joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427563
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov word [ebp - 4], ax
movsx eax, word [ebp - 4]
push eax
call fcn.004176ce
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x42761d
mov eax, dword [ebp - 0xc]
push eax
call fcn.004177e6
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x427611
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x427605
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
call fcn.00417b38
add esp, 0xc
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 0xc]
push eax
call fcn.00417800
add esp, 4
mov eax, dword [ebp - 0xc]
jmp 0x427624
mov eax, dword [ebp - 0xc]
push eax
call fcn.00417800
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
call fcn.004177b0
add esp, 4
xor eax, eax
jmp 0x427624
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4276f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x45bb8c]
push eax
call fcn.004177e6
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movsx eax, word [eax]
test eax, eax
je 0x42781d
mov eax, dword [ebp - 4]
movsx eax, word [eax]
cmp eax, 2
jne 0x427814
mov eax, dword [ebp - 4]
mov ax, word [eax + 2]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
mov word [ebp - 8], ax
mov word [ebp - 0xc], 0
movsx eax, word [ebp - 8]
cmp eax, 0xffffffff
je 0x42780b
xor eax, eax
mov al, byte [ebp - 7]
mov dword [ebp - 0x10], eax
jmp 0x42778a
mov word [ebp - 0xc], 2
jmp case.0x42779a.2
mov word [ebp - 0xc], 1
jmp case.0x42779a.2
mov word [ebp - 0xc], 9
jmp case.0x42779a.2
mov word [ebp - 0xc], 0xb
jmp case.0x42779a.2
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 6
ja case.0x42779a.2
mov eax, dword [ebp - 0x10]
jmp dword [eax*4 + 0x4277a1]
movsx eax, word [ebp - 0xc]
test al, 1
je 0x4277e6
mov eax, dword [ebp - 4]
movsx eax, word [eax + 4]
test al, 1
je 0x4277e6
mov eax, dword [ebp - 4]
mov word [eax + 2], 0
jmp 0x427806
movzx ax, byte [ebp - 8]
mov ecx, dword [ebp - 4]
mov word [ecx + 2], ax
mov eax, dword [ebp - 4]
movsx eax, word [eax + 4]
movsx ecx, word [ebp - 0xc]
or eax, ecx
mov ecx, dword [ebp - 4]
mov word [ecx + 4], ax
jmp 0x427814
mov eax, dword [ebp - 4]
mov word [eax + 2], 0
add dword [ebp - 4], 0xc
jmp 0x42770a
mov eax, dword [0x45bb8c]
push eax
call fcn.00417800
add esp, 4
pop edi
pop esi
pop ebx
leave
ret
Function at 0x427e37
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
and eax, 0xffff
cmp eax, 0x30
jl 0x427e90
mov eax, dword [ebp + 0xc]
and eax, 0xffff
cmp eax, 0x39
jg 0x427e90
mov eax, dword [ebp + 0xc]
push eax
call fcn.00428574
add esp, 4
mov word [ebp - 8], ax
call fcn.00425b4b
test eax, eax
je 0x427e8b
call fcn.004265b3
jmp 0x427ff6
movsx eax, word [ebp + 8]
test eax, eax
je 0x427ff6
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanA]
movzx ax, al
mov word [ebp - 0x10], ax
mov eax, dword [0x45bb8c]
push eax
call fcn.004177e6
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movsx eax, word [eax]
test eax, eax
je 0x427f21
mov eax, dword [ebp - 0xc]
movsx eax, word [eax + 6]
movsx ecx, word [ebp + 8]
cmp eax, ecx
jne 0x427f18
mov eax, dword [ebp - 0xc]
movsx eax, word [eax + 2]
movsx ecx, word [ebp - 0x10]
cmp eax, ecx
jne 0x427f18
mov eax, dword [ebp - 0xc]
movsx eax, word [eax + 4]
movsx ecx, word [ebp + 0x10]
cmp eax, ecx
jne 0x427f18
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
jmp 0x427f21
add dword [ebp - 0xc], 0xc
jmp 0x427ec6
mov eax, dword [0x45bb8c]
push eax
call fcn.00417800
add esp, 4
cmp dword [ebp - 0x14], 0
je 0x427ff6
call fcn.00425b4b
test eax, eax
je 0x427ff6
call fcn.004265b3
push 1
call fcn.0041019e
add esp, 4
movsx eax, word [ebp + 8]
mov dword [ebp - 0x18], eax
jmp 0x427fd6
push 0
mov eax, dword [ebp - 0x14]
mov ax, word [eax + 0xa]
push eax
call fcn.0043683c
add esp, 4
push eax
mov eax, dword [ebp - 0x14]
mov ax, word [eax + 0xa]
push eax
call fcn.00431e00
add esp, 0xc
jmp 0x427fef
mov eax, dword [ebp - 0x14]
movsx eax, word [eax + 8]
cmp eax, 0xfd
jne 0x427fb0
mov eax, dword [ebp - 0x14]
mov ax, word [eax + 0xa]
push eax
call fcn.00442a01
add esp, 4
jmp 0x427fcc
push 0
push 2
mov eax, dword [ebp - 0x14]
mov ax, word [eax + 0xa]
push eax
mov eax, dword [ebp - 0x14]
mov ax, word [eax + 8]
push eax
call fcn.00430f70
add esp, 0x10
jmp 0x427fef
cmp dword [ebp - 0x18], 4
je 0x427f61
cmp dword [ebp - 0x18], 5
je 0x427f89
jmp 0x427fef
mov dword [ebp - 4], 1
cmp dword [ebp - 4], 0
jne 0x428005
call fcn.004183e4
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4287df
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
cmp dword [0x45aa24], 0
je 0x428816
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call fcn.004289c7
add esp, 4
jmp 0x42882f
call fcn.00428a76
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call fcn.00428a1e
add esp, 4
jmp 0x42882f
pop edi
pop esi
pop ebx
leave
ret
Function at 0x428a76
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
push edi
lea eax, [ebp - 0x70]
push eax
push str.keyboard_layout
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x428aa2
xor eax, eax
jmp 0x428ae6
mov dword [ebp - 0x6c], 0x64
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x68]
push eax
push 0
push str.Active
mov eax, dword [ebp - 0x70]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x428ad5
xor eax, eax
jmp 0x428ae6
lea eax, [ebp - 0x64]
push eax
call fcn.00429231
add esp, 4
jmp 0x428ae6
pop edi
pop esi
pop ebx
leave
ret
Function at 0x428e7b
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 7
lea eax, [ebp - 8]
push eax
push 0x1004
mov eax, dword [ebp + 8]
and eax, 0xffff
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea eax, [ebp - 8]
push eax
call fcn.0044c730
add esp, 4
jmp 0x428eaf
pop edi
pop esi
pop ebx
leave
ret

Function at 0x428eb4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
cmp dword [0x45aa24], 0
jne 0x428eed
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.00428f24
add esp, 0xc
test eax, eax
je 0x428eed
mov eax, 1
jmp 0x428f1f
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push eax
push 2
mov eax, dword [ebp + 8]
and eax, 0xffff
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x428f18
mov eax, 1
jmp 0x428f1f
xor eax, eax
jmp 0x428f1f
pop edi
pop esi
pop ebx
leave
ret
Function at 0x428f24
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
push esi
push edi
mov dword [ebp - 0x238], 0
lea eax, [ebp - 0x24c]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004292e0
add esp, 8
push 0x104
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x428f6e
xor eax, eax
jmp 0x42914e
mov edx, str.layout.inf
lea edi, [ebp - 0x104]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov eax, dword [edx]
mov dword [edi], eax
mov eax, dword [edx + 4]
mov dword [edi + 4], eax
mov eax, dword [edx + 8]
mov dword [edi + 8], eax
push 0x4556d8
lea eax, [ebp - 0x104]
push eax
call fcn.0044cb10
add esp, 8
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0
jne 0x428fc1
xor eax, eax
jmp 0x42914e
mov dword [ebp - 0x254], 0
mov eax, dword [ebp - 0x258]
push eax
push 0x12c
lea eax, [ebp - 0x230]
push eax
call fcn.0044ca70
add esp, 0xc
test eax, eax
je 0x42901e
push str._OptionsTextENG_
lea eax, [ebp - 0x230]
push eax
call fcn.0044c430
add esp, 8
test eax, eax
je 0x429019
mov dword [ebp - 0x254], 1
jmp 0x42901e
jmp 0x428fcb
cmp dword [ebp - 0x254], 0
jne 0x429030
jmp 0x429134
mov dword [ebp - 0x254], 0
mov eax, dword [ebp - 0x258]
push eax
push 0x12c
lea eax, [ebp - 0x230]
push eax
call fcn.0044ca70
add esp, 0xc
test eax, eax
je 0x42908f
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.0044c430
add esp, 8
test eax, eax
je 0x42908a
mov dword [ebp - 0x254], 1
jmp 0x42908f
jmp 0x42903a
cmp dword [ebp - 0x254], 0
jne 0x4290a1
jmp 0x429134
push 0x22
lea eax, [ebp - 0x230]
push eax
call fcn.0044c170
add esp, 8
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0
jne 0x4290ca
jmp 0x429134
inc dword [ebp - 0x250]
push 0x22
mov eax, dword [ebp - 0x250]
push eax
call fcn.0044c170
add esp, 8
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0
jne 0x4290f9
jmp 0x429134
mov eax, dword [ebp - 0x234]
mov byte [eax], 0
mov edi, dword [ebp - 0x250]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov edx, edi
mov edi, dword [ebp + 0xc]
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x238], 1
mov eax, dword [ebp - 0x258]
push eax
call fcn.0044ca00
add esp, 4
mov eax, dword [ebp - 0x238]
jmp 0x42914e
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42a551
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x1c], 0x10
lea eax, [ebp - 0x20]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftOfficeCommon8.0Command_BarsButtonSize
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x42a590
xor eax, eax
jmp 0x42a5f3
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], 0
jne 0x42a5ec
lea eax, [ebp - 0x10]
push eax
call fcn.0044c730
add esp, 4
cmp eax, 0x18
jl 0x42a5e0
mov eax, 1
jmp 0x42a5e2
xor eax, eax
jmp 0x42a5f3
xor eax, eax
jmp 0x42a5f3
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42ecb2
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.0042ec12
add esp, 4
test eax, eax
je 0x42ee24
mov eax, dword [0x45bd14]
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
jmp 0x42edee
push 3
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x42ed25
mov eax, dword [ebp + 0xc]
add eax, 4
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.0042f097
add esp, 8
mov dword [ebp - 8], 1
jmp case.0x42edfb.2
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax + 4], 0
je 0x42ed7e
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 8], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [ebp - 8], 1
jmp 0x42ed88
mov eax, dword [ebp + 0xc]
mov dword [eax + 8], 0
jmp case.0x42edfb.2
xor eax, eax
mov ax, word [0x45baca]
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax + 4], 0
je 0x42edb6
mov dword [ebp - 8], 1
jmp case.0x42edfb.2
xor eax, eax
mov ax, word [0x45bac8]
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax + 4], 0
je 0x42ede4
mov dword [ebp - 8], 1
jmp case.0x42edfb.2
cmp dword [ebp - 0x10], 4
ja case.0x42edfb.2
mov eax, dword [ebp - 0x10]
jmp dword [eax*4 + 0x42ee02]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, dword [ebp - 8]
jmp 0x42ee2c
pop edi
pop esi
pop ebx
leave
ret
Function at 0x430c00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
push ebx
push esi
push edi
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x20
jae 0x430c43
lea eax, [ebp - 0x100]
push eax
push 0x60
call fcn.00427680
add esp, 8
push 1
lea eax, [ebp - 0x100]
push eax
call fcn.00418544
add esp, 8
pop edi
pop esi
pop ebx
leave
ret

Function at 0x448dd3
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 8]
add eax, 0x54
push eax
call fcn.00446929
add esp, 0x10
mov eax, dword [ebp + 8]
add eax, 0x54
push eax
call fcn.004462e3
add esp, 4
mov dword [ebp - 0x14], eax
mov eax, 0x45bae0
add eax, 0x1c
lea ecx, [ebp - 0x10]
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp - 0xc]
add eax, 4
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx + 0xc]
cmp eax, ecx
jg 0x448e40
mov eax, ecx
mov word [ebp - 0x1a], ax
movsx eax, word [ebp - 0x1a]
movsx ecx, word [ebp - 0x12]
add eax, ecx
mov ecx, dword [ebp - 4]
sub ecx, 4
cmp eax, ecx
jl 0x448e6c
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 4]
movsx ecx, word [ebp - 0x12]
sub eax, ecx
mov word [ebp - 0x1a], ax
mov eax, dword [ebp - 0x10]
add eax, 4
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
cmp eax, ecx
jg 0x448e81
mov eax, ecx
mov word [ebp - 0x1c], ax
mov eax, dword [ebp - 8]
sub eax, 4
movsx ecx, word [ebp - 0x14]
sub eax, ecx
movsx ecx, word [ebp - 0x1c]
cmp eax, ecx
jl 0x448e9f
mov eax, ecx
mov word [ebp - 0x1c], ax
mov eax, dword [ebp + 0xc]
movsx eax, word [eax + 8]
movsx ecx, word [ebp - 0x1c]
cmp eax, ecx
jl 0x448eb8
mov eax, ecx
mov word [ebp - 0x1c], ax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1a]
mov dword [ebp - 0x18], eax
push 0x10
movsx eax, word [ebp - 0x12]
add eax, 3
push eax
movsx eax, word [ebp - 0x14]
add eax, 3
push eax
movsx eax, word [ebp - 0x1a]
push eax
movsx eax, word [ebp - 0x1c]
inc eax
push eax
push 0
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
push 4
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x448f09
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
mov ax, word [0x457e88]
push eax
mov eax, dword [ebp + 8]
add eax, 0x54
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x54]
call dword [eax + 0x40]
add esp, 0xc
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x1a]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00425b4b
test eax, eax
je 0x448f55
mov eax, dword [0x45bd14]
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44b510
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
cmp dword [0x4593bc], 0
je 0x44b52b
jmp 0x44b65a
push 0x8000
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [ebp - 4], eax
push str.imm32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x4593c0], eax
cmp dword [0x4593c0], 0
je 0x44b641
push str.ImmGetContext
mov eax, dword [0x4593c0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4593c4], eax
push str.ImmReleaseContext
mov eax, dword [0x4593c0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4593c8], eax
push str.ImmAssociateContext
mov eax, dword [0x4593c0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4593cc], eax
push str.ImmGetConversionStatus
mov eax, dword [0x4593c0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4593d0], eax
push str.ImmGetOpenStatus
mov eax, dword [0x4593c0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4593d4], eax
push str.ImmSetOpenStatus
mov eax, dword [0x4593c0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4593d8], eax
push str.ImmSetCompositionFontA
mov eax, dword [0x4593c0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4593dc], eax
push str.ImmSetCompositionWindow
mov eax, dword [0x4593c0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4593e0], eax
push str.ImmGetCompositionStringA
mov eax, dword [0x4593c0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4593e4], eax
push str.ImmNotifyIME
mov eax, dword [0x4593c0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4593e8], eax
mov dword [0x4593bc], 1
jmp 0x44b650
call fcn.0044b65f
mov dword [0x4593bc], 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x44c8c0
Capabilities:
Move file

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
mov eax, 0
jne 0x44c8df
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x44c8f2
push eax
call fcn.0044d700
add esp, 4
mov eax, 0xffffffff
ret
xor eax, eax
ret
Function at 0x44cd40
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x453310
push 0x44f060
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x45a0e0], eax
xor eax, eax
mov al, byte [0x45a0e1]
mov dword [0x45a0ec], eax
mov eax, dword [0x45a0e0]
shr dword [0x45a0e0], 0x10
and eax, 0xff
mov dword [0x45a0e8], eax
shl eax, 8
add eax, dword [0x45a0ec]
mov dword [0x45a0e4], eax
call fcn.0044d770
test eax, eax
jne 0x44cdb4
push 0x1c
call fcn.0044cee0
add esp, 4
mov dword [ebp - 4], 0
call fcn.0044ee80
call fcn.0044ee70
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4656c4], eax
call fcn.0044ea20
mov dword [0x4594d0], eax
test eax, eax
je 0x44cde7
cmp dword [0x4656c4], 0
jne 0x44cdf1
push 0xffffffffffffffff
call fcn.0044e630
add esp, 4
call fcn.00412640
call fcn.0044e930
call fcn.0044e600
mov esi, dword [0x4656c4]
mov al, byte [esi]
cmp al, 0x22
je 0x44ce18
cmp al, 0x20
jbe 0x44ce45
inc esi
cmp byte [esi], 0x20
ja 0x44ce10
jmp 0x44ce45
inc esi
cmp byte [esi], 0x22
je 0x44ce44
mov bl, byte [ebp - 0x28]
mov bl, byte [esi]
test bl, bl
je 0x44ce3f
xor eax, eax
mov al, bl
push eax
call fcn.0044e8d0
add esp, 4
test eax, eax
je 0x44ce39
inc esi
inc esi
cmp byte [esi], 0x22
jne 0x44ce21
cmp byte [esi], 0x22
jne 0x44ce45
inc esi
cmp byte [esi], 0
je 0x44ce55
cmp byte [esi], 0x20
ja 0x44ce55
inc esi
cmp byte [esi], 0
jne 0x44ce4a
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x44], 1
mov eax, 0xa
je 0x44ce79
mov eax, dword [ebp - 0x40]
and eax, 0xffff
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.0044e630
jmp 0x44ceba
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44e670
Capabilities:
Terminate process

Disassembly:
cmp dword [0x45a11c], 1
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
jne 0x44e68e
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x45a118], 1
cmp dword [esp + 0x14], 0
mov ebx, dword [esp + 0x18]
mov byte [0x45a114], bl
jne 0x44e6e8
cmp dword [0x4656b8], 0
je 0x44e6d6
mov edi, dword [0x4656b4]
sub edi, 4
cmp edi, dword [0x4656b8]
jb 0x44e6d6
mov eax, dword [edi]
test eax, eax
je 0x44e6cb
call eax
sub edi, 4
cmp edi, dword [0x4656b8]
jae 0x44e6c3
push 0x45401c
push 0x454014
call fcn.0044e720
add esp, 8
push 0x454024
push 0x454020
call fcn.0044e720
add esp, 8
test ebx, ebx
jne 0x44e70f
mov dword [0x45a11c], 1
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebx
ret
Function at 0x44ea20
Capabilities:
Query environment variable

Disassembly:
sub esp, 4
push ebx
push esi
push edi
xor ebx, ebx
push ebp
xor edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
cmp dword [0x45a1b0], ebx
jne 0x44ea6f
call esi
cmp eax, ebx
mov edi, eax
je 0x44ea4d
mov dword [0x45a1b0], 1
jmp 0x44ea6f
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
je 0x44ea65
mov dword [0x45a1b0], 2
jmp 0x44ea6f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x45a1b0], 1
jne 0x44eb1e
test edi, edi
jne 0x44ea92
call esi
mov edi, eax
test edi, edi
jne 0x44ea92
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp word [edi], 0
mov esi, edi
je 0x44eaac
add esi, 2
cmp word [esi], 0
jne 0x44ea9a
add esi, 2
cmp word [esi], 0
jne 0x44ea9a
sub esi, edi
push 0
sar esi, 1
push 0
inc esi
push 0
push 0
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebp, eax
test ebp, ebp
je 0x44eb0d
push ebp
call fcn.0044c950
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x44eb0d
push 0
push 0
push ebp
push ebx
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x44eafc
push ebx
call fcn.0044c900
add esp, 4
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x45a1b0], 2
jne 0x44eba2
test ebx, ebx
jne 0x44eb41
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
jne 0x44eb41
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov ebp, ebx
cmp byte [ebx], 0
je 0x44eb56
inc ebp
cmp byte [ebp], 0
jne 0x44eb48
inc ebp
cmp byte [ebp], 0
jne 0x44eb48
sub ebp, ebx
inc ebp
push ebp
call fcn.0044c950
mov dword [esp + 0x14], eax
add esp, 4
test eax, eax
jne 0x44eb7b
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov edi, dword [esp + 0x10]
mov esi, ebx
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret