0x467ca0
sub esi, dword [0x501258]
push edx
sbb edi, dword [0x50125c]
push 0x3e8
push edi
push esi
call fcn.004fcf90
jmp 0x467ce6
cmp ecx, 3
jne 0x467c4c
cmp eax, 0x300001a
je 0x467c9a
cmp eax, 0x300001d
je 0x467c9a
cmp eax, 0x3000001
je 0x467c9a
cmp eax, 0x300001e
je 0x467c9a
cmp eax, 0x3000026
jne 0x467c4c
mov byte [ebp - 4], 1
jmp 0x467c4f
push 0x14
pop ecx
mov esi, 0x5011f0
lea edi, [ebp - 0x68]
rep movsd dword es:[edi], dword [esi]
push edx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 0x50
mov dword [ebp - 8], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov edx, dword [ebp - 8]
lea esi, [ebp - 0x68]
sub esp, 0x50
push 0x14
pop ecx
mov edi, esp
push dword [0x501244]
rep movsd dword es:[edi], dword [esi]
push dword [0x501240]
mov ecx, eax
call fcn.00467eb8
xor eax, eax
mov edx, eax
mov cl, byte [ebp - 4]
push edx
mov edx, dword [ebp - 0xc]
push eax
push dword [ebp - 0x14]
call fcn.0046807c
call fcn.00467b54
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x46843b
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebx
push esi
push edi
push 0x1c
mov edi, ecx
call fcn.004fb25b
mov esi, eax
pop ecx
test esi, esi
je 0x4684e7
xor ebx, ebx
mov edx, 0x40f25c
push 2
mov byte [esi], bl
mov ecx, 0x407cfc
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x18], ebx
push 0x7080
mov dword [esi + 0x10], edi
call fcn.004975f3
imul eax, eax, 0x3e8
mov dword [esi + 4], eax
lea eax, [esi + 0x18]
push eax
push ebx
push esi
push 0x468100
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x14], eax
test eax, eax
jne 0x4684e3
mov eax, dword [section..data]
cmp eax, section..data
je 0x4684d3
test byte [eax + 0x1c], 1
je 0x4684d3
cmp byte [eax + 0x19], 2
jb 0x4684d3
call fcn.0042386b
push eax
mov eax, dword [section..data]
mov edx, 0x40f2e4
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x12
pop ecx
call fcn.004238e7
mov ecx, esi
call fcn.00468529
push esi
call fcn.004fb234
pop ecx
jmp 0x46851d
mov eax, esi
jmp 0x46851f
mov eax, dword [section..data]
cmp eax, section..data
je 0x46851d
test byte [eax + 0x1c], 1
je 0x46851d
cmp byte [eax + 0x19], 2
jb 0x46851d
call fcn.0042386b
push eax
mov eax, dword [section..data]
mov edx, 0x40f2e4
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x11
pop ecx
call fcn.004238e7
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x468fa8
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
test esi, esi
je 0x469019
movzx ecx, word [esi]
push 0x20
pop edi
push 0x22
pop ebx
cmp cx, bx
jne 0x468feb
mov edx, esi
add esi, 2
movzx eax, word [esi]
mov ecx, eax
test ax, ax
je 0x468fdb
cmp ax, bx
jne 0x468fc7
cmp ax, bx
jne 0x468fe6
lea esi, [edx + 4]
movzx ecx, word [esi]
movzx eax, cx
jmp 0x468ffd
mov eax, ecx
cmp cx, di
jbe 0x468ffd
add esi, 2
movzx eax, word [esi]
cmp ax, di
ja 0x468ff2
test ax, ax
je 0x46904f
movzx ecx, ax
cmp cx, di
ja 0x46904f
add esi, 2
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x469005
jmp 0x46904f
mov eax, dword [section..data]
cmp eax, section..data
je 0x46904f
test byte [eax + 0x1c], 1
je 0x46904f
cmp byte [eax + 0x19], 2
jb 0x46904f
call fcn.0042386b
push eax
mov eax, dword [section..data]
mov edx, 0x40f87c
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0xa
pop ecx
call fcn.004238e7
pop edi
mov eax, esi
pop esi
pop ebx
ret