joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431065
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4c3140]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [ebp + 8]
mov esi, edx
mov dword [ebp - 0x14], 0x67452301
mov edx, ecx
mov dword [ebp - 0x10], 0xefcdab89
lea ecx, [ebp - 0x14]
mov dword [ebp - 0xc], 0x98badcfe
mov dword [ebp - 8], 0x10325476
call fcn.004305c2
pop ecx
mov ecx, dword [ebp - 0x14]
mov eax, ecx
shr eax, 8
mov byte [esi + 1], al
mov eax, ecx
shr eax, 0x10
mov byte [esi], cl
mov byte [esi + 2], al
shr ecx, 0x18
mov byte [esi + 3], cl
mov ecx, dword [ebp - 0x10]
mov eax, ecx
shr eax, 8
mov byte [esi + 5], al
mov eax, ecx
shr eax, 0x10
mov byte [esi + 4], cl
shr ecx, 0x18
mov byte [esi + 6], al
mov byte [esi + 7], cl
mov ecx, dword [ebp - 0xc]
mov eax, ecx
shr eax, 8
mov byte [esi + 9], al
mov eax, ecx
mov byte [esi + 8], cl
shr eax, 0x10
shr ecx, 0x18
mov byte [esi + 0xa], al
mov byte [esi + 0xb], cl
mov ecx, dword [ebp - 8]
mov eax, ecx
shr eax, 8
mov byte [esi + 0xd], al
mov eax, ecx
mov byte [esi + 0xc], cl
shr ecx, 0x18
mov byte [esi + 0xf], cl
mov ecx, dword [ebp - 4]
shr eax, 0x10
xor ecx, ebp
mov byte [esi + 0xe], al
mov al, 1
pop esi
call fcn.00458d97
leave
ret

Function at 0x43f565
Capabilities:
Create thread

Disassembly:
push 0x10
mov eax, 0x4838ea
call fcn.00459f52
mov ebx, ecx
mov esi, dword [ebp + 8]
push 0xb8
call fcn.00458da5
mov edi, eax
pop ecx
mov dword [ebp - 0x18], edi
and dword [ebp - 4], 0
mov ecx, edi
push esi
call fcn.00442b5b
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
call fcn.00441508
and dword [ebp - 0x18], 0
mov dword [ebp - 0x14], edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 1
call fcn.00441508
xor eax, eax
lea esi, [ebx + 4]
push esi
push eax
push edi
push 0x441804
push eax
push eax
call fcn.00467193
add esp, 0x18
mov dword [ebx], eax
test eax, eax
je 0x43f5d9
call fcn.00459f10
ret 4
and dword [esi], 0
push 6
call fcn.00457a25
int3

Function at 0x43f5e4
Capabilities:
Create thread

Disassembly:
push 0x10
mov eax, 0x48392e
call fcn.00459f52
mov ebx, ecx
mov esi, dword [ebp + 8]
push 0xb8
call fcn.00458da5
mov edi, eax
pop ecx
mov dword [ebp - 0x18], edi
and dword [ebp - 4], 0
mov ecx, edi
push esi
call fcn.00442c33
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
call fcn.004414eb
and dword [ebp - 0x18], 0
mov dword [ebp - 0x14], edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 1
call fcn.004414eb
xor eax, eax
lea esi, [ebx + 4]
push esi
push eax
push edi
push 0x441864
push eax
push eax
call fcn.00467193
add esp, 0x18
mov dword [ebx], eax
test eax, eax
je 0x43f658
call fcn.00459f10
ret 4
and dword [esi], 0
push 6
call fcn.00457a25
int3
Function at 0x43f663
Capabilities:
Create thread

Disassembly:
push 0xc
mov eax, 0x483972
call fcn.00459f52
mov ebx, ecx
mov esi, dword [ebp + 8]
push 0xd8
call fcn.00458da5
mov edi, eax
pop ecx
mov dword [ebp - 0x18], edi
and dword [ebp - 4], 0
mov ecx, edi
push esi
call fcn.00442ced
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
call fcn.004414ce
and dword [ebp - 0x18], 0
mov dword [ebp - 0x14], edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 1
call fcn.004414ce
xor eax, eax
lea esi, [ebx + 4]
push esi
push eax
push edi
push 0x4418c4
push eax
push eax
call fcn.00467193
add esp, 0x18
mov dword [ebx], eax
test eax, eax
je 0x43f6d7
call fcn.00459f10
ret 4
and dword [esi], 0
push 6
call fcn.00457a25
int3

Function at 0x43f6e2
Capabilities:
Create thread

Disassembly:
push 0xc
mov eax, 0x4839b6
call fcn.00459f52
mov ebx, ecx
mov esi, dword [ebp + 8]
push 0xc0
call fcn.00458da5
mov edi, eax
pop ecx
mov dword [ebp - 0x18], edi
and dword [ebp - 4], 0
mov ecx, edi
push esi
call fcn.00442e06
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
call fcn.004414b1
and dword [ebp - 0x18], 0
mov dword [ebp - 0x14], edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 1
call fcn.004414b1
xor eax, eax
lea esi, [ebx + 4]
push esi
push eax
push edi
push 0x441923
push eax
push eax
call fcn.00467193
add esp, 0x18
mov dword [ebx], eax
test eax, eax
je 0x43f756
call fcn.00459f10
ret 4
and dword [esi], 0
push 6
call fcn.00457a25
int3

Function at 0x43f761
Capabilities:
Create thread

Disassembly:
push 0xc
mov eax, 0x4839fa
call fcn.00459f52
mov ebx, ecx
mov esi, dword [ebp + 8]
push 0xa8
call fcn.00458da5
mov edi, eax
pop ecx
mov dword [ebp - 0x18], edi
and dword [ebp - 4], 0
mov ecx, edi
push esi
call fcn.00442ede
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
call fcn.00441494
and dword [ebp - 0x18], 0
mov dword [ebp - 0x14], edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 1
call fcn.00441494
xor eax, eax
lea esi, [ebx + 4]
push esi
push eax
push edi
push 0x441982
push eax
push eax
call fcn.00467193
add esp, 0x18
mov dword [ebx], eax
test eax, eax
je 0x43f7d5
call fcn.00459f10
ret 4
and dword [esi], 0
push 6
call fcn.00457a25
int3
Function at 0x4452a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4c3140]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x30
pop esi
push esi
xor edi, edi
mov ebx, 0x4c5648
push edi
push ebx
call fcn.00455160
add esp, 0xc
mov dword [0x4c5654], edi
mov dword [0x4c5648], esi
mov dword [0x4c5658], edi
push edi
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov edi, 0x7f00
mov dword [0x4c5668], eax
push edi
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov esi, dword [sym.imp.USER32.dll_LoadIconA]
push edi
push 0
mov dword [0x4c5664], eax
call esi
push edi
xor edi, edi
mov dword [0x4c5660], eax
push edi
call esi
push edi
mov dword [0x4c5674], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, str.Intermediate_D3D_Window
mov dword [0x4c565c], eax
push ebx
mov dword [0x4c5650], 0x4451fe
mov dword [0x4c5670], esi
mov dword [0x4c566c], 0x496d99
mov dword [0x4c564c], 3
call dword [sym.imp.USER32.dll_RegisterClassExA]
test ax, ax
je 0x4453af
push edi
push edi
push edi
push edi
push 0x64
push 0x64
push edi
push edi
push SysReAllocString
push 0x496d99
push esi
push 0x80088
call dword [sym.imp.USER32.dll_CreateWindowExA]
push 5
push eax
mov dword [0x4c5688], eax
call dword [sym.imp.USER32.dll_ShowWindow]
movaps xmm0, xmmword [0x4b1100]
lea eax, [ebp - 0x14]
push eax
push dword [0x4c5688]
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00458d97
leave
ret
push 0xde
call fcn.004681d3
int3
Function at 0x44e613
Capabilities:
Hide graphical window

Disassembly:
push 0xc
mov eax, 0x48812b
call fcn.00459f1f
mov edi, ecx
mov edx, str.ade7c95___
mov ecx, 0x4c49c0
call fcn.00450701
push eax
call fcn.00450861
pop ecx
push 2
pop ebx
mov word [0x4c7118], 0x101
mov byte [0x4c711a], 0
mov dword [0x4c7124], ebx
mov eax, dword [edi + 0xc]
push 0xd8
mov dword [0x4c7120], eax
call fcn.00458da5
mov esi, eax
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
sub esp, 0x14
mov ecx, esp
push 0x4c7744
call fcn.004103c9
mov ecx, esi
call fcn.0044e317
or dword [ebp - 4], 0xffffffff
lea ecx, [edi + 0x10]
push ecx
mov dword [0x4c711c], eax
lea ecx, [eax + 0xc0]
call fcn.004369c7
push str.zerohook
push 0x4aea88
push 0x65
push 0x4c744c
call fcn.00452bf0
push 0x4c7438
mov edx, 0x4c7298
mov ecx, 0x4c7138
call fcn.00445813
mov eax, dword [0x4c7290]
add esp, 0x14
mov ecx, ebx
mov dword [0x4c74b8], 0x3fc00000
mov dword [0x4c6828], 0x1c2
mov dword [0x4c682c], 0xe4
cmp byte [eax + 0x4b0d24], 0
push ebx
cmovne ecx, eax
mov dword [0x4c5644], 0x3f800000
mov eax, dword [0x4c5630]
mov dword [0x4c7448], ecx
push 0xff
mov dword [eax + 0x9c], 0x3fc00000
xor eax, eax
push eax
push dword [0x4c5688]
mov dword [0x4c67d0], eax
mov dword [0x4c67d4], eax
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
push 5
push dword [0x4c5688]
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, 1
call fcn.00459efc
ret
Function at 0x44f105
Capabilities:
Create thread

Disassembly:
push 0x34
mov eax, 0x488453
call fcn.00459f52
mov ebx, ecx
mov dword [ebp - 0x2c], ebx
and dword [ebp - 4], 0
lea edi, [ebp - 0x24]
mov dword [ebp - 0x40], ebx
xor eax, eax
and dword [ebp - 0x30], 0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0x94
push edi
call fcn.00458da5
push edi
mov esi, eax
push 0
push esi
mov dword [ebp - 0x2c], esi
call fcn.0045b240
add esp, 0xc
mov ecx, esi
call fcn.004504e2
xor edx, edx
mov edi, eax
mov dword [ebp - 0x24], edi
mov byte [ebp - 0x20], dl
mov byte [ebp - 0x1c], dl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x24]
mov dword [ebx], edx
mov dword [ebx + 4], edx
call fcn.004506e6
test al, al
je 0x44f23d
mov byte [ebp - 0x1c], 1
mov dword [ebx], edi
mov byte [ebx + 4], 1
test edi, edi
je 0x44f187
lock inc dword [edi + 4]
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x3c], edi
mov byte [ebp - 0x38], dl
mov byte [ebp - 0x34], 1
push 0xc
mov byte [ebp - 4], 2
call fcn.00458da5
mov esi, eax
mov dword [ebp - 0x30], 7
xor eax, eax
pop ecx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov dword [esi], edi
mov byte [esi + 4], al
mov byte [esi + 8], 1
mov dword [ebp - 0x2c], eax
call fcn.004509c1
and dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], esi
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.004509c1
lea eax, [ebp - 0x14]
push eax
xor eax, eax
push eax
push esi
push 0x450bd3
push eax
push eax
call fcn.00467193
add esp, 0x18
mov dword [ebp - 0x18], eax
test eax, eax
je 0x44f235
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 5
call fcn.0044fdc3
cmp dword [ebp - 0x14], 0
je 0x44f245
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.00457bde
pop ecx
pop ecx
test eax, eax
jne 0x44f245
xorps xmm0, xmm0
lea ecx, [ebp - 0x24]
movlpd qword [ebp - 0x18], xmm0
call fcn.0044fdc3
mov eax, ebx
call fcn.00459f10
ret
and dword [ebp - 0x14], 0
push 6
jmp 0x44f247
push 4
pop ecx
call fcn.00433b8a
push 1
call fcn.00457a25
int3
Function at 0x44f9fd
Capabilities:
Create process on windows

Disassembly:
push 0x8c
mov eax, 0x4885d1
call fcn.00459f52
mov eax, dword [0x4c711c]
lea ecx, [ebp - 0x80]
add eax, 0xa8
push eax
call fcn.004103c9
and dword [ebp - 4], 0
lea edi, [ebp - 0x80]
cmp dword [ebp - 0x6c], 0xf
mov ebx, 0x4c75e0
mov eax, dword [0x4c7448]
cmova edi, dword [ebp - 0x80]
cmp dword [0x4c75f4], 0xf
mov eax, dword [eax*4 + 0x4affb0]
cmova ebx, dword [0x4c75e0]
mov dword [ebp - 0x68], eax
call fcn.0044fb3c
mov esi, eax
cmp byte [esi + 0x1a], 0
je 0x44fa79
push 0x27ada77d
push 0xef277b71
push 0
push 0x1a
mov ecx, esi
call fcn.004108ef
add esp, 0x10
mov byte [esi + 0x1a], 0
push edi
push dword [ebp - 0x68]
push ebx
push esi
push 0x3e8
mov esi, 0x4c8088
push esi
call fcn.00452bf0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
add esp, 0x18
call fcn.00410400
push esi
lea ecx, [ebp - 0x98]
call fcn.00410390
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x54]
push ebx
push eax
call fcn.0045b240
add esp, 0xc
mov dword [ebp - 0x54], esi
xor eax, eax
lea edi, [ebp - 0x64]
cmp dword [ebp - 0x84], 0xf
lea ecx, [ebp - 0x64]
stosd dword es:[edi], eax
push ecx
lea ecx, [ebp - 0x54]
push ecx
stosd dword es:[edi], eax
push ebx
push ebx
push ebx
stosd dword es:[edi], eax
push ebx
push ebx
push ebx
stosd dword es:[edi], eax
lea eax, [ebp - 0x98]
cmova eax, dword [ebp - 0x98]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x44fb09
push dword [ebp - 0x64]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x60]
call esi
mov bl, 1
lea ecx, [ebp - 0x98]
call fcn.00410400
test bl, bl
jne 0x44fb2f
push str.No_se_pudo_iniciar_zerohook.
call fcn.0044e772
pop ecx
mov dword [0x4c7124], 2
jmp 0x44fb36
mov byte [0x4c7119], 0
call fcn.00459f10
ret
Function at 0x44fc8f
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4c3140]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0xc]
push edi
push eax
call esi
lea eax, [ebp - 0xc]
push eax
push dword [0x4c7f28]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ebx, dword [ebp - 0xc]
lea eax, [ebp - 0xc]
mov edi, dword [ebp - 8]
push eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], edi
call esi
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [0x4c68c0]
add eax, 0xffffffe2
movd xmm0, eax
cvttss2si eax, dword [0x4c74b4]
cvtdq2ps xmm0, xmm0
cvttss2si ecx, xmm0
test ebx, ebx
js 0x44fd0f
cmp ebx, ecx
jg 0x44fd0f
test edi, edi
js 0x44fd0f
cmp edi, eax
jg 0x44fd0f
mov byte [ebp - 8], 1
xor ebx, ebx
jmp 0x44fd14
xor ebx, ebx
mov byte [ebp - 8], bl
mov eax, dword fs:[0x2c]
mov esi, dword [eax]
mov eax, dword [0x4c9c30]
cmp eax, dword [esi + 0xc]
jle 0x44fd51
mov edi, 0x4c9c30
push edi
call fcn.00458f06
cmp dword [0x4c9c30], 0xffffffff
pop ecx
jne 0x44fd51
push edi
mov dword [0x4c9824], ebx
mov dword [0x4c9820], ebx
call fcn.00458eb5
pop ecx
mov eax, dword [0x4c9c1c]
cmp eax, dword [esi + 0xc]
jle 0x44fd86
mov esi, 0x4c9c1c
push esi
call fcn.00458f06
cmp dword [0x4c9c1c], 0xffffffff
pop ecx
jne 0x44fd86
push esi
mov dword [0x4c9c24], ebx
mov dword [0x4c9c20], ebx
call fcn.00458eb5
pop ecx
sub esp, 0xc
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x1c]
push dword [ebp - 8]
call fcn.0042a7f1
add esp, 0x10
test al, al
je 0x44fdb4
mov eax, dword [0x4c9c20]
mov ecx, dword [0x4c9c24]
mov dword [0x4c67d0], eax
mov dword [0x4c67d4], ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00458d97
leave
ret
Function at 0x452bf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x74
push ebx
push ebp
push esi
mov esi, dword [esp + 0x8c]
push edi
mov edi, dword [esp + 0x8c]
cmp edi, 1
jle 0x452d13
mov ebx, dword [esp + 0x88]
xorps xmm0, xmm0
mov dword [esp + 0x58], 0
lea eax, [esp + 0x74]
mov dword [esp + 0x54], eax
movlpd qword [esp + 0x5c], xmm0
movlpd qword [esp + 0x64], xmm0
movlpd qword [esp + 0x6c], xmm0
mov dword [esp + 0x4c], 0x48e9bc
mov dword [esp + 0x50], 0x48e9c4
mov dword [esp + 0x74], 0x48e980
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], edi
mov dword [esp + 0x1c], 0x496d99
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x14], 0x496d99
mov dword [esp + 0x18], 0
test esi, esi
je 0x452ca5
mov ecx, SysReAllocString
mov eax, esi
nop dword [eax]
cmp byte [eax], 0
je 0x452c9b
dec ecx
inc eax
test ecx, ecx
jg 0x452c90
sub eax, esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x98]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x58]
push eax
call fcn.004536d0
add esp, 0x10
mov ebp, eax
cmp dword [esp + 0x24], 0
jne 0x452d0e
mov ecx, dword [esp + 0x4c]
lea eax, [esp + 0x1c]
push eax
push 1
lea eax, [esp + 0x1b]
mov byte [esp + 0x1b], 0
mov edx, dword [ecx + 4]
lea ecx, [esp + 0x54]
push eax
cmp edx, fcn.00453450
jne 0x452d01
call fcn.00453450
pop edi
dec eax
pop esi
add eax, ebp
pop ebp
pop ebx
add esp, 0x74
ret
call edx
pop edi
dec eax
pop esi
add eax, ebp
pop ebp
pop ebx
add esp, 0x74
ret
mov byte [ebx + edi - 1], 0
mov dword [esp + 0x28], 0x496d99
xorps xmm0, xmm0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0x48e98c
mov dword [esp + 0x38], 0x48e994
movlpd qword [esp + 0x3c], xmm0
movlpd qword [esp + 0x44], xmm0
mov dword [esp + 0x14], 0x496d99
mov dword [esp + 0x18], 0
test esi, esi
je 0x452d7a
mov ecx, SysReAllocString
mov eax, esi
cmp byte [eax], 0
je 0x452d70
dec ecx
inc eax
test ecx, ecx
jg 0x452d65
sub eax, esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x98]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.004536d0
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x74
ret
Function at 0x454930
Capabilities:
Get common file path

Disassembly:
sub esp, 0x414
mov eax, dword [esp + 0x418]
push esi
mov esi, 0x400
mov dword [esp + 4], esi
push edi
mov edi, ecx
sub eax, 0
je 0x4549e8
sub eax, 1
je 0x4549d6
sub eax, 1
je 0x454964
xor esi, esi
jmp 0x454a12
push SysReAllocString
push str.USERPROFILE
call fcn.00452ec0
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
push 1
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], str.USERPROFILE
push eax
lea eax, [esp + 0x30]
push eax
call fcn.00454a90
add esp, 0x18
test al, al
jne 0x4549d0
push SysReAllocString
push str.HOME
call fcn.00452ec0
mov dword [esp + 0x20], eax
lea eax, [esp + 0x1c]
push 1
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x24], str.HOME
push eax
lea eax, [esp + 0x30]
push eax
call fcn.00454a90
add esp, 0x18
mov esi, dword [esp + 8]
jmp 0x454a12
lea eax, [esp + 0x1c]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x454a10
lea eax, [esp + 0x1c]
push 0x400
push eax
call fcn.0046944a
add esp, 8
test eax, eax
je 0x454a12
lea eax, [esp + 0x1c]
push SysReAllocString
push eax
call fcn.00452ec0
add esp, 8
mov esi, eax
cmp esi, 0x7fffffff
jne 0x454a2a
lea eax, [esp + 0x1c]
push esi
push eax
call fcn.00452ec0
add esp, 8
mov esi, eax
push esi
lea eax, [esp + 0x20]
push eax
push 0x400
push edi
call fcn.00454cc0
add esp, 0x10
mov eax, edi
pop edi
pop esi
add esp, 0x414
ret 4

Function at 0x455240
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov eax, dword [0x4c46d0]
sub esp, 0x10
or eax, dword [0x4c46d4]
jne 0x45526c
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov dword [0x4c46d0], eax
mov dword [0x4c46d4], ecx
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov ecx, dword [esp]
sub ecx, dword [0x4c46d0]
mov edx, dword [esp + 4]
sbb edx, dword [0x4c46d4]
call fcn.00459a30
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
movsd qword [esp], xmm0
call fcn.00459a30
movsd xmm1, qword [esp]
divsd xmm1, xmm0
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
movsd qword [ecx], xmm1
subsd xmm1, qword [0x4c46c8]
cvtpd2ps xmm0, xmm1
movss dword [eax], xmm0
movsd xmm0, qword [ecx]
movsd qword [0x4c46c8], xmm0
add esp, 0x10
ret

Function at 0x4560e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [esi + 4]
inc edi
mov eax, edi
call fcn.00459890
mov ebx, esp
push SysReAllocString
push esi
push edi
push ebx
call fcn.00452e70
mov esi, dword [ebp + 0xc]
add esp, 0x10
push dword [esi]
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x45612b
cmp eax, dword [esi]
jae 0x45612b
mov cl, 1
mov dword [esi], eax
mov al, cl
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
xor cl, cl
mov dword [esi], eax
mov al, cl
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x458857
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x458878
jl 0x45886f
test edi, edi
jne 0x458878
xor eax, eax
xor edx, edx
jmp 0x458939
cmp dword [ebx + 0x38], 0
je 0x45888d
push eax
push edi
push dword [ebp + 8]
call fcn.004317c9
jmp 0x458939
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x4588d4
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x4588d4
cmp eax, edi
jb 0x4588ae
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.0045b3a0
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x4588da
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x45892e
mov ecx, ebx
call fcn.004581a4
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x458919
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.00461a6e
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x45892e
jmp 0x4588ec
test edx, edx
je 0x45892e
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.00461a6e
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc
Function at 0x45893f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x458961
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004316eb
jmp 0x458a1f
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
test ecx, ecx
je 0x458987
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x45898c
xor ecx, ecx
mov dword [ebp - 0xc], eax
mov eax, ecx
cdq
mov dword [ebp - 4], eax
mov ecx, edx
mov dword [ebp - 8], ecx
test edi, edi
jl 0x4589ec
jg 0x4589a1
test esi, esi
je 0x4589ec
test ecx, ecx
jl 0x4589e7
jg 0x4589ab
test eax, eax
je 0x4589e7
cmp edi, ecx
jg 0x4589bd
jl 0x4589b5
cmp esi, eax
jae 0x4589bd
mov eax, esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], edi
push eax
push dword [ebp + 8]
push dword [ebp - 0x10]
call fcn.0045b3a0
mov eax, dword [ebp - 0xc]
add esp, 0xc
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [ebp - 8]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x4589ef
mov ecx, dword [ebp + 8]
jmp 0x4589f9
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x458a13
jg 0x4589f9
test esi, esi
je 0x458a13
cmp dword [ebx + 0x4c], 0
je 0x458a13
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.0046006c
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x45a28b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x45a2ca
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x45a2ca
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x45a2ca
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x45a2ca
cmp dword [ecx + 0x74], 0xe
jbe 0x45a2ca
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4718b3
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00471732

Function at 0x47544b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047510b

Function at 0x47c490
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x47c4bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x47c4bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret