joyce8/EMBER2024-capa huggingface dataset:
Function at 0x450410
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x45041d
mov byte [eax], 0
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
test ebx, ebx
je 0x45042a
mov byte [ebx], 0
mov eax, dword [ebp + 8]
push 0
push eax
call fcn.0044f060
push eax
call fcn.0043bac0
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov esi, eax
add esp, 4
test esi, esi
je 0x450460
push esi
call edi
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
jne 0x45052e
cmp esi, 0x10
je 0x45048c
cmp esi, 0xa0
je 0x45048c
cmp esi, 0xa1
je 0x45048c
push 0x10
call edi
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
je 0x45052e
cmp esi, 0x12
je 0x4504b4
cmp esi, 0xa4
je 0x4504b4
cmp esi, 0xa5
je 0x4504b4
push 0x12
call edi
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
je 0x45052e
cmp esi, 0x11
je 0x4504dc
cmp esi, 0xa2
je 0x4504dc
cmp esi, 0xa3
je 0x4504dc
push 0x11
call edi
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
je 0x45052e
test esi, esi
jne 0x450519
push 0x5d
call edi
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
je 0x45052e
push 0x5b
call edi
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
je 0x45052e
push 0x5c
call edi
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
je 0x45052e
test ebx, ebx
je 0x450520
mov byte [ebx], 1
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x45052e
test esi, esi
je 0x45052e
mov byte [eax], 1
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4532a0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
cmp byte [ecx + 0x1163d], 0
jne 0x4532ba
xor eax, eax
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [0x52fe2c]
call fcn.00408fd0
test al, al
jne 0x4532b2
mov eax, dword [0x52fe2c]
push edi
add eax, 0x5c8
push eax
lea ecx, [ebp - 0x258]
push ecx
call fcn.00450830
add esp, 8
push str.clinkclink_dll_x86.dll
push 0x122
lea edx, [ebp - 0x258]
push edx
call fcn.004017b0
xor edi, edi
lea eax, [ebp - 0x258]
push edi
push eax
call fcn.004c5850
add esp, 8
test al, al
je 0x453319
cmp word [ebp - 0x258], di
jne 0x453322
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [0x5303a4]
push esi
cmp eax, edi
jne 0x4533d7
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x258]
push edx
mov dword [ebp - 0xc], edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, edi
jne 0x45335b
mov eax, 1
pop esi
mov dword [0x5303a4], eax
pop edi
mov esp, ebp
pop ebp
ret 4
push ebx
push 1
push esi
call fcn.0044c490
mov ebx, eax
add esp, 8
cmp ebx, edi
je 0x4533d1
push ebx
push esi
push edi
lea eax, [ebp - 0x258]
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 8], 4
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4533c8
push 0x4e82fc
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x14]
push ecx
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4533c8
mov esi, dword [ebp - 4]
mov ecx, 0xd
mov edi, 0x530370
rep movsd dword es:[edi], dword [esi]
mov dword [0x5303a4], 2
push ebx
call fcn.0044c4f0
add esp, 4
mov eax, dword [0x5303a4]
pop ebx
cmp eax, 1
je 0x4533e3
cmp eax, 2
je 0x4533e3
xor eax, eax
pop esi
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x45a750
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push 0x1fffe
call fcn.0044c4d0
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x45a76d
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ebx
push 0
push 0
push str.AutoRun
push ecx
mov dword [ebp - 4], 0x1fffa
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x45a8aa
mov edx, dword [ebp - 4]
shr edx, 1
mov word [ebx + edx*2], ax
cmp byte [ebp + 0xc], al
je 0x45a880
cmp word [ebx], ax
je 0x45a880
push edi
push str.ConEmuCmd_Autorun.cmd
push ebx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov edi, eax
test edi, edi
je 0x45a87f
push esi
mov esi, edi
cmp edi, ebx
jbe 0x45a7de
lea ecx, [ecx]
cmp word [esi - 2], 0x26
je 0x45a7de
add esi, 0xfffffffe
cmp esi, ebx
ja 0x45a7d0
push 0x26
push edi
call fcn.004c9bca
add esp, 8
test eax, eax
jne 0x45a806
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x45a7f2
sub eax, edx
sar eax, 1
lea eax, [edi + eax*2]
jmp 0x45a819
cmp word [eax], 0x26
jne 0x45a819
lea esp, [esp]
add eax, 2
cmp word [eax], 0x26
je 0x45a810
cmp esi, ebx
ja 0x45a82a
cmp word [eax], 0
jne 0x45a84e
xor ecx, ecx
mov word [ebx], cx
jmp 0x45a87e
cmp word [eax], 0
jne 0x45a84e
movzx eax, word [esi - 2]
cmp ax, 0x26
je 0x45a840
cmp ax, 0x20
jne 0x45a847
add esi, 0xfffffffe
cmp esi, ebx
ja 0x45a830
xor edx, edx
mov word [esi], dx
jmp 0x45a87e
cmp esi, ebx
jne 0x45a85b
push eax
call fcn.00406cc0
add esp, 4
mov ecx, eax
lea edi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x45a860
sub ecx, edi
sar ecx, 1
lea ecx, [ecx + ecx + 2]
push ecx
push eax
push esi
call fcn.004c9f70
add esp, 0xc
pop esi
pop edi
push ebx
call fcn.00406cc0
add esp, 4
test eax, eax
je 0x45a893
cmp word [eax], 0
jne 0x45a8c1
xor edx, edx
push ebx
mov word [ebx], dx
call fcn.0044c4f0
add esp, 4
xor ebx, ebx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
push ebx
mov word [ebx], ax
call fcn.0044c4f0
add esp, 4
xor ebx, ebx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
cmp word [ebx], 0
jne 0x45a8d2
push ebx
call fcn.0044c4f0
add esp, 4
xor ebx, ebx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45a8e0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x10], ecx
xor ecx, ecx
push edi
mov byte [ebp - 1], 0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
cmp ebx, ecx
je 0x45a9e5
cmp word [ebx], cx
je 0x45a9e5
mov edi, dword [ebp + 8]
cmp edi, ecx
je 0x45a9e5
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ecx
je 0x45a94c
cmp word [eax], cx
je 0x45a94c
lea edx, [ebp - 0xc]
push edx
push 0xf003f
push ecx
push eax
push edi
call esi
test eax, eax
je 0x45a949
pop esi
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push ebx
push edi
call esi
test eax, eax
jne 0x45a9cb
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
xor esi, esi
mov eax, dword [ebp - 8]
push 0
push 0
push 0
push 0
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 0x218]
push edx
push 0
push eax
mov dword [ebp + 8], 0x104
call ebx
test eax, eax
jne 0x45a9ae
mov edx, dword [ebp - 8]
lea ecx, [ebp - 0x218]
push ecx
mov ecx, dword [ebp - 0x10]
push eax
push edx
call fcn.0045a8e0
test al, al
je 0x45a9ae
inc esi
cmp esi, 0xff
jb 0x45a967
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x10]
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x45a9cb
mov byte [ebp - 1], 1
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x45a9d9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 1]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x45bc10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
push SysReAllocString
mov esi, 0x40
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x45bc77
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 4]
push edx
push eax
push eax
mov eax, dword [ebp - 8]
push str.EnableBalloonTips
push eax
mov dword [ebp - 4], 1
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x45bc6d
cmp dword [ebp - 4], eax
jne 0x45bc6d
xor esi, esi
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x45d170
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push ebx
xor bl, bl
mov byte [ebp - 1], bl
call fcn.004c6070
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x100
lea ecx, [ebp - 0x10]
push ecx
or eax, 0x20019
push eax
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionConsoleTrueTypeFont
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x45d367
push esi
push edi
xor edx, edx
push 0x3e
push edx
lea eax, [ebp - 0x5a]
push eax
mov word [ebp - 0x5c], dx
call fcn.004c9b50
add esp, 0xc
cmp byte [0x52fe55], bl
je 0x45d2be
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x25c]
push edx
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
xor esi, esi
push esi
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x5c]
push edx
push esi
mov ebx, 0x1fc
push eax
mov dword [ebp - 0xc], 0x20
mov dword [ebp - 8], ebx
call edi
test eax, eax
jne 0x45d2be
mov eax, dword [ebp - 0xc]
inc esi
cmp eax, 0x1f
jbe 0x45d223
mov eax, 0x1f
xor ecx, ecx
mov word [ebp + eax*2 - 0x5c], cx
mov eax, dword [ebp - 8]
shr eax, 1
cmp eax, 0xfe
jbe 0x45d23b
mov eax, 0xfe
xor edx, edx
mov word [ebp + eax*2 - 0x25c], dx
push 0xa
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x5c]
push ecx
call fcn.004c9edf
add esp, 0xc
test eax, eax
je 0x45d28c
mov ax, word [ebp - 0x25c]
test ax, ax
je 0x45d28c
cmp ax, 0x2a
lea eax, [ebp - 0x25a]
je 0x45d279
lea eax, [ebp - 0x25c]
mov edx, dword [ebp + 8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x45d34f
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x25c]
push ecx
lea edx, [ebp - 0x14]
push edx
mov edx, dword [ebp - 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x5c]
push ecx
push esi
push edx
mov dword [ebp - 0xc], 0x20
mov dword [ebp - 8], ebx
call edi
test eax, eax
je 0x45d215
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor esi, esi
jmp 0x45d2d0
xor ecx, ecx
mov word [ebp + esi*2 - 0x5a], cx
mov eax, 0x30
mov word [ebp + esi*2 - 0x5c], ax
lea ecx, [eax + 0x4f]
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
lea edi, [ebp - 0x25c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x25c]
push ecx
mov ecx, dword [ebp - 0x10]
lea edx, [ebp - 0x14]
push edx
push 0
lea eax, [ebp - 0x5c]
push eax
push ecx
mov dword [ebp - 0x18], 0x1fe
call ebx
test eax, eax
jne 0x45d353
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x45d34f
inc esi
cmp esi, 0x14
jb 0x45d2d0
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [ebp - 1], 1
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45dee0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x52fe30]
movzx ecx, byte [eax + 0xee1]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.USER32.dll_CheckDlgButton]
push ecx
push 0x60e
push esi
call edi
mov edx, dword [0x52fe30]
movzx eax, byte [edx + 0x11292]
push eax
push 0x60f
push esi
call edi
mov edx, dword [0x52fe30]
xor ecx, ecx
cmp byte [edx + 0x11629], cl
setne cl
push ecx
push 0x601
push esi
call edi
mov eax, dword [0x52fe30]
movzx ecx, byte [eax + 0x1162a]
push ecx
push 0x6b9
push esi
call edi
mov edx, dword [0x52fe30]
movzx eax, byte [edx + 0x1162b]
push eax
push 0xa69
push esi
call edi
mov ecx, dword [0x52fe30]
movzx edx, byte [ecx + 0x11641]
push edx
push 0x609
push esi
call edi
mov eax, dword [0x52fe30]
movzx ecx, byte [eax + 0x11634]
push ecx
push 0x6d8
push esi
call edi
mov edx, dword [0x52fe30]
movzx eax, byte [edx + 0x11635]
push eax
push 0x8cd
push esi
call edi
mov ecx, dword [0x52fe30]
movzx edx, byte [ecx + 0x11636]
push edx
push 0xa77
push esi
call edi
mov eax, dword [0x52fe30]
cmp dword [eax + 0x11638], 0
je 0x45dfcc
mov eax, dword [eax + 0x11638]
jmp 0x45dfd1
mov eax, 0x4e5034
push eax
push 0xa78
push esi
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, dword [0x52fe30]
movzx ecx, byte [eax + 0x1163c]
push ecx
push 0xa50
push esi
call edi
mov edx, dword [0x52fe30]
movzx eax, byte [edx + 0x1163f]
push eax
push 0xa26
push esi
call edi
mov ecx, dword [0x52fe30]
movzx edx, byte [ecx + 0x11640]
push edx
push 0xa3e
push esi
call edi
mov ecx, dword [0x52fe30]
push 0
call fcn.004532a0
neg eax
sbb eax, eax
neg eax
push eax
push 0x972
push esi
call edi
mov eax, dword [0x52fe2c]
mov ecx, dword [eax + 0xbe8]
push ecx
push 0x6d9
push esi
call edi
mov eax, dword [0x52fe2c]
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
xor edx, edx
cmp dword [eax + 0xbe8], edx
sete dl
push edx
push 0x6d9
push esi
call ebx
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
push 0
push 0x6bc
push esi
call ebx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [0x52fe30]
movzx edx, byte [ecx + 0x1249]
push edx
push 0x6b7
push esi
call edi
mov eax, dword [0x52fe30]
movzx ecx, byte [eax + 0x121e]
push ecx
push 0xa08
push esi
call edi
push 0
push 0x655
push esi
call ebx
mov edi, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call edi
push 0
push 0x6e1
push esi
call ebx
push eax
call edi
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x45f7b0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0
push 3
push 0
push 1
push SysReAllocString
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
xor eax, eax
push 0x8002
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
call fcn.0044c4d0
add esp, 4
mov ebx, eax
mov dword [ebp - 4], 0
test esi, esi
je 0x45f95a
cmp esi, 0xffffffff
je 0x45f95a
lea eax, [ebp - 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x45f95a
cmp dword [ebp - 0xc], 0
jg 0x45f95a
jl 0x45f82f
cmp dword [ebp - 0x10], 0xffffff
jae 0x45f95a
push 0
lea ecx, [ebp - 4]
push ecx
push 0x7fff
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x45f95a
mov eax, dword [ebp - 4]
test eax, eax
je 0x45f95a
mov byte [eax + ebx], 0
mov edx, dword [ebp - 4]
mov byte [edx + ebx + 1], 0
mov eax, dword [ebp - 4]
push esi
mov byte [eax + ebx + 2], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov dword [ebp - 8], 0
call fcn.004c62f0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
add esp, 4
mov esi, eax
push str..bat
push esi
call edi
test eax, eax
je 0x45f8bf
push str..cmd
push esi
call edi
test eax, eax
je 0x45f8bf
mov ecx, dword [ebp - 4]
xor eax, eax
test ecx, ecx
jbe 0x45f8bf
lea esp, [esp]
cmp byte [eax + ebx], 0
je 0x45f957
inc eax
cmp eax, ecx
jb 0x45f8b0
mov ecx, dword [ebp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ecx
call esi
mov edx, dword [ebp + 8]
mov edi, eax
mov eax, dword [edx]
push eax
add edi, edi
call esi
mov ecx, dword [ebp - 4]
add eax, edi
lea edi, [eax + ecx + 0x15]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
lea edx, [edi + edi]
push edx
push ecx
call fcn.0044c4b0
mov esi, eax
add esp, 8
test esi, esi
je 0x45f957
push str._r_n_r_n___
push edi
push esi
call fcn.004017b0
mov edx, dword [ebp + 0xc]
push edx
push edi
push esi
call fcn.004017b0
push 0x4e77f4
push edi
push esi
call fcn.004017b0
mov eax, dword [ebp - 4]
inc eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [ebp - 4]
lea ecx, [esi + eax*2]
push ecx
inc edx
push edx
push ebx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push str._r_n___
push edi
push esi
call fcn.004017b0
mov eax, dword [ebp + 0xc]
push eax
push edi
push esi
call fcn.004017b0
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov esi, dword [ebp - 8]
push ebx
call fcn.0044c4f0
add esp, 4
test esi, esi
je 0x45f973
cmp esi, 0xffffffff
je 0x45f973
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x460cd0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
test edi, edi
je 0x460d56
cmp word [edi], 0
je 0x460d56
lea esi, [ebx + 0x11a9c]
mov edx, pe_nt_image_headers32
mov eax, esi
sub edi, esi
test edx, edx
je 0x460d12
movzx ecx, word [edi + eax]
test cx, cx
je 0x460d0e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x460cf4
jmp 0x460d12
test edx, edx
jne 0x460d15
sub eax, 2
xor ecx, ecx
xor edx, edx
lea edi, [ebx + 0x11894]
push str.SoftwareConEmu_
mov word [eax], cx
push edi
mov word [ebx + 0x11c7a], dx
call fcn.00405470
add esp, 8
push esi
push 0x104
push edi
call fcn.004017b0
push esi
push str.ConEmuConfig
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
pop edi
pop esi
pop ebx
pop ebp
ret 4
lea eax, [ebx + 0x11894]
push str.SoftwareConEmu.Vanilla
push eax
call fcn.00405470
add esp, 8
lea esi, [ebx + 0x11a9c]
push esi
xor ecx, ecx
push str.ConEmuConfig
mov word [esi], cx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4697f0
Capabilities:
Check for time delay via gettickcount
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
cmp edi, 0x578
jne 0x46987f
mov ecx, dword [0x52fe2c]
call fcn.0040a9d0
test al, al
je 0x469a15
cmp dword [0x5306c8], 0
je 0x469a15
mov eax, dword [esi + 0xf34cc]
mov ecx, dword [esi + 0xf34c8]
push 0
push 0x3e8
push eax
push ecx
call fcn.004cadc0
push edx
push eax
lea edx, [ebp - 0x110]
push str.Performance_counters___I64i_
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [esi + 0xf2bdc]
add esp, 0x10
lea eax, [ebp - 0x110]
push eax
push edi
push ecx
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push 1
mov ecx, esi
call fcn.00469570
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
lea edx, [edi - 0x579]
cmp edx, 4
ja 0x469a15
cmp edi, 0x579
jne 0x4698f3
lea eax, [ebp - 8]
xor edi, edi
push eax
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esi + 0xf3570]
mov ecx, dword [ebp - 8]
mov dword [esi + eax*8 + 0xf34d0], ecx
mov edx, dword [ebp - 4]
mov dword [esi + eax*8 + 0xf34d4], edx
inc dword [esi + 0xf3570]
cmp dword [esi + 0xf3570], 0x14
jl 0x4698d7
mov dword [esi + 0xf3570], edi
cmp dword [0x5306c8], edi
je 0x469a15
push edi
mov ecx, esi
call fcn.00469570
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
cmp edi, 0x57d
jne 0x469958
lea eax, [ebp - 8]
xor edi, edi
push eax
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esi + 0xf3618]
mov ecx, dword [ebp - 8]
mov dword [esi + eax*8 + 0xf3578], ecx
mov edx, dword [ebp - 4]
mov dword [esi + eax*8 + 0xf357c], edx
inc dword [esi + 0xf3618]
cmp dword [esi + 0xf3618], 0x14
jl 0x46993c
mov dword [esi + 0xf3618], edi
cmp dword [0x5306c8], edi
je 0x469a15
push edi
mov ecx, esi
call fcn.00469570
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
cmp dword [ebp + 0xc], 0
jne 0x469974
lea eax, [esi + edi*8 + 0xf0a58]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + edi*8 + 0xf0a58]
or ecx, dword [esi + edi*8 + 0xf0a5c]
je 0x469a15
mov edx, dword [esi + 0xf34c8]
or edx, dword [esi + 0xf34cc]
je 0x469a15
push ebx
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x10]
sub eax, dword [esi + edi*8 + 0xf0a58]
mov ebx, dword [ebp - 0xc]
sbb ebx, dword [esi + edi*8 + 0xf0a5c]
mov ecx, dword [esi + edi*8 + 0xf0a84]
cmp ecx, ebx
mov dword [ebp - 8], eax
jl 0x4699e7
jg 0x4699d0
mov edx, dword [esi + edi*8 + 0xf0a80]
cmp edx, eax
jb 0x4699e7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + edi*4 + 0xf208c]
cmp eax, 0x1388
jbe 0x469a14
mov eax, dword [ebp - 8]
mov dword [esi + edi*8 + 0xf0a80], eax
mov dword [esi + edi*8 + 0xf0a84], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + edi*4 + 0xf208c], eax
cmp dword [0x5306c8], 0
je 0x469a14
push 0
mov ecx, esi
call fcn.00469570
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x46bbe0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi], ebx
je 0x46bc23
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x46bbff
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 4], ebx
mov eax, dword [esi]
cmp eax, ebx
je 0x46bc0e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
mov dword [esi], ebx
mov dword [esi + 8], ebx
mov dword [esi + 4], ebx
mov dword [esi + 0xc], 0xffffffff
mov dword [esi + 0x110], ebx
xor ecx, ecx
lea edi, [esi + 0x10]
lea eax, [esi + 0x114]
mov dword [esi + 0x110], ebx
mov word [eax], cx
cmp word [edi], bx
jne 0x46bc53
push str.Internal_error._Mapping_file_name_was_not_specified.
push eax
call fcn.00412a30
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
cmp eax, ebx
jg 0x46bc5f
mov eax, 0x218
mov edx, dword [ebp + 8]
mov dword [esi + 0xc], eax
cmp edx, ebx
jne 0x46bc72
cmp dword [ebp + 0xc], ebx
jne 0x46bc72
xor ecx, ecx
jmp 0x46bc77
mov ecx, 1
mov dword [esi + 8], ecx
push edi
cmp edx, ebx
je 0x46bc93
push eax
push ebx
push 4
call fcn.0044cf40
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
jmp 0x46bc9c
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ecx, eax
mov dword [esi], eax
cmp ecx, ebx
jne 0x46bcc9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x110], eax
mov ecx, str.create
cmp dword [ebp + 8], ebx
jne 0x46bcbf
mov ecx, str.open
push edi
push eax
push ecx
push str.Cant__s_console_data_file_mapping._ErrCode0x_08X_n_s
jmp 0x46bd0d
mov eax, dword [esi + 8]
neg eax
push ebx
sbb eax, eax
push ebx
and eax, 0xf001b
push ebx
add eax, 4
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 4], eax
cmp eax, ebx
jne 0x46bd21
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x110], eax
mov ecx, str.ReadWrite
cmp dword [esi + 8], ebx
jne 0x46bd05
mov ecx, 0x4e93f8
push edi
push eax
push ecx
push str.Cant_map_console_info___s_._ErrCode0x_08X_n_s
lea eax, [esi + 0x114]
push 0x208
push eax
call fcn.0044cff0
add esp, 0x18
mov eax, dword [esi + 4]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x46ce30
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d9408
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10c
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x18]
xor edi, edi
call fcn.004bc8c0
lea eax, [ebp - 0x18]
push edi
push eax
mov dword [ebp - 4], edi
call fcn.004b69a0
add esp, 8
test eax, eax
jl 0x46ce7a
lea ecx, [ebp - 0x18]
call fcn.004bc9d0
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ecx, dword [ebp + 8]
mov ebx, dword [sym.imp.USER32.dll_SetDlgItemTextW]
push eax
push 0x5e4
push ecx
call ebx
mov ecx, dword [0x52fe2c]
call fcn.0040a9d0
test al, al
je 0x46cefa
cmp dword [0x5306c8], 0
je 0x46cefa
mov edx, dword [esi + 0xf34cc]
mov eax, dword [esi + 0xf34c8]
push 0
push 0x3e8
push edx
push eax
call fcn.004cadc0
push edx
push eax
lea ecx, [ebp - 0x118]
push str.Performance_counters___I64i_
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [esi + 0xf2bdc]
add esp, 0x10
lea edx, [ebp - 0x118]
push edx
push 0x578
push eax
call ebx
push 1
mov ecx, esi
call fcn.00469570
mov ecx, dword [0x52fe2c]
push 1
call fcn.00416000
mov ecx, dword [0x52fe2c]
call fcn.004104e0
pop ebx
test edi, edi
je 0x46cf25
mov ecx, edi
call fcn.004bcc80
mov ecx, eax
call fcn.004895a0
mov ecx, esi
call fcn.0045bb70
test edi, edi
je 0x46cf46
mov ecx, edi
call fcn.004bcc80
mov ecx, eax
call fcn.00489380
push eax
mov ecx, esi
call fcn.0045c750
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
call fcn.004bc960
mov ecx, dword [ebp - 0xc]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4