joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434420
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x451996
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x46e02c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x30]
xor ebx, ebx
mov dword [esi], vtable.adobe::xml_parser_t_struct_adobe::implementation::null_output_t_.0
mov dword [esi + 8], ebx
cmp eax, ebx
je 0x434475
push ebx
lea ecx, [esi + 0x10]
push ecx
lea edx, [esp + 0x40]
mov dword [esi + 8], eax
mov eax, dword [eax]
push edx
call eax
add esp, 0xc
mov byte [esp + 0x14], 2
mov eax, dword [esp + 0x50]
mov dword [esi + 0x28], ebx
cmp eax, ebx
je 0x434499
push ebx
lea ecx, [esi + 0x30]
push ecx
lea edx, [esp + 0x60]
mov dword [esi + 0x28], eax
mov eax, dword [eax]
push edx
call eax
add esp, 0xc
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
lea eax, [esi + 0x50]
push eax
mov byte [esp + 0x20], 3
call fcn.0043ffc0
mov byte [esp + 0x14], bl
mov eax, dword [esp + 0x30]
mov byte [esi + 0x118], bl
cmp eax, ebx
je 0x4344e0
mov eax, dword [eax]
cmp eax, ebx
je 0x4344dc
lea ecx, [esp + 0x38]
push 1
push ecx
mov edx, ecx
push edx
call eax
add esp, 0xc
mov dword [esp + 0x30], ebx
mov dword [esp + 0x14], 0xffffffff
mov eax, dword [esp + 0x50]
cmp eax, ebx
je 0x434505
mov eax, dword [eax]
cmp eax, ebx
je 0x434505
lea ecx, [esp + 0x58]
push 1
push ecx
mov edx, ecx
push edx
call eax
add esp, 0xc
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 0x54

Function at 0x436490
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44ba13
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x46e02c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call fcn.004082d0
mov dword [esp + 0x30], 1
call fcn.00435f90
lea ecx, [esp + 0xc]
mov dword [esp + 8], 1
mov byte [esp + 0x30], 0
call dword [0x4561c8]
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret 8

Function at 0x436a00
Capabilities:
Create thread

Disassembly:
mov eax, dword [edi + 8]
sub esp, 0x14
push ebx
push esi
lea ecx, [eax + 0x1c]
push ecx
push 4
push eax
push 0x436960
push 0
push 0
call dword [0x456480]
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x436a4c
lea ecx, [esp + 8]
call dword [0x45642c]
push 0x460514
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], vtable.boost::thread_resource_error.0
call fcn.00449b44
mov eax, dword [edi + 8]
add eax, 4
mov ecx, 1
lock xadd dword [eax], ecx
mov esi, dword [edi + 8]
mov eax, dword [esi + 8]
add esi, 8
test eax, eax
je 0x436a74
cmp eax, 0xffffffff
je 0x436a74
push eax
call dword [0x45617c]
mov dword [esi], ebx
mov edx, dword [edi + 8]
mov eax, dword [edx + 8]
push eax
call dword [0x456120]
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x447650
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44a109
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
mov eax, dword [0x46e02c]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov eax, dword [esp + 0x58]
mov edx, dword [eax + 0x3c]
mov esi, dword [eax + 0x10]
mov ecx, dword [eax + 0x40]
mov dword [esi], edx
mov esi, dword [eax + 0x20]
sub ecx, edx
mov dword [esi], edx
mov edx, dword [eax + 0x30]
push 1
xor ebx, ebx
push ebx
mov dword [edx], ecx
push eax
lea ecx, [esp + 0x18]
call dword [0x45629c]
mov edx, dword [esp + 0x5c]
mov dword [esp + 0x50], ebx
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 4]
and dword [esp + eax + 0x1c], 0xfffffffe
mov ecx, dword [esp + 0xc]
lea eax, [esp + eax + 0xc]
mov eax, dword [ecx + 4]
lea eax, [esp + eax + 0xc]
push edx
lea ecx, [esp + 0x10]
mov dword [eax + 0x14], 6
call dword [0x45619c]
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
mov edx, dword [ecx + eax + 8]
add ecx, eax
and dl, 6
movsx eax, dl
neg eax
sbb eax, eax
not eax
test ecx, eax
je 0x447701
lea ecx, [esp + 0xc]
call dword [0x456294]
cmp eax, 0xffffffff
jne 0x447701
mov bl, 1
lea ecx, [esp + 0xc]
mov dword [esp + 0x50], 0xffffffff
call dword [0x4562a4]
mov al, bl
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x48
ret 8

Function at 0x447730
Capabilities:
Generate random numbers via winapi

Disassembly:
push 0xffffffffffffffff
push 0x44a5a3
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x46e02c]
xor eax, esp
mov dword [esp + 0x3c], eax
push ebx
push ebp
push esi
mov eax, dword [0x46e02c]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], ebx
call dword [0x4561e4]
mov ebp, 1
mov dword [esp + 0x58], ebp
cmp esi, ebx
jne 0x447793
lea eax, [esp + 0x20]
push eax
mov ecx, edi
call dword [0x4561dc]
jmp 0x44780c
lea ecx, [esp + 0x3c]
push ecx
push 0x10
push esi
call dword [0x456028]
test eax, eax
jne 0x4477ac
lea edx, [esp + 0x20]
push edx
jmp 0x447804
xor esi, esi
mov edi, edi
movzx eax, byte [esp + esi + 0x3c]
mov ecx, eax
shr ecx, 4
and eax, 0x8000000f
mov dl, byte [ecx + str.0123456789ABCDEFincomplete_message_information__rejected_]
mov byte [esp + 0x18], dl
jns 0x4477d0
dec eax
or eax, 0xfffffff0
inc eax
mov ecx, dword [esp + 0x18]
mov al, byte [eax + str.0123456789ABCDEFincomplete_message_information__rejected_]
push ecx
lea ecx, [esp + 0x24]
mov byte [esp + 0x18], al
call dword [0x456240]
mov edx, dword [esp + 0x14]
push edx
lea ecx, [esp + 0x24]
call dword [0x456240]
add esi, ebp
cmp esi, 0x10
jb 0x4477b0
lea eax, [esp + 0x20]
push eax
mov ecx, edi
call dword [0x4561dc]
lea ecx, [esp + 0x20]
mov dword [esp + 0x10], ebp
mov byte [esp + 0x58], bl
call dword [0x4561d8]
mov eax, edi
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.00449014
add esp, 0x4c
ret
Function at 0x447840
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x44addc
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x46e02c]
xor eax, esp
mov dword [esp + 0x50], eax
push ebp
push esi
push edi
mov eax, dword [0x46e02c]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x44]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x18], 0
call dword [0x4561e4]
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push str.SoftwareAdobeIAC
mov edi, 1
push 0x80000001
mov dword [esp + 0x80], edi
call dword [0x456024]
test eax, eax
je 0x4478f6
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareAdobeIAC
push 0x80000001
call dword [0x456020]
test eax, eax
je 0x4478f6
lea eax, [esp + 0x44]
push eax
mov ecx, ebx
call dword [0x4561dc]
mov dword [esp + 0x18], edi
jmp 0x4479e9
mov eax, dword [esp + 0x10]
mov ebp, dword [0x456018]
lea ecx, [esp + 0x14]
push ecx
push 0
lea edx, [esp + 0x24]
push edx
push 0
push esi
push eax
call ebp
test eax, eax
jne 0x44797a
mov ecx, dword [esp + 0x14]
inc ecx
push ecx
call fcn.00449004
mov ecx, dword [esp + 0x14]
add esp, 4
lea edx, [esp + 0x14]
push edx
mov edi, eax
push edi
lea eax, [esp + 0x24]
push eax
push 0
push esi
push ecx
call ebp
push 0x29
lea ecx, [esp + 0x48]
call dword [0x4562ec]
xor esi, esi
lea esp, [esp]
cmp esi, dword [esp + 0x14]
jae 0x44796f
movzx eax, byte [esi + edi]
test al, al
je 0x44796f
push eax
lea ecx, [esp + 0x48]
call dword [0x456240]
inc esi
cmp esi, 0x28
jb 0x447950
push edi
call fcn.004490f8
add esp, 4
jmp 0x4479c9
mov ecx, dword [esp + 0x74]
lea edi, [esp + 0x28]
call fcn.00447730
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x70], 2
call dword [0x4561d4]
mov ecx, edi
mov byte [esp + 0x6c], 1
call dword [0x4561d8]
cmp dword [esp + 0x5c], 0x10
mov eax, dword [esp + 0x48]
jae 0x4479b3
lea eax, [esp + 0x48]
mov edx, dword [esp + 0x58]
push edx
push eax
mov eax, dword [esp + 0x18]
push 1
push 0
push esi
push eax
call dword [0x456014]
mov ecx, dword [esp + 0x10]
push ecx
call dword [0x456034]
lea edx, [esp + 0x44]
push edx
mov ecx, ebx
call dword [0x4561dc]
mov dword [esp + 0x18], 1
lea ecx, [esp + 0x44]
mov byte [esp + 0x6c], 0
call dword [0x4561d8]
mov eax, ebx
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.00449014
add esp, 0x60
ret

Function at 0x447a20
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ecx
cmp dword [esi], 0
push ebx
mov ebx, eax
mov dword [esp + 4], 0
jne 0x447a70
push edi
mov edi, dword [0x456010]
push 0
push 1
push 0
push 0
push esi
call edi
test eax, eax
jne 0x447a6f
push ebp
mov ebp, dword [0x45604c]
call ebp
cmp eax, 0x80090016
jne 0x447a6e
push 8
push 1
push 0
push 0
push esi
call edi
test eax, eax
jne 0x447a6e
call ebp
mov dword [esi], 0
pop ebp
pop edi
mov eax, dword [esi]
push eax
mov ecx, str.UserID
call fcn.00447840
add esp, 4
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x447a90
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ecx
cmp dword [esi], 0
push ebx
mov ebx, eax
mov dword [esp + 4], 0
jne 0x447ae0
push edi
mov edi, dword [0x456010]
push 0
push 1
push 0
push 0
push esi
call edi
test eax, eax
jne 0x447adf
push ebp
mov ebp, dword [0x45604c]
call ebp
cmp eax, 0x80090016
jne 0x447ade
push 8
push 1
push 0
push 0
push esi
call edi
test eax, eax
jne 0x447ade
call ebp
mov dword [esi], 0
pop ebp
pop edi
mov eax, dword [esi]
push eax
mov ecx, str.MD5ID
call fcn.00447840
add esp, 4
mov eax, ebx
pop ebx
pop ecx
ret

Function at 0x447b00
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ecx
cmp dword [esi], 0
push edi
mov edi, eax
mov dword [esp + 4], 0
jne 0x447b50
push ebx
mov ebx, dword [0x456010]
push 0
push 1
push 0
push 0
push esi
call ebx
test eax, eax
jne 0x447b4f
push ebp
mov ebp, dword [0x45604c]
call ebp
cmp eax, 0x80090016
jne 0x447b4e
push 8
push 1
push 0
push 0
push esi
call ebx
test eax, eax
jne 0x447b4e
call ebp
mov dword [esi], 0
pop ebp
pop ebx
mov ecx, dword [esi]
call fcn.00447730
mov eax, edi
pop edi
pop ecx
ret

Function at 0x447b60
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x44f796
mov eax, dword fs:[0]
push eax
sub esp, 0x280
mov eax, dword [0x46e02c]
xor eax, esp
mov dword [esp + 0x27c], eax
push esi
mov eax, dword [0x46e02c]
xor eax, esp
push eax
lea eax, [esp + 0x288]
mov dword fs:[0], eax
push 0
push 0x2b
lea eax, [esp + 0x84]
push eax
push 0
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], 0
call dword [0x4564e0]
test eax, eax
jne 0x447bca
push eax
mov ecx, edi
call dword [0x4561e0]
jmp 0x447cde
lea ecx, [esp + 0x28]
call dword [0x4561cc]
lea ecx, [esp + 0x28]
mov dword [esp + 0x290], 1
call dword [0x456230]
lea eax, [esp + 0x7c]
lea ecx, [esp + 0x28]
call fcn.004087f0
mov eax, str.Adobe
lea ecx, [esp + 0x28]
call fcn.004087f0
mov eax, 0x45b580
lea ecx, [esp + 0x28]
call fcn.004087f0
mov eax, 0x45d188
lea ecx, [esp + 0x28]
call fcn.004087f0
lea ecx, [esp + 0x60]
call dword [0x4561e4]
lea ecx, [esp + 0x28]
mov byte [esp + 0x290], 2
call fcn.00408ba0
test al, al
je 0x447ca5
lea ecx, [esp + 0x44]
lea eax, [esp + 0x28]
call fcn.004082d0
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x48]
mov byte [esp + 0x294], 3
call dword [0x4563b4]
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x48]
mov esi, eax
call dword [0x4563b8]
mov ecx, dword [esi + 4]
mov edx, dword [esi]
push ecx
mov ecx, dword [eax + 4]
push edx
mov edx, dword [eax]
push ecx
push edx
lea eax, [esp + 0x70]
push eax
lea esi, [esp + 0x28]
call fcn.00408fc0
add esp, 0x14
lea ecx, [esp + 0x44]
mov byte [esp + 0x290], 2
call dword [0x4561c8]
lea ecx, [esp + 0x60]
push ecx
mov ecx, edi
call dword [0x4561dc]
lea ecx, [esp + 0x60]
mov dword [esp + 0xc], 1
mov byte [esp + 0x290], 1
call dword [0x4561d8]
lea ecx, [esp + 0x28]
mov byte [esp + 0x290], 0
call dword [0x4561c8]
mov eax, edi
mov ecx, dword [esp + 0x288]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x27c]
xor ecx, esp
call fcn.00449014
add esp, 0x28c
ret
Function at 0x447d20
Capabilities:
Get common file path

Disassembly:
sub esp, 0x220
mov eax, dword [0x46e02c]
xor eax, esp
mov dword [esp + 0x218], eax
push esi
lea eax, [esp + 0xc]
push eax
push 0x1a
push 0
mov esi, ecx
call dword [0x4564d4]
test eax, eax
jne 0x447dda
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [0x4564d0]
cmp eax, 1
jne 0x447dae
mov ecx, esi
call dword [0x456230]
lea eax, [esp + 0x10]
mov ecx, esi
call fcn.004087f0
mov eax, str.Adobe
mov ecx, esi
call fcn.004087f0
mov ecx, esi
call fcn.00408ba0
test al, al
jne 0x447d92
call fcn.00448cf0
mov eax, 0x45b580
mov ecx, esi
call fcn.004087f0
mov ecx, esi
call fcn.00408ba0
test al, al
jne 0x447dae
call fcn.00448cf0
lea eax, [esp + 8]
push eax
call dword [0x4564e4]
test eax, eax
jne 0x447dda
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov ecx, dword [esp + 0x21c]
pop esi
xor ecx, esp
call fcn.00449014
add esp, 0x220
ret

Function at 0x447df0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44f719
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x46e02c]
xor eax, esp
mov dword [esp + 0x30], eax
push edi
mov eax, dword [0x46e02c]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
lea ecx, [esp + 0x1c]
call dword [0x4561cc]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
mov dword [esp + 0x4c], 0
call dword [0x456244]
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
mov edi, eax
call dword [0x45624c]
mov edx, dword [edi + 4]
mov ecx, dword [edi]
push edx
mov edx, dword [eax + 4]
mov eax, dword [eax]
push ecx
push edx
push eax
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.00408f20
add esp, 0x18
push str..ini
lea ecx, [esp + 0x20]
call dword [0x4561ac]
mov ecx, ebx
call fcn.00447d20
cmp dword [esp + 0x34], 8
mov eax, dword [esp + 0x20]
jae 0x447e98
lea eax, [esp + 0x20]
mov ecx, ebx
call fcn.004087f0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x48], 0xffffffff
call dword [0x4561c8]
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00449014
mov esp, ebp
pop ebp
ret
Function at 0x447ed0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44f719
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x46e02c]
xor eax, esp
mov dword [esp + 0x30], eax
push edi
mov eax, dword [0x46e02c]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
lea ecx, [esp + 0x1c]
call dword [0x4561cc]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
mov dword [esp + 0x4c], 0
call dword [0x456244]
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
mov edi, eax
call dword [0x45624c]
mov edx, dword [edi + 4]
mov ecx, dword [edi]
push edx
mov edx, dword [eax + 4]
mov eax, dword [eax]
push ecx
push edx
push eax
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.00408f20
add esp, 0x18
push str..xml
lea ecx, [esp + 0x20]
call dword [0x4561ac]
mov ecx, ebx
call fcn.00447d20
cmp dword [esp + 0x34], 8
mov eax, dword [esp + 0x20]
jae 0x447f78
lea eax, [esp + 0x20]
mov ecx, ebx
call fcn.004087f0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x48], 0xffffffff
call dword [0x4561c8]
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00449014
mov esp, ebp
pop ebp
ret
Function at 0x448470
Capabilities:
Hide graphical window
Log keystrokes

Disassembly:
sub esp, 0xc
cmp dword [eax + 0x18], 0x10
jb 0x44847e
mov eax, dword [eax + 4]
jmp 0x448481
add eax, 4
push esi
push 0
push eax
call dword [0x456500]
mov esi, eax
test esi, esi
je 0x44858f
push ebx
push ebp
push edi
mov edi, dword [0x456514]
push 0
push esi
call edi
lea eax, [esp + 0x10]
push eax
push esi
mov dword [esp + 0x18], 0
call edi
call dword [0x4560e0]
push 0
mov ebp, eax
call dword [0x4564fc]
push eax
call edi
mov edi, eax
call dword [0x456184]
push 0xfffffffffffffffc
push esi
mov ebx, eax
call dword [0x4564f4]
test eax, eax
je 0x44852f
cmp dword [esp + 0x10], ebp
jne 0x44852f
cmp edi, ebx
je 0x44852f
mov ebp, dword [0x456504]
push 1
push ebx
push edi
call ebp
test eax, eax
je 0x44852f
push esi
call dword [0x45650c]
test eax, eax
je 0x448506
push 1
jmp 0x448508
push 5
push esi
call dword [0x4564ec]
push esi
call dword [0x456508]
push 1
push 0
push esi
call dword [0x4564f8]
push 0
push ebx
push edi
call ebp
pop edi
pop ebp
pop ebx
pop esi
add esp, 0xc
ret
push esi
call dword [0x45650c]
test eax, eax
je 0x44853e
push 1
jmp 0x448540
push 5
push esi
call dword [0x4564ec]
mov edi, dword [0x4564f0]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0x2000
call edi
push 2
lea edx, [esp + 0x18]
push edx
push 0
push 0x2001
mov dword [esp + 0x24], 0
call edi
push esi
call dword [0x456508]
push 2
lea eax, [esp + 0x1c]
push eax
push 0
push 0x2001
call edi
pop edi
pop ebp
pop ebx
pop esi
add esp, 0xc
ret
Function at 0x448ac0
Capabilities:
Enumerate gui resources

Disassembly:
push ecx
push esi
mov esi, dword [0x456500]
push 0
push str.SwitchBoardLauncher
call esi
test eax, eax
je 0x448ada
mov al, 1
pop esi
pop ecx
ret
push 0
push 0x45b59c
call esi
test eax, eax
jne 0x448aec
xor al, al
pop esi
pop ecx
ret
call dword [0x4560e0]
mov esi, eax
lea eax, [esp + 4]
push eax
push 0x448a00
mov dword [esp + 0xc], esi
call dword [0x456528]
xor eax, eax
cmp esi, dword [esp + 4]
pop esi
setne al
pop ecx
ret

Function at 0x448b20
Capabilities:
Accept command line arguments

Disassembly:
push 0xffffffffffffffff
push 0x44f69a
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x46e02c]
xor eax, esp
mov dword [esp + 0x6c], eax
push ebp
push esi
push edi
mov eax, dword [0x46e02c]
xor eax, esp
push eax
lea eax, [esp + 0x84]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x94]
mov esi, ecx
mov ecx, ebp
call dword [0x4561c0]
lea ecx, [esp + 0x44]
call dword [0x4561cc]
lea eax, [esp + 0x20]
push eax
mov ecx, esi
mov dword [esp + 0x90], 0
call dword [0x456244]
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
mov edi, eax
call dword [0x45624c]
mov edx, dword [edi + 4]
mov ecx, dword [edi]
push edx
mov edx, dword [eax + 4]
mov eax, dword [eax]
push ecx
push edx
push eax
lea ecx, [esp + 0x54]
push ecx
lea edx, [esp + 0x28]
push edx
call fcn.00408f20
mov eax, dword [esp + 0x60]
add esp, 0x18
cmp dword [esp + 0x5c], 8
mov dword [esp + 0x10], 0
jae 0x448bcd
lea eax, [esp + 0x48]
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [0x4564dc]
cmp dword [esp + 0x10], 0
jle 0x448ca9
mov edx, dword [eax]
mov eax, edx
lea esi, [eax + 2]
jmp 0x448bf0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x448bf0
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x4c]
call dword [0x4561a4]
lea edx, [esp + 0x60]
push edx
lea esi, [esp + 0x48]
call fcn.00408250
lea ecx, [esp + 0x60]
mov byte [esp + 0x8c], 1
call fcn.00408ba0
test al, al
je 0x448c97
lea ecx, [esp + 0x28]
lea eax, [esp + 0x60]
call fcn.004082d0
push eax
mov ecx, esi
mov byte [esp + 0x90], 2
call dword [0x456234]
lea ecx, [esp + 0x28]
mov byte [esp + 0x8c], 1
call dword [0x4561c8]
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call dword [0x456228]
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x48]
mov esi, eax
call dword [0x45622c]
mov edx, dword [esi + 4]
mov ecx, dword [esi]
push edx
mov edx, dword [eax + 4]
mov eax, dword [eax]
push ecx
push edx
push eax
push ebp
lea esi, [esp + 0x28]
call fcn.00408fc0
add esp, 0x14
lea ecx, [esp + 0x60]
mov byte [esp + 0x8c], 0
call dword [0x4561c8]
lea ecx, [esp + 0x44]
mov dword [esp + 0x8c], 0xffffffff
call dword [0x4561c8]
mov ecx, dword [esp + 0x84]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x6c]
xor ecx, esp
call fcn.00449014
add esp, 0x80
ret 4
Function at 0x4024b7
Capabilities:
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [ebx]
mov dword [ebp + 0xc], eax
mov esi, dword [edi]
mov dword [ebp + 8], esi
add esi, 4
lea eax, [esi*4 + 4]
push eax
call fcn.004020c4
pop ecx
mov dword [edi], esi
mov esi, 0x408010
push 4
mov dword [ebx], eax
mov edx, esi
pop ebx
mov ecx, dword [edx]
cmp byte [ecx], 0x2d
jne 0x402500
cmp byte [ecx + 1], 0x4a
jne 0x402500
add ecx, 2
mov dword [eax], ecx
add eax, ebx
add edx, ebx
cmp edx, 0x408020
jl 0x4024ec
xor edi, edi
cmp dword [ebp + 8], edi
jle 0x402535
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx]
cmp byte [ecx], 0x2d
jne 0x40252d
cmp byte [ecx + 1], 0x4a
jne 0x40252d
add ecx, 2
cmp byte [ecx], 0
je 0x40257a
mov dword [eax], ecx
add eax, ebx
inc edi
add edx, ebx
cmp edi, dword [ebp + 8]
jl 0x402514
mov edx, esi
mov ecx, dword [edx]
cmp byte [ecx], 0x2d
jne 0x402544
cmp byte [ecx + 1], 0x4a
je 0x402548
mov dword [eax], ecx
add eax, ebx
add edx, ebx
cmp edx, 0x408020
jl 0x402537
mov esi, dword [ebp + 8]
test esi, esi
jle 0x402572
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx]
cmp byte [ecx], 0x2d
jne 0x402569
cmp byte [ecx + 1], 0x4a
je 0x40256d
mov dword [eax], ecx
add eax, ebx
add edx, ebx
dec esi
jne 0x40255c
and dword [eax], 0
pop edi
pop esi
pop ebx
pop ebp
ret
push 1
push str.Error:_the__J_option_should_not_be_followed_by_a_space.
call fcn.004035ac
pop ecx
pop ecx
push 1
call dword [sym.imp.MSVCRT.dll_exit]