joyce8/EMBER2024-capa huggingface dataset:
Function at 0x488d40
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x21c]
sub esp, 0x21c
push 0xffffffffffffffff
push 0x4fcdf1
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x53b098]
xor eax, ebp
mov dword [ebp + 0x218], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x20], esi
mov ebx, dword [ebp + 0x224]
lea ecx, [ebp]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], 0
call fcn.00406d40
mov dword [ebp - 4], 1
cmp dword [esi], 0
jne 0x488de1
mov ecx, ebx
call fcn.004059e0
mov byte [ebp - 0x11], 0
lea eax, [ebp]
push dword [ebp - 0x11]
push eax
call fcn.004056d0
add esp, 4
mov ecx, ebx
push eax
call fcn.00406f90
mov dword [ebp - 0x1c], 1
mov byte [ebp - 4], 0
lea ecx, [ebp]
call fcn.00404e30
mov eax, ebx
jmp 0x488ea2
lea ecx, [ebp]
call fcn.00404e90
mov ebx, eax
nop dword [eax + eax]
push dword [esi]
lea eax, [ebp + 0x18]
push 0x200
push 1
push eax
call fcn.004cfafc
mov esi, dword [ebx + 0x14]
mov edi, eax
mov edx, dword [ebx + 0x10]
mov ecx, esi
sub ecx, edx
add esp, 0x10
cmp edi, ecx
ja 0x488e48
lea ecx, [edx + edi]
mov eax, ebx
mov dword [ebx + 0x10], ecx
cmp esi, 0x10
jb 0x488e24
mov eax, dword [ebx]
lea esi, [eax + edx]
push edi
lea eax, [ebp + 0x18]
push eax
push esi
call fcn.00406000
lea eax, [ebp - 0xd]
mov byte [ebp - 0xd], 0
push eax
lea eax, [esi + edi]
push eax
call fcn.00401ec0
add esp, 0x14
jmp 0x488e5d
push edi
lea eax, [ebp + 0x18]
mov byte [ebp - 0x11], 0
push eax
push dword [ebp - 0x11]
lea ecx, [ebp]
push edi
call fcn.0042ab60
mov esi, dword [ebp - 0x20]
cmp edi, 0x200
je 0x488df0
mov esi, dword [ebp - 0x18]
mov ecx, esi
call fcn.004059e0
mov byte [ebp - 0x18], 0
lea eax, [ebp]
push dword [ebp - 0x18]
push eax
call fcn.004056d0
add esp, 4
mov ecx, esi
push eax
call fcn.00406f90
mov dword [ebp - 0x1c], 1
mov byte [ebp - 4], 0
lea ecx, [ebp]
call fcn.00404e30
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x218]
xor ecx, ebp
call fcn.004c35a5
lea esp, [ebp + 0x21c]
pop ebp
ret 4
Function at 0x48bd30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
mov esi, ecx
push edi
cmp byte [esi + 4], 0
lea edi, [esi - 0x10]
je 0x48bd59
push 6
push str.log4z_already_start__r_n
mov ecx, edi
call fcn.0048b5c0
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0x40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
push 0
push 0
push edi
push 0x488be0
push 0
push 0
mov dword [esi + 0xc], eax
call fcn.004cee2d
mov ecx, eax
add esp, 0x18
or ecx, 0
je 0x48bdab
push 0xbb8
mov dword [edi + 8], eax
mov dword [edi + 0xc], 0
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x48bdb8
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push str.log4z:_create_log4z_thread_error___r_n
call fcn.00488890
add esp, 4
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x48f260
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fdcb7
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x53b098]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
call fcn.004059e0
mov esi, dword [ebp + 8]
mov byte [ebp - 0x10], 0
push dword [ebp - 0x10]
push esi
call fcn.004056d0
add esp, 4
mov ecx, ebx
push eax
call fcn.00406f90
mov dword [ebp - 4], 0
add ebx, 0x18
add esi, 0x18
mov dword [ebp - 0x18], ebx
mov ecx, ebx
mov dword [ebp + 8], esi
call fcn.004059e0
mov byte [ebp - 0x10], 0
push dword [ebp - 0x10]
push esi
call fcn.004056d0
add esp, 4
mov ecx, ebx
push eax
call fcn.00406f90
mov byte [ebp - 4], 1
lea ecx, [ebx + 0x18]
add esi, 0x18
call fcn.004059e0
mov byte [ebp - 0x10], 0
push dword [ebp - 0x10]
push esi
call fcn.004056d0
add esp, 4
lea ecx, [ebx + 0x18]
push eax
call fcn.00406f90
mov byte [ebp - 4], 2
lea ecx, [ebx + 0x30]
mov esi, dword [ebp + 8]
add esi, 0x30
call fcn.004059e0
mov byte [ebp - 0x10], 0
push dword [ebp - 0x10]
push esi
call fcn.004056d0
add esp, 4
lea ecx, [ebx + 0x30]
push eax
call fcn.00406f90
mov byte [ebp - 4], 3
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x48]
mov dword [ebx + 0x48], eax
movzx eax, byte [edi + 0x4c]
mov byte [ebx + 0x4c], al
movzx eax, byte [edi + 0x4d]
mov byte [ebx + 0x4d], al
movzx eax, byte [edi + 0x4e]
mov byte [ebx + 0x4e], al
mov eax, dword [edi + 0x50]
mov dword [ebx + 0x50], eax
movzx eax, byte [edi + 0x54]
mov byte [ebx + 0x54], al
movzx eax, byte [edi + 0x55]
mov byte [ebx + 0x55], al
mov eax, dword [edi + 0x58]
mov dword [ebx + 0x58], eax
mov eax, dword [edi + 0x5c]
mov dword [ebx + 0x5c], eax
mov eax, dword [edi + 0x60]
mov dword [ebx + 0x60], eax
mov eax, dword [edi + 0x64]
mov dword [ebx + 0x64], eax
mov eax, dword [edi + 0x68]
mov dword [ebx + 0x68], eax
mov eax, dword [edi + 0x6c]
mov dword [ebx + 0x6c], eax
mov eax, dword [edi + 0x70]
mov dword [ebx + 0x70], eax
mov eax, dword [edi + 0x74]
mov dword [ebx + 0x74], eax
mov eax, dword [edi + 0x78]
mov dword [ebx + 0x78], eax
mov byte [ebp - 4], 4
lea esi, [ebx + 0x7c]
push 0
mov dword [ebp + 8], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00443ff0
mov dword [esi], eax
mov byte [ebp - 4], 6
mov ecx, dword [esi]
mov eax, dword [edi + 0x7c]
mov dword [esi], eax
mov dword [edi + 0x7c], ecx
mov ecx, dword [esi + 4]
mov eax, dword [edi + 0x80]
mov dword [esi + 4], eax
mov dword [edi + 0x80], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x494660
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x49466b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.00494680
Function at 0x4a6200
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x120]
sub esp, 0x120
push 0xffffffffffffffff
push 0x4ff852
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x53b098]
xor eax, ebp
mov dword [ebp + 0x11c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi], 0
je 0x4a6244
call fcn.004a6390
cmp byte [0x53e0e4], 0
jne 0x4a6257
mov eax, 0x80000001
jmp 0x4a636c
mov eax, dword [esi]
test eax, eax
jne 0x4a62c2
push 8
call fcn.004c35b6
mov edi, eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
push 1
call fcn.004c35b6
mov dword [edi + 4], eax
push 0x118
push 0
mov byte [eax], 0
lea eax, [ebp + 4]
push eax
call fcn.004c5c20
add esp, 0x14
mov dword [ebp], 0x11c
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4a62b1
cmp dword [ebp + 4], 6
mov eax, dword [edi + 4]
setae cl
mov byte [eax], cl
mov dword [ebp - 4], 0xffffffff
mov dword [esi], edi
mov dword [edi], 0
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x4a635b
call fcn.00415fd0
test al, al
jne 0x4a62fc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esi]
push eax
add ecx, 4
call fcn.00416150
test al, al
je 0x4a635b
mov ecx, dword [esi]
add ecx, 4
call fcn.00415af0
call fcn.00415fd0
test al, al
je 0x4a635b
push str.Advapi32.dll
lea ecx, [ebp - 0x28]
call fcn.00404d00
mov dword [ebp - 4], 2
lea eax, [ebp - 0x28]
push eax
call fcn.0040ee30
mov ecx, eax
call fcn.0040eef0
mov edi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004049a0
test edi, edi
je 0x4a635b
push 0x51c998
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4a635b
push dword [esi]
push dword [ebp + 0x128]
call eax
test eax, eax
je 0x4a635b
mov eax, dword [esi]
mov dword [eax], 0
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x4a636a
mov dword [eax], 0x80000001
mov eax, dword [esi]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp + 0x11c]
xor ecx, ebp
call fcn.004c35a5
lea esp, [ebp + 0x120]
pop ebp
ret 4
Function at 0x4a6600
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x628]
sub esp, 0x628
push 0xffffffffffffffff
push 0x4ff900
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x53b098]
xor eax, ebp
mov dword [ebp + 0x624], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 0x630]
lea ecx, [ebp - 0x24]
mov ebx, dword [ebp + 0x634]
call fcn.00404d40
mov dword [ebp - 4], 0
mov eax, dword [0x53e150]
mov dword [ebp], 0
mov dword [ebp], 0x53e150
test eax, eax
je 0x4a6674
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 1
mov ecx, 0x53e138
call fcn.00404c10
test al, al
jne 0x4a66b8
mov ecx, 0x53e138
call fcn.00404e90
lea ecx, [ebp - 0x24]
cmp ecx, eax
je 0x4a676d
mov ecx, 0x53e138
call fcn.00404e90
mov ecx, eax
cmp dword [eax + 0x14], 8
jb 0x4a66af
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
jmp 0x4a6765
push 0x20c
lea eax, [ebp + 0x418]
push 0
push eax
call fcn.004c5c20
add esp, 0xc
lea eax, [ebp + 0x418]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x4a6809
xor eax, eax
push 0x412
push eax
mov word [ebp + 0x622], ax
lea eax, [ebp + 4]
push eax
call fcn.004c5c20
add esp, 0xc
lea eax, [ebp + 4]
push 0x208
push eax
lea eax, [ebp + 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x4a674e
test eax, eax
je 0x4a674e
add eax, eax
cmp eax, 0x412
jae 0x4a685c
xor ecx, ecx
mov word [ebp + eax + 4], cx
lea eax, [ebp + 4]
push eax
call fcn.004051b0
add esp, 4
push eax
lea eax, [ebp + 4]
jmp 0x4a6764
lea eax, [ebp + 0x418]
push eax
call fcn.004051b0
add esp, 4
push eax
lea eax, [ebp + 0x418]
push eax
lea ecx, [ebp - 0x24]
call fcn.00405050
mov byte [ebp - 4], 0
mov eax, dword [0x53e150]
test eax, eax
je 0x4a6781
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push ebx
push edi
lea eax, [ebp - 0x24]
mov dword [ebp], 0
push eax
mov ecx, esi
call fcn.004a6590
test al, al
je 0x4a67a0
mov bl, 1
jmp 0x4a6826
push 0x20c
lea eax, [ebp + 0x418]
push 0
push eax
call fcn.004c5c20
add esp, 0xc
lea eax, [ebp + 0x418]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec eax
cmp eax, 0x103
ja 0x4a6824
xor eax, eax
mov word [ebp + 0x622], ax
lea eax, [ebp + 0x418]
push eax
call fcn.004051b0
add esp, 4
lea ecx, [ebp - 0x24]
push eax
lea eax, [ebp + 0x418]
push eax
call fcn.00405050
push ebx
push edi
lea eax, [ebp - 0x24]
mov ecx, esi
push eax
call fcn.004a6590
mov bl, al
jmp 0x4a6826
mov byte [ebp - 4], 0
mov eax, dword [0x53e150]
test eax, eax
je 0x4a681d
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp], 0
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.004049a0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x624]
xor ecx, ebp
call fcn.004c35a5
lea esp, [ebp + 0x628]
pop ebp
ret 8
call fcn.004c3d33
int3
Function at 0x4a8650
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ffc0f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x53b098]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.004049a0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.004049a0
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.004049a0
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.004049a0
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.004049a0
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.004049a0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4a86e0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ffc0f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x53b098]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.004049a0
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.004049a0
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.004049a0
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.004049a0
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.004049a0
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.004049a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4a9980
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ffddf
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x53b098]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.00405a70
mov dword [ebp - 4], 0
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.00405a70
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.00405a70
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.00405a70
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.00405a70
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.00405a70
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4ab240
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50001f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x53b098]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.00404d60
mov dword [ebp - 4], 0
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.00404d60
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.00404d60
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.00404d60
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.00404d60
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.00404d60
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4ac3b0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5002ff
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x53b098]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.00404d40
mov dword [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.00404d40
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.00404d40
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.00404d40
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.00404d40
mov byte [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.00404d40
mov byte [ebp - 4], 5
mov byte [esi + 0x60], 0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4ac520
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x414]
sub esp, 0x414
push 0xfffffffffffffffe
push 0x536828
push 0x4c4dc0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x53b098]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x410], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00404e90
mov dword [ebp - 0x24], 0
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 8
jb 0x4ac592
mov eax, dword [eax]
lea ecx, [ebp - 0x24]
push ecx
push eax
call fcn.00405420
add esp, 8
mov edx, esi
mov ecx, edi
call fcn.004ac680
mov bl, al
mov byte [ebp - 0x19], bl
mov dword [ebp - 4], 0xfffffffe
jmp 0x4ac5d1
test bl, bl
jne 0x4ac654
cmp edi, 0x1a
jne 0x4ac654
mov ecx, esi
call fcn.00404e90
mov dword [ebp - 0x20], 0
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 8
jb 0x4ac5f7
mov eax, dword [eax]
lea ecx, [ebp - 0x20]
push ecx
push eax
call fcn.00405420
push 0x410
push 0
lea eax, [ebp]
push eax
call fcn.004c5c20
add esp, 0x14
push 0x207
lea eax, [ebp]
push eax
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp]
push eax
call fcn.004051b0
add esp, 4
push eax
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.00405050
mov ecx, esi
call fcn.00404c10
movzx ebx, bl
mov ecx, 1
test al, al
cmove ebx, ecx
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.004c35a5
lea esp, [ebp + 0x414]
pop ebp
ret

Function at 0x4ac820
Capabilities:
Query environment variable

Disassembly:
mov edx, dword [esp + 4]
mov ecx, 0x1a
jmp fcn.004ac520
Function at 0x4ad410
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x53b098]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
cmp dword [ebp + 0x10], 0xffffffff
mov edi, dword [esp + 0x20]
je 0x4ad492
mov ecx, 0x100000
nop dword [eax]
nop word [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x4ad492
test ecx, ecx
je 0x4ad48e
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x4ad450
xor eax, eax
jmp 0x4ad497
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4ad4a1
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004c35a5
add esp, 0xc
ret 0xc
Function at 0x4b1960
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x500a98
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x53b098]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
movq qword [ebp - 0x30], xmm0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x30]
push eax
call fcn.004b0e80
test al, al
jne 0x4b19cf
xor bl, bl
jmp 0x4b1b33
lea ecx, [ebp - 0x5c]
call fcn.004af110
mov byte [ebp - 4], 1
add esi, 0x24
mov eax, dword [esi]
cmp eax, dword [esi + 4]
je 0x4b1a0c
push esi
lea ecx, [ebp - 0x5c]
call fcn.004b3040
lea eax, [esi + 0xc]
push eax
lea ecx, [ebp - 0x50]
call fcn.004b3040
lea eax, [esi + 0x18]
push eax
lea ecx, [ebp - 0x44]
call fcn.004b3040
mov eax, dword [esi + 0x24]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.004b0610
test al, al
jne 0x4b1a24
xor bl, bl
jmp 0x4b1b27
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
movq qword [ebp - 0x24], xmm0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x5c]
call fcn.004afca0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x20]
je 0x4b1b19
mov ecx, edi
call fcn.00418dc0
test al, al
je 0x4b1b19
mov ecx, dword [ebp - 0x20]
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0x24]
sub ecx, eax
push edx
push ecx
push eax
mov ecx, edi
mov dword [ebp - 0x18], 0
call fcn.00418c00
test al, al
je 0x4b1b19
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x24]
cmp dword [ebp - 0x18], eax
jne 0x4b1b19
mov esi, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x30]
sub esi, ebx
mov eax, dword [edi]
mov dword [ebp - 0x34], esi
test eax, eax
je 0x4b1b19
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x4b1b19
push 0
lea ecx, [ebp - 0x18]
push ecx
push 4
lea ecx, [ebp - 0x34]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4b1b19
cmp dword [ebp - 0x18], 4
jne 0x4b1b19
cmp ebx, dword [ebp - 0x2c]
je 0x4b1af1
lea eax, [ebp - 0x18]
mov ecx, edi
push eax
push esi
push ebx
call fcn.00418c00
test al, al
je 0x4b1b19
cmp dword [ebp - 0x18], esi
jne 0x4b1b19
lea eax, [ebp - 0x64]
xorps xmm0, xmm0
push eax
mov ecx, edi
movlpd qword [ebp - 0x64], xmm0
call fcn.00418c80
test al, al
je 0x4b1b15
push dword [ebp - 0x60]
mov ecx, edi
push dword [ebp - 0x64]
call fcn.00418e10
mov bl, 1
jmp 0x4b1b1b
xor bl, bl
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.00422450
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x5c]
call fcn.004b1dd0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00422450
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004c35a5
mov esp, ebp
pop ebp
ret 4
Function at 0x4b1c80
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x500b18
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x53b098]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ecx, eax
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
push 0x80
push dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
push dword [ebp + 0x14]
push esi
push edi
call fcn.00418ad0
mov bl, al
test bl, bl
jne 0x4b1dab
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, 0x50000000
je 0x4b1d5e
call eax
cmp eax, 5
jne 0x4b1d59
push 0x80
mov ecx, edi
call fcn.00404c20
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
call ebx
test eax, eax
jne 0x4b1d3e
lea ecx, [ebp - 0x28]
call fcn.00404d40
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
mov ecx, edi
call fcn.0041da10
test al, al
je 0x4b1d2f
push 0x80
lea ecx, [ebp - 0x28]
call fcn.00404c20
push eax
call ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004049a0
mov ecx, dword [ebp - 0x2c]
push 0x80
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
push edi
call fcn.00418ad0
mov bl, al
test bl, bl
jne 0x4b1dab
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
cmp eax, 0x21
je 0x4b1d6a
cmp eax, 0x20
jne 0x4b1dab
xor esi, esi
nop dword [eax]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x2c]
push 0x80
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
call fcn.00418ad0
mov bl, al
test bl, bl
jne 0x4b1dab
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x21
je 0x4b1da5
cmp eax, 0x20
jne 0x4b1dab
inc esi
cmp esi, 0x28
jb 0x4b1d70
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c35a5
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4ba4d0
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x53b098]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x4ba535
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4ba510
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4ba535
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.004c35a5
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.004c35a5
add esp, 8
ret 4