joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d880
Capabilities:
Check for time delay via gettickcount
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x734
cmp byte [ebp + 0x1c], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [esp + 0x28], ecx
jne 0x43d8e9
mov ecx, dword [0x4c1688]
push 1
push 0
push 0xffffffffffffffff
push 0x49eb0c
call fcn.004698a0
cmp word [ebx], 0
jne 0x43d8cf
mov eax, dword [0x4bd4c4]
mov dword [eax + 0x30], 0x57
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp dword [ebp + 0x14], 0
jne 0x43d8dc
mov dword [ebp + 0x14], 1
mov ecx, dword [0x4bd4c4]
mov dword [ecx + 0x30], 0
mov eax, ebx
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43d8f0
sub eax, edx
sar eax, 1
cmp eax, 0x104
jb 0x43d91e
mov edx, dword [0x4bd4c4]
mov dword [edx + 0x30], 0x6f
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [ebp + 8]
push 0x3f
push eax
lea ecx, [esp + 0x68]
push ecx
call fcn.00485434
xor edx, edx
mov word [esp + 0xea], dx
lea edx, [esp + 0x544]
add esp, 0xc
mov eax, ebx
sub edx, ebx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x43d946
cmp word [esp + 0x60], cx
je 0x43d9ae
push 0
lea esi, [esp + 0x38]
lea eax, [esp + 0x64]
call fcn.00466a40
add esp, 4
lea eax, [esp + 0x2c]
push eax
mov ecx, esi
push ecx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
je 0x43d994
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
test eax, eax
jne 0x43d9b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [0x4bd4c4]
mov dword [edx + 0x30], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea edx, [esp + 0x330]
mov eax, ebx
sub edx, ebx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x43d9c4
lea ecx, [esp + 0x330]
push 0x5c
push ecx
call fcn.00483835
add al, 0

Function at 0x43d9e0
Capabilities:
Check for time delay via gettickcount
Enumerate files on windows

Disassembly:
add al, 0
add esp, 8
test eax, eax
je 0x43da11
xor edx, edx
mov word [eax + 2], dx
lea eax, [esp + 0x330]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x43da00
sub eax, edx
sar eax, 1
jmp 0x43da1b
xor eax, eax
mov word [esp + 0x330], ax
lea ecx, [esp + eax*2 + 0x330]
mov dword [esp + 0x18], ecx
mov ecx, 0x103
lea edx, [esp + 0x538]
sub ecx, eax
push 0x5c
push edx
mov dword [esp + 0x18], ecx
call fcn.00483835
add esp, 8
test eax, eax
je 0x43da4c
add eax, 2
jmp 0x43da53
lea eax, [esp + 0x538]
mov ebx, 0x4a54c0
mov dword [esp + 0x14], eax
call fcn.00408fc0
test eax, eax
jne 0x43da6c
mov dword [ebp + 0x14], 2
lea eax, [esp + 0xe0]
push eax
lea ecx, [esp + 0x53c]
xor edi, edi
push ecx
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov dword [esp + 0x24], esi
cmp esi, 0xffffffff
je 0x43dc50
jmp 0x43daa6
Function at 0x445258
Capabilities:
Write clipboard data

Disassembly:
je 0x445268
pop esi
pop ebp
pop edi
mov ecx, 0x4c2fe4
pop ebx
jmp fcn.00403d20
and byte [esi + 0x15], 0x86
pop esi
pop ebp
pop edi
pop ebx
ret

Function at 0x4468ca
Capabilities:
Allocate or change rwx memory

Disassembly:
jne 0x446899
cmp dword [esp + 0x10], 0x1f
jg 0x446970
mov edx, dword [edi + 0xc]
xor ecx, ecx
test edx, edx
jle 0x4468c2
mov eax, dword [edi + 8]
add eax, 4
jmp 0x4468b0
cmp word [eax], 0
jne 0x446970
inc ecx
add eax, 0x10
cmp ecx, edx
jl 0x4468b0
push 0x20
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
dec ecx
add byte [ebx + 0xff685f0], cl
invalid
invalid
add byte [eax], al
invalid
mov dword [esi], 0xe8
mov dword [esi + 4], 0x24448d00
mov dword [esi + 8], 0x15ff5008
mov dword [esi + 0xc], 0x4be898
test bl, bl
je 0x4468f9
xor eax, eax
jmp 0x446900
mov eax, dword [esp + 0x10]
shl eax, 0x1a
add eax, 0xc48359
cmp dword [ebp + 0x10], 4
mov edx, 0xe1ff
mov dword [esi + 0x10], eax
mov word [esi + 0x14], dx
jge 0x44691b
mov eax, esi
jmp 0x44692b
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
push 0
call fcn.00448cc0
add esp, 4
mov cl, byte [esp + 0x10]
mov dword [esi + 0x18], eax
mov eax, dword [esp + 0xc]
mov ebx, 0x4a5b10
mov dword [esi + 0x1c], edi
mov byte [esi + 0x16], cl
call fcn.00408fc0
test eax, eax
lea eax, [esp + 0x14]
push eax
push 0x40
push 0x20
sete dl
push esi
mov byte [esi + 0x17], dl
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp + 8]
mov eax, esi
cdq
mov dword [ecx + 8], 1
mov dword [ecx], eax
mov dword [ecx + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x449200
Capabilities:
Log keystrokes via polling

Disassembly:
test bl, bl
jne 0x449207
xor al, al
ret
mov eax, dword [esp + 4]
dec eax
je 0x44922f
dec eax
je 0x449221
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
ret
movzx ecx, bl
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
and eax, 1
ret
lea edx, [ebx - 1]
cmp dl, 5
ja 0x44923c
cmp bl, 3
jne 0x449243
lea eax, [ebx + 0x66]
cmp al, 5
ja 0x449269
cmp dword [0x4c0e50], 0
je 0x449259
movzx ecx, bl
mov al, byte [ecx + 0x4c0d40]
shr al, 7
ret
movzx edx, bl
push edx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
ret
cmp dword [0x4c0e4c], 0
je 0x449298
xor ecx, ecx
xor edx, edx
mov al, bl
call fcn.00411140
test al, al
je 0x44928b
push 1
call fcn.00410f70
add esp, 4
movzx eax, bl
mov al, byte [eax + 0x4c0d40]
shr al, 7
ret
movzx ecx, bl
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
ret
Function at 0x44a897
Capabilities:
Hide graphical window

Disassembly:
jmp 0x44a8ba
push 0x5a
push edi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push edi
mov esi, eax
call dword [sym.imp.GDI32.dll_DeleteDC]
imul esi, ebp
lea eax, [esp + 0x98]
push eax
push 0
push 2
push 0
push 4
push 1
push 0
mov eax, 0xc71c71c7
imul esi
push 0
push 0
push 0x190
sar edx, 4
push 0
mov ecx, edx
push 0
shr ecx, 0x1f
push 0
add ecx, edx
push ecx
call dword [sym.imp.GDI32.dll_CreateFontW]
mov dword [0x4c0d2c], eax
push 1
push eax
push 0x30
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [0x4c0d24]
push 4
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push 0xffffffffffffffff
mov dword [0x4bd3c0], 0
call fcn.00401350
add esp, 8
pop edi
pop esi
pop ebp
mov dword [0x4bd3c0], 1
mov eax, 1
pop ebx
add esp, 0x110
ret 0xc

Function at 0x44be94
Capabilities:
Check for time delay via gettickcount
Delete file
Write file on windows

Disassembly:
cmp dword [esp + 0x10], 0
je fcn.0044bf6e
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x4c38b4]
mov ecx, dword [0x4bd4c4]
cmp eax, dword [ecx + 0xd0]
jbe 0x44bea4
push 0
push 0
push 0
push 0
lea edx, [esp + 0x64]
push edx
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x44be9d
push 1
push 0xffffffffffffffff
call fcn.00401350
add esp, 8
call esi
mov dword [0x4c38b4], eax
mov eax, dword [esp + 0x10]
push edi
push 1
push eax
lea ecx, [esp + 0x7c]
push ecx
call fcn.00484e01
add esp, 0x10
lea edx, [esp + 0x10]
push edx
push 0x400
add byte [eax], al
lea eax, [esp + 0x78]
push eax
push ebx
call dword [esp + 0x38]
mov esi, eax
test esi, esi
jne 0x44be53
jmp fcn.0044bf6e

Function at 0x44bef3
Capabilities:
Delete file
Write file on windows

Disassembly:
inc esp
add byte [edi + esi*2 - 0x75], dh
xor eax, sym.imp.KERNEL32.dll_GetTickCount

Function at 0x44bf19
Capabilities:
Delete file
Write file on windows

Disassembly:
cmp dword [esp + 0x44], 0
je fcn.0044bf6e
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x4c38b4]
mov edx, dword [0x4bd4c4]
cmp eax, dword [edx + 0xd0]
jbe 0x44bf3d
push 0
push 0
push 0
push 0
lea eax, [esp + 0x64]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x44bf36
push 1
push 0xffffffffffffffff
call fcn.00401350
add esp, 8
call esi
mov dword [0x4c38b4], eax
mov ecx, dword [esp + 0x44]
push edi
push 1
push ecx
lea edx, [esp + 0x7c]
jl 0x44bf9c
call fcn.00484e01
add esp, 0x10
push 0
push 8
lea eax, [esp + 0x34]
push eax
push ebx
mov dword [esp + 0x54], 0x400
call dword [esp + 0x20]
mov esi, eax
test esi, esi
jne 0x44bef0
Function at 0x44bf48
Capabilities:
Delete file
Write file on windows

Disassembly:
cmp dword [esp + 0x44], 0
je fcn.0044bf6e
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x4c38b4]
mov edx, dword [0x4bd4c4]
cmp eax, dword [edx + 0xd0]
jbe 0x44bf3d
push 0
push 0
push 0
push 0
lea eax, [esp + 0x64]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x44bf36
push 1
push 0xffffffffffffffff
call fcn.00401350
add esp, 8
call esi
mov dword [0x4c38b4], eax
mov ecx, dword [esp + 0x44]
push edi
push 1
push ecx
lea edx, [esp + 0x7c]
jl 0x44bf9c
call fcn.00484e01
add esp, 0x10
push 0
push 8
lea eax, [esp + 0x34]
push eax
push ebx
mov dword [esp + 0x54], 0x400
call dword [esp + 0x20]
mov esi, eax
test esi, esi
jne 0x44bef0

Function at 0x44bf6e
Capabilities:
Delete file

Disassembly:
push ebx
mov ebx, dword [esp + 0x1c]
call ebx
mov ecx, dword [esp + 0x14]
push ecx
call ebx
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push edi
call fcn.00484ee8
add esp, 4
test esi, esi
je 0x44bfb3
mov ecx, dword [0x4c1688]
push 1
push 0
push 0xffffffffffffffff
push 0x49c138
call fcn.004698a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [0x4c1688]
push 1
push 0
push 0xffffffffffffffff
push 0x49eb0c
call fcn.004698a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x44c450
Capabilities:
Check if file exists
Get file attributes

Disassembly:
add ax, word [eax]
add esp, 8
test eax, eax
jne fcn.0044c489
mov ecx, dword [ebp + 8]
push 0x3f
push ecx
call fcn.00482b51
add esp, 8
test eax, eax
jne fcn.0044c489
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne fcn.0044c4a8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x44c749
Capabilities:
Get keyboard layout

Disassembly:
arpl word [ecx], ax
cld
inc dword [eax + eax*8 + 0x106a1074]
push 0
push ebx
call fcn.004833ab
add esp, 0xc
dec eax
jmp 0x44c76f
mov ecx, dword [esp + 8]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x44]
push esi
push ecx
call eax
mov esi, dword [ebp + 0x18]
cmp word [esi], 0
je 0x44c7bf
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 1
mov ecx, eax
push 0
xor edx, edx
mov eax, esi
call fcn.004116f0
add esp, 8
test al, al
je 0x44c7bf
mov ecx, dword [esp + 8]
mov edx, dword [ecx]
movzx eax, al
mov esi, 0x600
or ax, si
movzx eax, ax
push eax
push ecx
mov ecx, dword [edx + 0x34]
call ecx
mov esi, dword [ebp + 0x1c]
cmp word [esi], 0
je 0x44c7f8
mov eax, esi
call fcn.0040c8b0
test al, al
je 0x44c7e2
push 0x10
push 0
push esi
call fcn.004833ab
add esp, 0xc
jmp 0x44c7eb
push esi
call fcn.00483016
add esp, 4
mov ecx, dword [esp + 8]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x3c]
push ecx
call eax
mov eax, dword [esp + 8]
mov ecx, dword [eax]
lea edx, [esp + 0xc]
push edx
push 0x499700
push eax
mov eax, dword [ecx]
call eax
test eax, eax
js 0x44c849
mov eax, dword [esp + 0xc]
mov edx, dword [ebp + 0xc]
mov ecx, dword [eax]
push 1
push edx
push eax
mov eax, dword [ecx + 0x18]
call eax
test eax, eax
js 0x44c83d
mov ecx, dword [0x4c1688]
push 1
push 0
push 0xffffffffffffffff
push 0x49c138
call fcn.004698a0
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0x18
Function at 0x44d187
Capabilities:
Check for time delay via gettickcount
Copy file
Delete file
Move file

Disassembly:
mov dword [edx], 0
lea edx, [esp + 0xcd8]
push edx
lea eax, [esp + 0xacc]
push eax
lea ecx, [esp + 0x40]
push ecx
call fcn.00485169
lea edx, [esp + 0xce4]
push edx
lea eax, [esp + 0xad8]
push eax
push 0x49ffa0
mov esi, 0x105
lea edi, [esp + 0x6c0]
call fcn.00466f40
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0x104
add esp, 0x20
sub edi, eax
lea ebx, [esp + eax*2 + 0x6a0]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x4c38b4]
mov ecx, dword [0x4bd4c4]
cmp eax, dword [ecx + 0xd0]
jbe 0x44d22e
push 0
push 0
push 0
push 0
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x44d223
push 1
push 0xffffffffffffffff
call fcn.00401350
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4c38b4], eax
test byte [esp + 0x450], 0x10
jne 0x44d346
lea eax, [esp + 0x47c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44d246
sub eax, edx
sar eax, 1
cmp eax, edi
jbe 0x44d26b
mov eax, dword [esp + 0x1314]
mov dword [eax], 0x6f
jmp 0x44d345
lea eax, [esp + 0x47c]
mov edx, ebx
mov ecx, eax
sub edx, ecx
jmp 0x44d280
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x44d280
lea edx, [esp + 0x47c]
push edx
lea ecx, [esp + 0x8b4]
lea edx, [esp + 0x244]
call fcn.0044d380
add esp, 4
cmp byte [esp + 0x1310], 0
je 0x44d313
lea eax, [esp + 0x8b0]
push eax
lea ecx, [esp + 0x6a4]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x44d346
cmp byte [esp + 0x130c], al
je 0x44d306
lea edx, [esp + 0x8b0]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x44d306
lea eax, [esp + 0x8b0]
push eax
lea ecx, [esp + 0x6a4]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x44d346
call ebp
mov edx, dword [esp + 0x1314]
mov dword [edx], eax
jmp 0x44d345
xor eax, eax
cmp byte [esp + 0x130c], al
lea ecx, [esp + 0x8b0]
sete al
lea edx, [esp + 0x6a0]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x44d346
call ebp
mov ecx, dword [esp + 0x1314]
mov dword [ecx], eax
inc esi
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x450]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x44d1e6
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x12f4
ret

Function at 0x44d6c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x44d765
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 2
invalid
je 0x44d750
dec eax
test al, 0x10
je 0x44d772
mov al, 1
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret
Function at 0x44d6e0
Capabilities:
Create directory

Disassembly:
add dh, byte [ebp + ebp*2 + 0x48]
jne 0x44d772
mov eax, edi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44d6f0
sub eax, edx
sar eax, 1
cmp eax, 0x104
ja 0x44d772
lea eax, [eax + eax + 2]
call fcn.00490a60
mov esi, esp
mov edx, esi
mov eax, edi
sub edx, edi
jmp 0x44d720
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x44d720
push 0x5c
push esi
call fcn.00483835
add esp, 8
test eax, eax
je 0x44d772
xor ecx, ecx
push esi
mov word [eax], cx
call fcn.0044d6c0
add esp, 4
test al, al
je 0x44d772
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne al
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret
xor al, al
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret

Function at 0x44d780
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x254
push 0x2a
push esi
call fcn.00482b51
add esp, 8
test eax, eax
jne 0x44d7b8
push 0x3f
push esi
call fcn.00482b51
add esp, 8
test eax, eax
jne 0x44d7b8
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
add esp, 0x254
ret
lea eax, [esp]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x44d7d1
xor al, al
add esp, 0x254
ret
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
add esp, 0x254
ret

Function at 0x44f6a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x498148
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xfa4
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
xor ecx, ecx
push ebx
xor ebx, ebx
cmp byte [eax], 2
mov eax, dword [eax + 8]
setne cl
mov dword [ebp - 0x48], edx
mov edx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x44], 0x4a5c64
dec ecx
and ecx, dword [0x4c0cc0]
add edx, edx
mov edi, dword [eax + edx*8 + 0xc]
lea eax, [eax + edx*8 + 0xc]
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x4c], ebx

Function at 0x4500e0
Capabilities:
Query environment variable

Disassembly:
invalid
loopne 0x45006b
jle 0x4500ec
add byte [ebx - 0x7af0fc06], al
xlatb
stc
invalid
Function at 0x452240
Capabilities:
Query environment variable

Disassembly:
sub esp, 8
push ebx
push ebp
shl eax, 4
add eax, dword [edx + 8]
push esi
push edi
mov edi, dword [esp + 0x1c]
test ecx, ecx
je 0x452269
push edi
call 0x4bb237
lea eax, [edi + eax*2 + 2]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov ebp, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [esp + 0x10], ebp
test eax, eax
je 0x452428
mov ecx, eax
mov dword [esp + 0x14], eax
mov eax, dword [ecx]
test eax, eax
je 0x452428
jmp 0x452290
cmp ebp, eax
jae 0x4522a9
mov dx, word [ebp]
mov word [edi], dx
add ebp, 2
add edi, 2
cmp ebp, eax
jb 0x452294
mov dword [esp + 0x10], ebp
mov esi, dword [ecx + 4]
movzx eax, byte [esi + 0x17]
mov ebx, edi
cmp eax, 3
ja case.default.0x4522bb
jmp dword [eax*4 + 0x452458]
mov eax, esi
call fcn.00452825
cmp dword [0x4c0e70], 0
jne 0x45233d
cmp dword [esi + 0xc], 0
jne 0x45233d
cmp dword [0x4c449c], esi
jne 0x4522e4
test edi, edi
jne 0x45231e
mov ecx, dword [esi + 0x18]
push 0
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x45231a
mov dword [0x4c449c], 0
test edi, edi
je 0x452314
mov ecx, dword [esi + 0x18]
call 0x4b9a5b
jmp 0x452400
dec eax
jmp 0x452400
test edi, edi
je 0x452330
xor edx, edx
mov word [edi], dx
mov dword [0x4c449c], edx
xor eax, eax
jmp 0x452400
mov dword [0x4c449c], esi
xor eax, eax
jmp 0x452400
mov eax, dword [esi + 0xc]
mov ebp, eax
shr ebp, 1
test edi, edi
jne 0x452353
mov eax, ebp
mov ebp, dword [esp + 0x10]
jmp 0x452400
test eax, eax
jne 0x452363
mov ebp, dword [esp + 0x10]
mov word [edi], ax
jmp 0x452400
mov esi, dword [esi + 8]
cmp edi, esi
jne 0x452375
mov eax, ebp
mov ebp, dword [esp + 0x10]
jmp 0x452400
cmp eax, 0x186a0
jae 0x4523a4
mov ecx, esi
movzx eax, word [ecx]
test ax, ax
je 0x452397
add ecx, 2
mov word [ebx], ax
movzx eax, word [ecx]
add ebx, 2
test ax, ax
jne 0x452386
xor ecx, ecx
mov eax, ebp
mov ebp, dword [esp + 0x10]
mov word [ebx], cx
jmp 0x452400
push eax
push esi
push edi
call 0x4d7618
add esp, 0xc
xor edx, edx
mov word [edi + ebp*2], dx
mov eax, ebp
mov ebp, dword [esp + 0x10]
jmp 0x452400
mov ecx, dword [esi + 0xc]
push edi
call 0x4bb3a2
jmp 0x452400
push edi
mov ecx, 0x4c2fe4
call fcn.0045522f
cmp eax, 0xffffffff
jne 0x4523da
xor eax, eax
test edi, edi
je 0x452400
xor ecx, ecx
mov word [edi + eax*2], cx
jmp 0x452400
test edi, edi
je 0x4523ef
xor edx, edx
mov word [edi], dx
xor eax, eax
jmp 0x452400
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x10]
push eax
push edi
call ecx
add esp, 8
mov ecx, dword [esp + 0x14]
movzx edx, word [ecx + 0xa]
lea edi, [edi + eax*2]
lea eax, [ebp + edx*2]
add ecx, 0xc
mov dword [esp + 0x10], eax
mov eax, dword [ecx]
mov ebp, dword [esp + 0x10]
mov dword [esp + 0x14], ecx
test eax, eax
jne 0x452290
movzx ecx, word [ebp]
test cx, cx
je 0x452445
sub ebp, edi
mov word [edi], cx
movzx eax, word [edi + ebp + 2]
add edi, 2
mov ecx, eax
test ax, ax
jne 0x452433
xor ecx, ecx
mov word [edi], cx
lea eax, [edi + 2]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x4547a0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
cmp eax, 0x63
jb 0x4547ac
xor eax, eax
ret
push esi
mov esi, dword [eax*4 + 0x4c1498]
test esi, esi
je 0x45496a
cmp dword [esi], 0
push ebx
push ebp
push edi
je 0x45487a
xor edi, edi
xor ebx, ebx
lea esp, [esp]
mov eax, dword [edi*4 + 0x4c1498]
test eax, eax
je 0x4547f4
mov eax, dword [eax + 0x40]
cmp eax, dword [esi]
jne 0x4547eb
push edi
call 0x4a8384
add esp, 4
inc ebx
cmp dword [0x4c2f4c], ebx
je 0x4547fa
inc edi
cmp edi, 0x63
jb 0x4547d0
mov eax, dword [esi + 4]
test eax, eax
je 0x45483e
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x406
push eax
call ebx
mov ebp, eax
xor edi, edi
test ebp, ebp
jle 0x45483e
jmp 0x454820
mov ecx, dword [esi + 4]
push 0
push edi
push 0x414
push ecx
call ebx
test eax, eax
je 0x454839
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
inc edi
cmp edi, ebp
jl 0x454820
mov edx, dword [esi]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x45487a
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi]
push 0
push ecx
call dword [sym.imp.USER32.dll_SetMenu]
cmp byte [esi + 0xbb], 0
jne 0x45487a
mov edx, dword [esi]
push edx
mov byte [esi + 0xbb], 1
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [esi + 0x60]
mov ebp, dword [sym.imp.GDI32.dll_DeleteObject]
test eax, eax
je 0x45488a
push eax
call ebp
mov eax, dword [esi + 0x68]
test eax, eax
je 0x454894
push eax
call ebp
mov eax, dword [esi + 0x6c]
test eax, eax
je 0x4548a2
push eax
call dword [sym.imp.SHELL32.dll_DragFinish]
xor ebx, ebx
cmp dword [esi + 0xc], ebx
jbe 0x4548f2
xor edi, edi
jmp 0x4548b0
mov eax, dword [esi + 0x14]
mov cl, byte [eax + edi + 4]
add eax, edi
cmp cl, 2
jne 0x4548d8
mov edx, dword [eax + 0x10]
test edx, edx
je 0x4548d8
test byte [eax + 5], 0x80
push edx
je 0x4548d4
call dword [sym.imp.USER32.dll_DestroyIcon]
jmp 0x4548e9
call ebp
jmp 0x4548e9
cmp cl, 0xa
jne 0x4548e9
mov eax, dword [eax + 0x10]
push eax
call 0x4d70a7
add esp, 4
inc ebx
add edi, 0x14
cmp ebx, dword [esi + 0xc]
jb 0x4548b0
mov ecx, dword [esi + 0x14]
mov edi, dword [esi + 0x70]
mov ebx, dword [esi + 0x74]
push ecx
call 0x4d70c2
mov esi, dword [esp + 0x18]
mov edx, dword [esi*4 + 0x4c1498]
push edx
call 0x4d827f
mov dword [esi*4 + 0x4c1498], 0
mov esi, dword [0x4c2f4c]
dec esi
add esp, 8
mov dword [0x4c2f4c], esi
test edi, edi
je 0x454967
cmp edi, dword [0x4c38dc]
je 0x454967
xor edx, edx
mov ecx, 0x4c1498
cmp edx, esi
jge 0x45495b
mov eax, dword [ecx]
test eax, eax
je 0x454950
cmp dword [eax + 0x70], edi
je 0x454967
inc edx
add ecx, 4
cmp ecx, 0x4c1624
jl 0x454940
mov esi, dword [sym.imp.USER32.dll_DestroyIcon]
push edi
call esi
push ebx
call esi
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
ret