joyce8/EMBER2024-capa huggingface dataset:
Function at 0x446f30
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
push esi
mov esi, ecx
mov eax, dword [esi + 8]
push edi
cmp eax, 5
ja case.0x446f49.2
jmp dword [eax*4 + 0x4470b4]
mov ecx, dword [esi + 0x28]
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [esi + 0x58]
mov eax, dword [esp + 0xc]
mov edx, dword [esi + 0x54]
lea edi, [ecx + 8]
cmp eax, edi
mov dword [esp + 8], edx
jle 0x446f7d
sub eax, 8
mov dword [esp + 0xc], eax
jmp 0x446f9c
mov dword [esp + 0xc], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [esp + 8]
mov dword [esi + 0x1bc], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 8], 4
cmp byte [esi + 0x1cc], 0
jne 0x446fa9
mov cl, 1
jmp 0x446fb3
cmp byte [esi + 0x1cd], 0
setne cl
movzx ecx, cl
neg ecx
sbb ecx, ecx
and ecx, 0x40
or ecx, 0x414
push ecx
mov ecx, dword [esp + 0x18]
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x18]
sub ecx, edx
push ecx
push eax
push edx
mov edx, dword [esi + 0x28]
push 0
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [esi]
mov edx, dword [eax + 0x44]
mov ecx, esi
call edx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi]
mov edx, dword [eax + 0x38]
call edx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
cmp byte [esi + 0xc], 0
jne 0x44701a
push 0
mov byte [esi + 0xc], 1
call fcn.004d2ce5
add esp, 4
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
cmp byte [esi + 0x20], 0
mov edi, 4
je 0x447091
lea eax, [esp + 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esi + 0x28]
lea ecx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push eax
push ecx
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x447061
mov dword [esi + 8], 5
jmp 0x447091
cmp dword [esi + 8], 5
jne 0x44708e
mov eax, dword [esi + 0x1c0]
test eax, eax
je 0x447091
cmp eax, 0x3e8
je 0x44708e
mov dword [esi + 0x1c0], 0x3e8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x1bc], eax
mov dword [esi + 8], edi
cmp dword [esi + 8], edi
jne case.0x446f49.2
mov eax, dword [esi]
mov edx, dword [eax + 0x40]
mov ecx, esi
call edx
test al, al
je case.0x446f49.2
mov dword [esi + 8], 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x447a60
Capabilities:
Hide graphical window

Disassembly:
mov eax, esi
call fcn.00447bf0
test eax, eax
jne 0x447a6e
xor al, al
ret
mov eax, dword [eax + 0x148]
push 8
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [esi + 0x1cc], 0
je 0x447a8f
cmp byte [esi + 0x1cd], 0
je 0x447ac3
cmp byte [esi + 0x1c4], 0
je 0x447aaa
mov ecx, dword [esi + 0x28]
push 0x53
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ecx
jmp 0x447abd
mov edx, dword [esi + 0x28]
push 0x257
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp byte [esi + 0x1cc], 0
je 0x447ae8
cmp byte [esi + 0x1cd], 0
je 0x447ae8
mov eax, dword [esi + 0x28]
push 0
push 0xa
push 0x10a
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov al, 1
ret
Function at 0x44f960
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4f6426
mov eax, dword fs:[0]
push eax
sub esp, 0x938
mov eax, dword [0x545628]
xor eax, esp
mov dword [esp + 0x934], eax
push ebp
push esi
push edi
mov eax, dword [0x545628]
xor eax, esp
push eax
lea eax, [esp + 0x948]
mov dword fs:[0], eax
mov eax, dword [esp + 0x958]
mov dword [esp + 0x18], eax
mov byte [esp + 0x14], 0
mov dword [esp + 0x10], 0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x950], 0
call fcn.00415be0
mov ecx, dword [esp + 0x95c]
push ecx
lea edi, [esp + 0x20]
lea ecx, [esp + 0x14]
mov byte [esp + 0x954], 1
call fcn.0044f740
add esp, 4
test al, al
jne 0x44fa27
lea ecx, [esp + 0x10]
call fcn.0040fe70
cmp byte [esp + 0x138], 0
mov dword [esp + 0x1c], vtable.t_str.0
jne 0x44fbbd
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x28]
cmp eax, edx
je 0x44fbbd
push eax
call fcn.004d1d15
add esp, 4
jmp 0x44fbbd
cmp byte [esp + 0x138], 0
lea eax, [esp + 0x28]
jne 0x44fa39
mov eax, dword [esp + 0x24]
lea esi, [eax + 4]
xor eax, eax
push 0x7fe
push eax
lea ecx, [esp + 0x14e]
push ecx
mov word [esp + 0x150], ax
call fcn.004d6770
add esp, 0xc
push 0x5529f0
push esi
call fcn.004d35bd
add esp, 8
test eax, eax
jne 0x44f9f3
mov eax, 0x4000
test word [0x5529f6], ax
jne 0x44fab0
cmp byte [esp + 0x138], 0
mov dword [esp + 0x1c], vtable.t_str.0
jne 0x44fbbd
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x28]
cmp eax, ecx
je 0x44fbbd
push eax
call fcn.004d1d15
add esp, 4
jmp 0x44fbbd
push esi
push str._s.
lea edx, [esp + 0x14c]
call fcn.0041a760
add esp, 8
push 0x5527a0
lea edx, [esp + 0x148]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x44fbb4
mov ecx, 0x52a134
mov eax, 0x5527cc
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x44fb16
test dx, dx
je 0x44fb12
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x44fb16
add eax, 4
add ecx, 4
test dx, dx
jne 0x44faf0
xor eax, eax
jmp 0x44fb1b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x44fb99
mov ecx, 0x52bd0c
mov eax, 0x5527cc
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x44fb56
test dx, dx
je 0x44fb52
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x44fb56
add eax, 4
add ecx, 4
test dx, dx
jne 0x44fb30
xor eax, eax
jmp 0x44fb5b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x44fb99
mov edi, dword [esp + 0x18]
mov ecx, 0x5527cc
call fcn.0044fbf0
test al, al
jne 0x44fb99
push 0x5527cc
push esi
push 0x52be34
lea edx, [esp + 0x150]
call fcn.0041a760
add esp, 0xc
lea eax, [esp + 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x5527a0
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x44fae3
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x1c]
call fcn.004161d0
lea ecx, [esp + 0x10]
call fcn.0040f9f0
mov ecx, dword [esp + 0x948]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x934]
xor ecx, esp
call fcn.004d158d
add esp, 0x944
ret 8
Function at 0x452510
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4f2a1c
mov eax, dword fs:[0]
push eax
sub esp, 0x454
mov eax, dword [0x545628]
xor eax, esp
mov dword [esp + 0x450], eax
push ebp
push esi
push edi
mov eax, dword [0x545628]
xor eax, esp
push eax
lea eax, [esp + 0x464]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x474]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x262]
push ecx
mov word [esp + 0x264], ax
call fcn.004d6770
add esp, 0xc
lea edx, [esp + 0x258]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x258]
push 0x5c
push eax
call fcn.004d3998
lea ecx, [esp + 0x260]
add esp, 8
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x4525a0
sub ecx, esi
mov edx, eax
lea esi, [esp + 0x258]
sar ecx, 1
sub edx, esi
sar edx, 1
dec ecx
cmp edx, ecx
jne 0x4525c6
xor ecx, ecx
mov word [eax], cx
lea ecx, [esp + 0x10]
call fcn.00410c10
lea eax, [esp + 0x258]
lea edx, [esp + 0x10]
call fcn.00410e40
cmp byte [esp + 0x12c], 0
lea eax, [esp + 0x1c]
jne 0x4525f1
mov eax, dword [esp + 0x18]
add eax, 4
mov edx, ebx
call fcn.00410e40
cmp byte [esp + 0x12c], 0
mov dword [esp + 0x10], vtable.t_str.0
jne 0x452622
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1c]
cmp eax, edx
je 0x452622
push eax
call fcn.004d1d15
add esp, 4
lea ecx, [esp + 0x134]
call fcn.00410c10
lea edi, [esp + 0x134]
mov eax, ebp
call fcn.0045bcd0
cmp byte [esp + 0x250], 0
lea esi, [esp + 0x140]
jne 0x452654
mov esi, dword [esp + 0x13c]
lea ecx, [esp + 0x10]
call fcn.00410c10
lea eax, [esi + 4]
lea edx, [esp + 0x10]
call fcn.00410e40
cmp byte [esp + 0x12c], 0
lea eax, [esp + 0x1c]
jne 0x45267b
mov eax, dword [esp + 0x18]
cmp word [eax + 4], 0x2e
jne 0x452690
lea eax, [esp + 0x10]
push eax
mov ecx, ebx
call fcn.00417080
jmp 0x45269c
lea ecx, [esp + 0x10]
push ecx
mov ecx, ebx
call fcn.00416320
cmp byte [esp + 0x12c], 0
mov esi, vtable.t_str.0
mov dword [esp + 0x10], esi
jne 0x4526c4
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1c]
cmp eax, edx
je 0x4526c4
push eax
call fcn.004d1d15
add esp, 4
lea ecx, [esp + 0x10]
call fcn.00410c10
mov eax, 0x51a8f8
lea edx, [esp + 0x10]
call fcn.00410e40
lea eax, [esp + 0x10]
push eax
mov ecx, ebx
call fcn.00417080
cmp byte [esp + 0x12c], 0
mov dword [esp + 0x10], esi
jne 0x45270a
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
cmp eax, ecx
je 0x45270a
push eax
call fcn.004d1d15
add esp, 4
cmp byte [esp + 0x250], 0
mov dword [esp + 0x134], esi
jne 0x452736
mov eax, dword [esp + 0x13c]
lea edx, [esp + 0x140]
cmp eax, edx
je 0x452736
push eax
call fcn.004d1d15
add esp, 4
mov ecx, dword [esp + 0x464]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x450]
xor ecx, esp
call fcn.004d158d
add esp, 0x460
ret
Function at 0x456fd0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x804
mov eax, dword [0x545628]
xor eax, esp
mov dword [esp + 0x800], eax
push ebx
mov ebx, dword [esp + 0x818]
push ebp
mov ebp, dword [esp + 0x818]
push esi
mov esi, dword [esp + 0x814]
push edi
xor eax, eax
push 0x7fe
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call fcn.004d6770
push esi
push str._s.
lea edx, [esp + 0x24]
call fcn.0041a760
add esp, 0x14
push 0x551fa0
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x457166
mov ecx, 0x52a134
mov eax, 0x551fcc
jmp 0x457050
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x457076
test dx, dx
je 0x457072
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x457076
add eax, 4
add ecx, 4
test dx, dx
jne 0x457050
xor eax, eax
jmp 0x45707b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x45714b
mov ecx, 0x52bd0c
mov eax, 0x551fcc
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4570b6
test dx, dx
je 0x4570b2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4570b6
add eax, 4
add ecx, 4
test dx, dx
jne 0x457090
xor eax, eax
jmp 0x4570bb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x45714b
push esi
lea eax, [esp + 0x14]
push 0x400
push eax
call fcn.004d2c76
push 0x52a4b8
lea ecx, [esp + 0x20]
push 0x400
push ecx
call fcn.004d3269
push 0x551fcc
lea edx, [esp + 0x2c]
push 0x400
push edx
call fcn.004d3269
lea eax, [esp + 0x34]
push 0x551f70
push eax
call fcn.004d35bd
add esp, 0x2c
test eax, eax
jne 0x45714b
mov ecx, 0x4000
test word [0x551f76], cx
je 0x45713c
mov eax, dword [esp + 0x81c]
test al, al
je 0x45714b
push ebx
push ebp
push eax
lea edx, [esp + 0x1c]
push edx
call fcn.00456fd0
add esp, 0x10
jmp 0x457147
lea eax, [esp + 0x10]
push ebx
push eax
call ebp
add esp, 8
test eax, eax
je 0x457184
push 0x551fa0
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x457041
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 1
mov ecx, dword [esp + 0x810]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004d158d
add esp, 0x804
ret
xor eax, eax
jmp 0x45716b
Function at 0x45b930
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4f1b28
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x545628]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x290]
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x14], eax
mov edi, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
lea ebx, [edi + edi + 2]
cmp ebx, eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x18], edi
jge 0x45b9d0
mov ecx, ebx
imul ecx, ecx, 0x258
lea eax, [ecx + ebp]
lea edx, [eax - 0x258]
push edx
push eax
call dword [esp + 0x1c]
add esp, 8
test al, al
je 0x45b9a1
dec ebx
mov esi, ebx
imul edi, edi, 0x258
imul esi, esi, 0x258
add esi, ebp
add edi, ebp
call fcn.00452300
mov dword [esp + 0x30], ebx
mov edi, dword [esp + 0x30]
lea ebx, [ebx + ebx + 2]
cmp ebx, dword [esp + 0x34]
jl 0x45b982
mov eax, dword [esp + 0x34]
cmp ebx, eax
jne 0x45b9f5
imul eax, eax, 0x258
imul edi, edi, 0x258
lea esi, [eax + ebp - 0x258]
add edi, ebp
call fcn.00452300
mov eax, dword [esp + 0x34]
dec eax
mov dword [esp + 0x30], eax
mov ecx, dword [esp + 0x14]
push ecx
sub esp, 0x258
lea esi, [esp + 0x294]
mov edi, esp
mov dword [esp + 0x270], esp
call fcn.00451810
mov edx, dword [esp + 0x274]
mov ecx, dword [esp + 0x28c]
push edx
push ebp
call fcn.0045bad0
add esp, 0x264
cmp byte [esp + 0x278], 0
mov esi, vtable.t_str.0
mov dword [esp + 0x15c], esi
jne 0x45ba61
mov eax, dword [esp + 0x164]
lea ecx, [esp + 0x168]
cmp eax, ecx
je 0x45ba61
push eax
call fcn.004d1d15
add esp, 4
cmp byte [esp + 0x154], 0
mov dword [esp + 0x38], esi
jne 0x45ba84
mov eax, dword [esp + 0x40]
lea edx, [esp + 0x44]
cmp eax, edx
je 0x45ba84
push eax
call fcn.004d1d15
add esp, 4
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x45f040
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x210
mov eax, dword [0x545628]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebp
mov ebp, dword [esp + 0x218]
push esi
push edi
mov edi, ecx
mov eax, 0x40
cmp ax, word [edi]
jne 0x45f06d
add edi, 2
push 0x2c
push edi
call fcn.004d3496
mov esi, eax
add esp, 8
test esi, esi
jne 0x45f098
pop edi
pop esi
xor al, al
pop ebp
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004d158d
add esp, 0x210
ret
push 0xa
lea ecx, [esp + 0x10]
push ecx
lea edx, [esi + 2]
push edx
mov dword [esp + 0x18], 0
call fcn.004d30d6
mov dword [ebp], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x26]
push ecx
mov word [esp + 0x28], ax
call fcn.004d6770
sub esi, edi
sar esi, 1
push esi
push edi
lea edx, [esp + 0x30]
push 0x104
push edx
call fcn.004d4a58
add esp, 0x28
push 0x104
push ebx
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ecx, dword [esp + 0x218]
pop edi
test eax, eax
pop esi
setne al
pop ebp
xor ecx, esp
call fcn.004d158d
add esp, 0x210
ret
Function at 0x460970
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 0x38
mov eax, dword [0x545628]
xor eax, esp
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x3c]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
push edi
push 0
push 0
mov dword [esp + 0x18], eax
call esi
mov ebx, eax
lea ecx, [ebx*4]
push ecx
call fcn.004d1df2
add esp, 4
mov ebp, eax
push ebp
push ebx
call esi
xor edi, edi
test ebx, ebx
jle 0x460a27
push 0x2c
lea edx, [esp + 0x1c]
push 0
push edx
call fcn.004d6770
mov esi, dword [ebp + edi*4]
mov eax, esi
and eax, 0xf0000000
add esp, 0xc
mov dword [esp + 0x14], esi
cmp eax, 0xe0000000
jne 0x4609e1
mov dword [esp + 0x1c], esi
jmp 0x460a10
cmp eax, 0xf0000000
je 0x4609f3
mov eax, esi
shr eax, 0x10
mov dword [esp + 0x1c], eax
jmp 0x460a10
mov ecx, esi
shr ecx, 0x10
and ecx, 0xfff
push ecx
lea edx, [esp + 0x20]
push edx
call fcn.00466c20
add esp, 8
test al, al
je 0x460a15
mov word [esp + 0x20], si
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
call fcn.004689d0
inc edi
cmp edi, ebx
jl 0x4609b4
push ebp
call fcn.004d1d15
mov ecx, dword [esp + 0x48]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov al, 1
call fcn.004d158d
add esp, 0x38
ret
Function at 0x461410
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4f7fd8
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x545628]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x545628]
xor eax, esp
push eax
lea eax, [esp + 0x6c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x7c]
lea eax, [esp + 0x1c]
push eax
mov edi, ecx
call fcn.00458ba0
lea ecx, [esp + 0x1c]
xor esi, esi
push ecx
mov eax, edi
mov dword [esp + 0x78], esi
call fcn.004643c0
test al, al
jne 0x46146f
mov ecx, edi
call fcn.0040faa0
push edi
mov ecx, ebp
call fcn.00460f80
add esp, 4
test al, al
je 0x461497
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp + 0xc]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x4614d5
push ebp
call fcn.00460970
add esp, 4
test al, al
jne 0x4614d5
mov eax, dword [esp + 0x28]
cmp eax, esi
je 0x4614b5
push eax
call fcn.004d195d
add esp, 4
mov ecx, dword [esp + 0x1c]
push ecx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
call fcn.004d195d
add esp, 4
xor al, al
jmp 0x4615ff
push ebp
lea ebx, [esp + 0x20]
call fcn.00468da0
push 0x2c
lea edx, [esp + 0x3c]
push esi
push edx
mov dword [esp + 0x40], esi
call fcn.004d6770
add esp, 0xc
lea esi, [esp + 0x34]
mov eax, edi
call fcn.004603c0
test al, al
je 0x4615d1
call fcn.004666e0
test al, al
je 0x461540
mov eax, esi
push eax
lea ecx, [esp + 0x1c]
push ecx
mov edi, ebx
mov dword [esp + 0x20], 0xffffffff
call fcn.00468a40
test al, al
je 0x461540
mov edi, dword [esp + 0x18]
mov esi, ebx
call fcn.0045e160
mov esi, eax
lea edi, [esp + 0x34]
call fcn.0045ed20
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
sub ecx, esi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
xor edi, edi
mov dword [esp + 0x18], eax
test eax, eax
jle 0x4615d1
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
sub ecx, esi
mov eax, 0x2aaaaaab
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x461584
call fcn.004d723a
mov esi, dword [ebp + 0xc]
movzx eax, word [ebx + esi + 0xc]
mov cx, word [esp + 0x40]
cmp ax, cx
jb 0x461644
ja 0x461644
mov eax, dword [ebx + esi + 8]
test eax, eax
je 0x46161e
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x46161e
cmp eax, ecx
jb 0x461644
ja 0x461644
cmp edi, 0xffffffff
je 0x4615d1
test edi, edi
je 0x4615d1
mov ecx, edi
neg ecx
push ebp
call fcn.00468af0
mov eax, dword [esp + 0x28]
xor esi, esi
cmp eax, esi
je 0x4615e4
push eax
call fcn.004d195d
add esp, 4
mov ecx, dword [esp + 0x1c]
push ecx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
call fcn.004d195d
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x6c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.004d158d
add esp, 0x64
ret
lea edx, [ebx + esi + 0x10]
lea ecx, [esp + 0x44]
call fcn.00466670
test eax, eax
jne 0x461644
lea edx, [ebx + esi + 0x20]
lea ecx, [esp + 0x54]
call fcn.00466670
test eax, eax
je 0x4615be
inc edi
add ebx, 0x30
cmp edi, dword [esp + 0x18]
jl 0x461565
jmp 0x4615d1
Function at 0x461c10
Capabilities:
Delete registry key

Disassembly:
push 0xffffffffffffffff
push 0x4f4a66
mov eax, dword fs:[0]
push eax
sub esp, 0x150
mov eax, dword [0x545628]
xor eax, esp
mov dword [esp + 0x14c], eax
push ebp
push esi
push edi
mov eax, dword [0x545628]
xor eax, esp
push eax
lea eax, [esp + 0x160]
mov dword fs:[0], eax
push str.Keyboard_LayoutPreload
push SysReAllocString
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebp, vtable.t_reg.0
lea ecx, [esp + 0x38]
mov dword [esp + 0x2c], ebp
call fcn.00410c10
xor edi, edi
mov eax, str.HKEY_CURRENT_USER
lea edx, [esp + 0x38]
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], VariantClear
call fcn.00410e40
push 1
push 1
push ebx
mov eax, str.Keyboard_LayoutPreload
lea ecx, [esp + 0x38]
mov dword [esp + 0x174], edi
call fcn.00411e70
test al, al
jne 0x461d08
mov ecx, ebx
call fcn.0040fa50
push 0x530024
push 0x52a3bc
mov edx, eax
call fcn.004114a0
mov eax, dword [esp + 0x38]
add esp, 8
mov dword [esp + 0x2c], ebp
cmp eax, edi
je 0x461cd6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esp + 0x154], 0
mov dword [esp + 0x30], edi
mov dword [esp + 0x38], vtable.t_str.0
jne 0x461d01
mov eax, dword [esp + 0x40]
lea ecx, [esp + 0x44]
cmp eax, ecx
je 0x461d01
push eax
call fcn.004d1d15
add esp, 4
xor al, al
jmp 0x461e18
lea edx, [esp + 0x14]
push edx
mov ecx, esi
call fcn.004647c0
mov byte [esp + 0x168], 1
mov ecx, dword [esp + 0x24]
mov edx, ecx
sub edx, dword [esp + 0x20]
mov eax, 0x2aaaaaab
imul edx
sar edx, 3
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp esi, edi
mov dword [esp + 0x10], 1
jle 0x461da3
xor ebp, ebp
jmp 0x461d54
mov ecx, dword [esp + 0x24]
sub ecx, dword [esp + 0x20]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x461d72
call fcn.004d723a
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x10]
lea eax, [ecx + ebp]
push edx
lea ecx, [esp + 0x30]
mov edx, ebx
call fcn.00461b90
add esp, 4
test al, al
je 0x461d94
inc dword [esp + 0x10]
inc edi
add ebp, 0x30
cmp edi, esi
jl 0x461d50
xor edi, edi
mov ebp, vtable.t_reg.0
mov eax, dword [esp + 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [esp + 0x20]
cmp eax, edi
je 0x461dbf
push eax
call fcn.004d195d
add esp, 4
mov ecx, dword [esp + 0x14]
push ecx
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
call fcn.004d195d
mov eax, dword [esp + 0x34]
add esp, 4
mov dword [esp + 0x2c], ebp
cmp eax, edi
je 0x461deb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esp + 0x154], 0
mov dword [esp + 0x30], edi
mov dword [esp + 0x38], vtable.t_str.0
jne 0x461e16
mov eax, dword [esp + 0x40]
lea edx, [esp + 0x44]
cmp eax, edx
je 0x461e16
push eax
call fcn.004d1d15
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x160]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x14c]
xor ecx, esp
call fcn.004d158d
add esp, 0x15c
ret
Function at 0x462940
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4f37d8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebp
push esi
push edi
mov eax, dword [0x545628]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
movzx eax, word [ebx + 0xc]
push eax
lea ecx, [esp + 0x18]
xor ebp, ebp
push ecx
mov dword [esp + 0x1c], ebp
call fcn.00462890
test al, al
jne 0x4629e1
lea edx, [esp + 0x18]
push edx
call fcn.00458ba0
mov eax, ebx
lea edi, [esp + 0x18]
mov dword [esp + 0x38], ebp
call fcn.0045e190
mov eax, edi
push eax
mov edi, esi
call fcn.00464a10
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x4629b5
push eax
call fcn.004d195d
add esp, 4
mov ecx, dword [esp + 0x18]
push ecx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
call fcn.004d195d
add esp, 4
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x2c
ret
mov edx, dword [esp + 0x14]
push edx
mov eax, esi
call fcn.00464970
mov edi, eax
mov eax, ebx
call fcn.0045e190
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x2c
ret
Function at 0x466730
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x210
mov eax, dword [0x545628]
xor eax, esp
mov dword [esp + 0x20c], eax
mov eax, dword [esp + 0x214]
push ebx
push ebp
mov ebp, dword [esp + 0x220]
mov dword [esp + 8], eax
push esi
xor eax, eax
push edi
mov edi, ecx
cmp dword [ebp + 0x120], eax
je 0x46676c
mov dword [ebp + 0x120], eax
lea esi, [ebp + 8]
mov ecx, 1
mov dword [ebp + 4], eax
call fcn.00411b60
cmp byte [esi + 0x114], 0
je 0x46678a
add esi, 4
jmp 0x46678c
mov esi, dword [esi]
xor ecx, ecx
xor edx, edx
mov word [esi + 4], cx
cmp dx, word [edi]
je 0x466809
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
nop
push 0x25
push edi
call fcn.004d3496
add esp, 8
mov esi, eax
push edi
mov edx, ebp
push 0x52a3bc
test esi, esi
je 0x466824
xor eax, eax
mov word [esi], ax
add esi, 2
call fcn.004114a0
push 0x25
push esi
call fcn.004d3496
add esp, 0x10
test eax, eax
je 0x46682e
push 0x104
lea edx, [esp + 0x18]
push edx
xor ecx, ecx
push esi
mov word [eax], cx
lea edi, [eax + 2]
call ebx
test eax, eax
je 0x46684f
lea eax, [esp + 0x14]
push eax
push 0x52a3bc
mov edx, ebp
call fcn.004114a0
xor ecx, ecx
add esp, 8
cmp cx, word [edi]
jne 0x4667a0
mov al, 1
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004d158d
add esp, 0x210
ret
call fcn.004114a0
add esp, 8
jmp 0x466809
mov ecx, dword [esp + 0x10]
call fcn.0040fa50
push 0x530498
push 0x52a3bc
mov edx, eax
call fcn.004114a0
add esp, 8
xor al, al
jmp 0x46680b
mov ecx, dword [esp + 0x10]
call fcn.0040fa50
mov edi, eax
push 0x5304a8
push 0x52a3bc
mov edx, edi
call fcn.004114a0
push esi
push 0x52a3bc
mov edx, edi
call fcn.004114a0
add esp, 0x10
xor al, al
jmp 0x46680b