joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43406d
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4c9180]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [ebp + 8]
mov esi, edx
mov dword [ebp - 0x14], 0x67452301
mov edx, ecx
mov dword [ebp - 0x10], 0xefcdab89
lea ecx, [ebp - 0x14]
mov dword [ebp - 0xc], 0x98badcfe
mov dword [ebp - 8], 0x10325476
call fcn.00433548
pop ecx
mov ecx, dword [ebp - 0x14]
mov eax, ecx
shr eax, 8
mov byte [esi + 1], al
mov eax, ecx
shr eax, 0x10
mov byte [esi], cl
mov byte [esi + 2], al
shr ecx, 0x18
mov byte [esi + 3], cl
mov ecx, dword [ebp - 0x10]
mov eax, ecx
shr eax, 8
mov byte [esi + 5], al
mov eax, ecx
shr eax, 0x10
mov byte [esi + 4], cl
shr ecx, 0x18
mov byte [esi + 6], al
mov byte [esi + 7], cl
mov ecx, dword [ebp - 0xc]
mov eax, ecx
shr eax, 8
mov byte [esi + 9], al
mov eax, ecx
mov byte [esi + 8], cl
shr eax, 0x10
shr ecx, 0x18
mov byte [esi + 0xa], al
mov byte [esi + 0xb], cl
mov ecx, dword [ebp - 8]
mov eax, ecx
shr eax, 8
mov byte [esi + 0xd], al
mov eax, ecx
mov byte [esi + 0xc], cl
shr ecx, 0x18
mov byte [esi + 0xf], cl
mov ecx, dword [ebp - 4]
shr eax, 0x10
xor ecx, ebp
mov byte [esi + 0xe], al
mov al, 1
pop esi
call fcn.0045c1f5
leave
ret

Function at 0x4426a4
Capabilities:
Create thread

Disassembly:
push 0x10
mov eax, 0x487714
call fcn.0045d3b2
mov ebx, ecx
mov esi, dword [ebp + 8]
push 0xb8
call fcn.0045c203
mov edi, eax
pop ecx
mov dword [ebp - 0x18], edi
and dword [ebp - 4], 0
mov ecx, edi
push esi
call fcn.00445c9a
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
call fcn.00444647
and dword [ebp - 0x18], 0
mov dword [ebp - 0x14], edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 1
call fcn.00444647
xor eax, eax
lea esi, [ebx + 4]
push esi
push eax
push edi
push 0x444943
push eax
push eax
call fcn.0046a5f3
add esp, 0x18
mov dword [ebx], eax
test eax, eax
je 0x442718
call fcn.0045d370
ret 4
and dword [esi], 0
push 6
call fcn.0045ae85
int3

Function at 0x442723
Capabilities:
Create thread

Disassembly:
push 0x10
mov eax, 0x487758
call fcn.0045d3b2
mov ebx, ecx
mov esi, dword [ebp + 8]
push 0xb8
call fcn.0045c203
mov edi, eax
pop ecx
mov dword [ebp - 0x18], edi
and dword [ebp - 4], 0
mov ecx, edi
push esi
call fcn.00445d72
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
call fcn.0044462a
and dword [ebp - 0x18], 0
mov dword [ebp - 0x14], edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 1
call fcn.0044462a
xor eax, eax
lea esi, [ebx + 4]
push esi
push eax
push edi
push 0x4449a3
push eax
push eax
call fcn.0046a5f3
add esp, 0x18
mov dword [ebx], eax
test eax, eax
je 0x442797
call fcn.0045d370
ret 4
and dword [esi], 0
push 6
call fcn.0045ae85
int3
Function at 0x4427a2
Capabilities:
Create thread

Disassembly:
push 0xc
mov eax, 0x48779c
call fcn.0045d3b2
mov ebx, ecx
mov esi, dword [ebp + 8]
push 0xd8
call fcn.0045c203
mov edi, eax
pop ecx
mov dword [ebp - 0x18], edi
and dword [ebp - 4], 0
mov ecx, edi
push esi
call fcn.00445e2c
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
call fcn.0044460d
and dword [ebp - 0x18], 0
mov dword [ebp - 0x14], edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 1
call fcn.0044460d
xor eax, eax
lea esi, [ebx + 4]
push esi
push eax
push edi
push 0x444a03
push eax
push eax
call fcn.0046a5f3
add esp, 0x18
mov dword [ebx], eax
test eax, eax
je 0x442816
call fcn.0045d370
ret 4
and dword [esi], 0
push 6
call fcn.0045ae85
int3

Function at 0x442821
Capabilities:
Create thread

Disassembly:
push 0xc
mov eax, 0x4877e0
call fcn.0045d3b2
mov ebx, ecx
mov esi, dword [ebp + 8]
push 0xc0
call fcn.0045c203
mov edi, eax
pop ecx
mov dword [ebp - 0x18], edi
and dword [ebp - 4], 0
mov ecx, edi
push esi
call fcn.00445f45
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
call fcn.004445f0
and dword [ebp - 0x18], 0
mov dword [ebp - 0x14], edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 1
call fcn.004445f0
xor eax, eax
lea esi, [ebx + 4]
push esi
push eax
push edi
push 0x444a62
push eax
push eax
call fcn.0046a5f3
add esp, 0x18
mov dword [ebx], eax
test eax, eax
je 0x442895
call fcn.0045d370
ret 4
and dword [esi], 0
push 6
call fcn.0045ae85
int3

Function at 0x4428a0
Capabilities:
Create thread

Disassembly:
push 0xc
mov eax, 0x487824
call fcn.0045d3b2
mov ebx, ecx
mov esi, dword [ebp + 8]
push 0xa8
call fcn.0045c203
mov edi, eax
pop ecx
mov dword [ebp - 0x18], edi
and dword [ebp - 4], 0
mov ecx, edi
push esi
call fcn.0044601d
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
call fcn.004445d3
and dword [ebp - 0x18], 0
mov dword [ebp - 0x14], edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 1
call fcn.004445d3
xor eax, eax
lea esi, [ebx + 4]
push esi
push eax
push edi
push 0x444ac1
push eax
push eax
call fcn.0046a5f3
add esp, 0x18
mov dword [ebx], eax
test eax, eax
je 0x442914
call fcn.0045d370
ret 4
and dword [esi], 0
push 6
call fcn.0045ae85
int3
Function at 0x448410
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4c9180]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x30
pop esi
push esi
xor edi, edi
mov ebx, 0x4cb6a8
push edi
push ebx
call fcn.004585c0
add esp, 0xc
mov dword [0x4cb6b4], edi
mov dword [0x4cb6a8], esi
mov dword [0x4cb6b8], edi
push edi
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov edi, 0x7f00
mov dword [0x4cb6c8], eax
push edi
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov esi, dword [sym.imp.USER32.dll_LoadIconA]
push edi
push 0
mov dword [0x4cb6c4], eax
call esi
push edi
xor edi, edi
mov dword [0x4cb6c0], eax
push edi
call esi
push edi
mov dword [0x4cb6d4], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, str.Intermediate_D3D_Window
mov dword [0x4cb6bc], eax
push ebx
mov dword [0x4cb6b0], 0x44836e
mov dword [0x4cb6d0], esi
mov dword [0x4cb6cc], 0x49bed9
mov dword [0x4cb6ac], 3
call dword [sym.imp.USER32.dll_RegisterClassExA]
test ax, ax
je 0x44851f
push edi
push edi
push edi
push edi
push 0x64
push 0x64
push edi
push edi
push SysReAllocString
push 0x49bed9
push esi
push 0x80088
call dword [sym.imp.USER32.dll_CreateWindowExA]
push 5
push eax
mov dword [0x4cb71c], eax
call dword [sym.imp.USER32.dll_ShowWindow]
movaps xmm0, xmmword [0x4b6270]
lea eax, [ebp - 0x14]
push eax
push dword [0x4cb71c]
movups xmmword [ebp - 0x14], xmm0
call dword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045c1f5
leave
ret
push 0xde
call fcn.0046b631
int3
Function at 0x451aa1
Capabilities:
Hide graphical window

Disassembly:
push 0xc
mov eax, 0x48c627
call fcn.0045d37f
mov edi, ecx
mov edx, str.fb9bc14___
mov ecx, 0x4caa20
call fcn.00453b78
push eax
call fcn.00453cd8
pop ecx
push 2
pop ebx
mov word [0x4cd738], 0x101
mov byte [0x4cd73a], 0
mov dword [0x4cd744], ebx
mov eax, dword [edi + 0xc]
push 0xd8
mov dword [0x4cd740], eax
call fcn.0045c203
mov esi, eax
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
sub esp, 0x14
mov ecx, esp
push 0x4cdd94
call fcn.00413289
mov ecx, esi
call fcn.004517a5
or dword [ebp - 4], 0xffffffff
lea ecx, [edi + 0x10]
push ecx
mov dword [0x4cd73c], eax
lea ecx, [eax + 0xc0]
call fcn.00439a40
push str.zerohook
push 0x4b3bc8
push 0x65
push 0x4cda6c
call fcn.00456060
push 0x4cda58
mov edx, 0x4cd8b8
mov ecx, 0x4cd758
call fcn.0044898b
mov eax, dword [0x4cd8b0]
add esp, 0x14
mov ecx, ebx
mov dword [0x4cdad8], 0x3fc00000
mov dword [0x4ccc58], 0x1c2
mov dword [0x4ccc5c], 0xe4
cmp byte [eax + 0x4b5e68], 0
push ebx
cmovne ecx, eax
mov dword [0x4cb6a4], 0x3f800000
mov eax, dword [0x4cb690]
mov dword [0x4cda68], ecx
push 0xff
mov dword [eax + 0x9c], 0x3fc00000
xor eax, eax
push eax
push dword [0x4cb71c]
mov dword [0x4ccc00], eax
mov dword [0x4ccc04], eax
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push dword [0x4cb71c]
call esi
mov ecx, dword [0x4cb6dc]
test ecx, ecx
je 0x451be0
push 5
push ecx
call esi
mov al, 1
call fcn.0045d35c
ret
Function at 0x4525a4
Capabilities:
Create thread

Disassembly:
push 0x34
mov eax, 0x48c94f
call fcn.0045d3b2
mov ebx, ecx
mov dword [ebp - 0x2c], ebx
and dword [ebp - 4], 0
lea edi, [ebp - 0x24]
mov dword [ebp - 0x40], ebx
xor eax, eax
and dword [ebp - 0x30], 0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0x94
push edi
call fcn.0045c203
push edi
mov esi, eax
push 0
push esi
mov dword [ebp - 0x2c], esi
call fcn.0045e6a0
add esp, 0xc
mov ecx, esi
call fcn.00453959
xor edx, edx
mov edi, eax
mov dword [ebp - 0x24], edi
mov byte [ebp - 0x20], dl
mov byte [ebp - 0x1c], dl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x24]
mov dword [ebx], edx
mov dword [ebx + 4], edx
call fcn.00453b5d
test al, al
je 0x4526dc
mov byte [ebp - 0x1c], 1
mov dword [ebx], edi
mov byte [ebx + 4], 1
test edi, edi
je 0x452626
lock inc dword [edi + 4]
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x3c], edi
mov byte [ebp - 0x38], dl
mov byte [ebp - 0x34], 1
push 0xc
mov byte [ebp - 4], 2
call fcn.0045c203
mov esi, eax
mov dword [ebp - 0x30], 7
xor eax, eax
pop ecx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov dword [esi], edi
mov byte [esi + 4], al
mov byte [esi + 8], 1
mov dword [ebp - 0x2c], eax
call fcn.00453e38
and dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], esi
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.00453e38
lea eax, [ebp - 0x14]
push eax
xor eax, eax
push eax
push esi
push 0x45404c
push eax
push eax
call fcn.0046a5f3
add esp, 0x18
mov dword [ebp - 0x18], eax
test eax, eax
je 0x4526d4
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 5
call fcn.00453262
cmp dword [ebp - 0x14], 0
je 0x4526e4
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.0045b03e
pop ecx
pop ecx
test eax, eax
jne 0x4526e4
xorps xmm0, xmm0
lea ecx, [ebp - 0x24]
movlpd qword [ebp - 0x18], xmm0
call fcn.00453262
mov eax, ebx
call fcn.0045d370
ret
and dword [ebp - 0x14], 0
push 6
jmp 0x4526e6
push 4
pop ecx
call fcn.00436b92
push 1
call fcn.0045ae85
int3
Function at 0x452e9c
Capabilities:
Create process on windows

Disassembly:
push 0x8c
mov eax, 0x48cacd
call fcn.0045d3b2
mov eax, dword [0x4cd73c]
lea ecx, [ebp - 0x80]
add eax, 0xa8
push eax
call fcn.00413289
and dword [ebp - 4], 0
lea edi, [ebp - 0x80]
cmp dword [ebp - 0x6c], 0xf
mov ebx, 0x4cdc00
mov eax, dword [0x4cda68]
cmova edi, dword [ebp - 0x80]
cmp dword [0x4cdc14], 0xf
mov eax, dword [eax*4 + 0x4b50f0]
cmova ebx, dword [0x4cdc00]
mov dword [ebp - 0x68], eax
call fcn.00452fdb
mov esi, eax
cmp byte [esi + 0x1a], 0
je 0x452f18
push 0x27ada77d
push 0xef277b71
push 0
push 0x1a
mov ecx, esi
call fcn.004137af
add esp, 0x10
mov byte [esi + 0x1a], 0
push edi
push dword [ebp - 0x68]
push ebx
push esi
push 0x3e8
mov esi, 0x4ce858
push esi
call fcn.00456060
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
add esp, 0x18
call fcn.004132c0
push esi
lea ecx, [ebp - 0x98]
call fcn.00413250
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x54]
push ebx
push eax
call fcn.0045e6a0
add esp, 0xc
mov dword [ebp - 0x54], esi
xor eax, eax
lea edi, [ebp - 0x64]
cmp dword [ebp - 0x84], 0xf
lea ecx, [ebp - 0x64]
stosd dword es:[edi], eax
push ecx
lea ecx, [ebp - 0x54]
push ecx
stosd dword es:[edi], eax
push ebx
push ebx
push ebx
stosd dword es:[edi], eax
push ebx
push ebx
push ebx
stosd dword es:[edi], eax
lea eax, [ebp - 0x98]
cmova eax, dword [ebp - 0x98]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x452fa8
push dword [ebp - 0x64]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x60]
call esi
mov bl, 1
lea ecx, [ebp - 0x98]
call fcn.004132c0
test bl, bl
jne 0x452fce
push str.No_se_pudo_iniciar_zerohook.
call fcn.00451c11
pop ecx
mov dword [0x4cd744], 2
jmp 0x452fd5
mov byte [0x4cd739], 0
call fcn.0045d370
ret
Function at 0x45312e
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4c9180]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0xc]
push edi
push eax
call esi
lea eax, [ebp - 0xc]
push eax
push dword [0x4ce6f8]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ebx, dword [ebp - 0xc]
lea eax, [ebp - 0xc]
mov edi, dword [ebp - 8]
push eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], edi
call esi
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [0x4ccd30]
add eax, 0xffffffe2
movd xmm0, eax
cvttss2si eax, dword [0x4cdad4]
cvtdq2ps xmm0, xmm0
cvttss2si ecx, xmm0
test ebx, ebx
js 0x4531ae
cmp ebx, ecx
jg 0x4531ae
test edi, edi
js 0x4531ae
cmp edi, eax
jg 0x4531ae
mov byte [ebp - 8], 1
xor ebx, ebx
jmp 0x4531b3
xor ebx, ebx
mov byte [ebp - 8], bl
mov eax, dword fs:[0x2c]
mov esi, dword [eax]
mov eax, dword [0x4d0400]
cmp eax, dword [esi + 0xc]
jle 0x4531f0
mov edi, 0x4d0400
push edi
call fcn.0045c364
cmp dword [0x4d0400], 0xffffffff
pop ecx
jne 0x4531f0
push edi
mov dword [0x4cfff4], ebx
mov dword [0x4cfff0], ebx
call fcn.0045c313
pop ecx
mov eax, dword [0x4d03ec]
cmp eax, dword [esi + 0xc]
jle 0x453225
mov esi, 0x4d03ec
push esi
call fcn.0045c364
cmp dword [0x4d03ec], 0xffffffff
pop ecx
jne 0x453225
push esi
mov dword [0x4d03f4], ebx
mov dword [0x4d03f0], ebx
call fcn.0045c313
pop ecx
sub esp, 0xc
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0x1c]
push dword [ebp - 8]
call fcn.0042d777
add esp, 0x10
test al, al
je 0x453253
mov eax, dword [0x4d03f0]
mov ecx, dword [0x4d03f4]
mov dword [0x4ccc00], eax
mov dword [0x4ccc04], ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045c1f5
leave
ret
Function at 0x456060
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x74
push ebx
push ebp
push esi
mov esi, dword [esp + 0x8c]
push edi
mov edi, dword [esp + 0x8c]
cmp edi, 1
jle 0x456183
mov ebx, dword [esp + 0x88]
xorps xmm0, xmm0
mov dword [esp + 0x58], 0
lea eax, [esp + 0x74]
mov dword [esp + 0x54], eax
movlpd qword [esp + 0x5c], xmm0
movlpd qword [esp + 0x64], xmm0
movlpd qword [esp + 0x6c], xmm0
mov dword [esp + 0x4c], 0x493afc
mov dword [esp + 0x50], 0x493b04
mov dword [esp + 0x74], 0x493ac0
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], edi
mov dword [esp + 0x1c], 0x49bed9
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x14], 0x49bed9
mov dword [esp + 0x18], 0
test esi, esi
je 0x456115
mov ecx, SysReAllocString
mov eax, esi
nop dword [eax]
cmp byte [eax], 0
je 0x45610b
dec ecx
inc eax
test ecx, ecx
jg 0x456100
sub eax, esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x98]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x58]
push eax
call fcn.00456b40
add esp, 0x10
mov ebp, eax
cmp dword [esp + 0x24], 0
jne 0x45617e
mov ecx, dword [esp + 0x4c]
lea eax, [esp + 0x1c]
push eax
push 1
lea eax, [esp + 0x1b]
mov byte [esp + 0x1b], 0
mov edx, dword [ecx + 4]
lea ecx, [esp + 0x54]
push eax
cmp edx, fcn.004568c0
jne 0x456171
call fcn.004568c0
pop edi
dec eax
pop esi
add eax, ebp
pop ebp
pop ebx
add esp, 0x74
ret
call edx
pop edi
dec eax
pop esi
add eax, ebp
pop ebp
pop ebx
add esp, 0x74
ret
mov byte [ebx + edi - 1], 0
mov dword [esp + 0x28], 0x49bed9
xorps xmm0, xmm0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0x493acc
mov dword [esp + 0x38], 0x493ad4
movlpd qword [esp + 0x3c], xmm0
movlpd qword [esp + 0x44], xmm0
mov dword [esp + 0x14], 0x49bed9
mov dword [esp + 0x18], 0
test esi, esi
je 0x4561ea
mov ecx, SysReAllocString
mov eax, esi
cmp byte [eax], 0
je 0x4561e0
dec ecx
inc eax
test ecx, ecx
jg 0x4561d5
sub eax, esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x98]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.00456b40
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x74
ret
Function at 0x457da0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x414
mov eax, dword [esp + 0x418]
push esi
mov esi, 0x400
mov dword [esp + 4], esi
push edi
mov edi, ecx
sub eax, 0
je 0x457e58
sub eax, 1
je 0x457e46
sub eax, 1
je 0x457dd4
xor esi, esi
jmp 0x457e82
push SysReAllocString
push str.USERPROFILE
call fcn.00456330
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
push 1
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], str.USERPROFILE
push eax
lea eax, [esp + 0x30]
push eax
call fcn.00457f00
add esp, 0x18
test al, al
jne 0x457e40
push SysReAllocString
push str.HOME
call fcn.00456330
mov dword [esp + 0x20], eax
lea eax, [esp + 0x1c]
push 1
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x24], str.HOME
push eax
lea eax, [esp + 0x30]
push eax
call fcn.00457f00
add esp, 0x18
mov esi, dword [esp + 8]
jmp 0x457e82
lea eax, [esp + 0x1c]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x457e80
lea eax, [esp + 0x1c]
push 0x400
push eax
call fcn.0046c8a8
add esp, 8
test eax, eax
je 0x457e82
lea eax, [esp + 0x1c]
push SysReAllocString
push eax
call fcn.00456330
add esp, 8
mov esi, eax
cmp esi, 0x7fffffff
jne 0x457e9a
lea eax, [esp + 0x1c]
push esi
push eax
call fcn.00456330
add esp, 8
mov esi, eax
push esi
lea eax, [esp + 0x20]
push eax
push 0x400
push edi
call fcn.00458120
add esp, 0x10
mov eax, edi
pop edi
pop esi
add esp, 0x414
ret 4

Function at 0x4586a0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov eax, dword [0x4ca710]
sub esp, 0x10
or eax, dword [0x4ca714]
jne 0x4586cc
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov dword [0x4ca710], eax
mov dword [0x4ca714], ecx
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov ecx, dword [esp]
sub ecx, dword [0x4ca710]
mov edx, dword [esp + 4]
sbb edx, dword [0x4ca714]
call fcn.0045ce90
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
movsd qword [esp], xmm0
call fcn.0045ce90
movsd xmm1, qword [esp]
divsd xmm1, xmm0
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
movsd qword [ecx], xmm1
subsd xmm1, qword [0x4ca708]
cvtpd2ps xmm0, xmm1
movss dword [eax], xmm0
movsd xmm0, qword [ecx]
movsd qword [0x4ca708], xmm0
add esp, 0x10
ret

Function at 0x459540
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [esi + 4]
inc edi
mov eax, edi
call fcn.0045ccf0
mov ebx, esp
push SysReAllocString
push esi
push edi
push ebx
call fcn.004562e0
mov esi, dword [ebp + 0xc]
add esp, 0x10
push dword [esi]
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x45958b
cmp eax, dword [esi]
jae 0x45958b
mov cl, 1
mov dword [esi], eax
mov al, cl
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
xor cl, cl
mov dword [esi], eax
mov al, cl
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x45bcb5
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x45bcd6
jl 0x45bccd
test edi, edi
jne 0x45bcd6
xor eax, eax
xor edx, edx
jmp 0x45bd97
cmp dword [ebx + 0x38], 0
je 0x45bceb
push eax
push edi
push dword [ebp + 8]
call fcn.004347d1
jmp 0x45bd97
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x45bd32
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x45bd32
cmp eax, edi
jb 0x45bd0c
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.0045e800
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x45bd38
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x45bd8c
mov ecx, ebx
call fcn.0045b602
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x45bd77
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.00464ece
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x45bd8c
jmp 0x45bd4a
test edx, edx
je 0x45bd8c
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.00464ece
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc
Function at 0x45bd9d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x45bdbf
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004346f3
jmp 0x45be7d
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
test ecx, ecx
je 0x45bde5
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x45bdea
xor ecx, ecx
mov dword [ebp - 0xc], eax
mov eax, ecx
cdq
mov dword [ebp - 4], eax
mov ecx, edx
mov dword [ebp - 8], ecx
test edi, edi
jl 0x45be4a
jg 0x45bdff
test esi, esi
je 0x45be4a
test ecx, ecx
jl 0x45be45
jg 0x45be09
test eax, eax
je 0x45be45
cmp edi, ecx
jg 0x45be1b
jl 0x45be13
cmp esi, eax
jae 0x45be1b
mov eax, esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], edi
push eax
push dword [ebp + 8]
push dword [ebp - 0x10]
call fcn.0045e800
mov eax, dword [ebp - 0xc]
add esp, 0xc
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [ebp - 8]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x45be4d
mov ecx, dword [ebp + 8]
jmp 0x45be57
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x45be71
jg 0x45be57
test esi, esi
je 0x45be71
cmp dword [ebx + 0x4c], 0
je 0x45be71
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.004634cc
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x45d6eb
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x45d72a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x45d72a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x45d72a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x45d72a
cmp dword [ecx + 0x74], 0xe
jbe 0x45d72a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x474d11
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00474b90

Function at 0x4788a9
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00478569

Function at 0x47f8f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x47f91d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x47f91d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret