joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dcbc0
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [0x634ba4]
test eax, eax
jne 0x4dcccc
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x8001
mov dword [0x634ba4], 1
call edi
push str.imm32.dll
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push ebx
mov esi, eax
call edi
test esi, esi
je 0x4dccc9
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ImmGetContext
push esi
call edi
test eax, eax
mov dword [0x634ba8], eax
je 0x4dccc9
push str.ImmReleaseContext
push esi
call edi
test eax, eax
mov dword [0x634bac], eax
je 0x4dccc9
push str.ImmSetCompositionWindow
push esi
call edi
test eax, eax
mov dword [0x634bb0], eax
je 0x4dccc9
push str.ImmSetCompositionFontA
push esi
call edi
test eax, eax
mov dword [0x634bb4], eax
je 0x4dccc9
push str.ImmGetCompositionStringW
push esi
call edi
push str.ImmGetOpenStatus
push esi
mov dword [0x634bb8], eax
call edi
push str.ImmSetOpenStatus
push esi
mov dword [0x634bbc], eax
call edi
push str.ImmGetConversionStatus
push esi
mov dword [0x634bc0], eax
call edi
push str.ImmSetConversionStatus
push esi
mov dword [0x634bc4], eax
call edi
push str.ImmSetCompositionStringW
push esi
mov dword [0x634bc8], eax
call edi
push str.ImmNotifyIME
push esi
mov dword [0x634bcc], eax
call edi
push str.ImmGetCandidateListW
push esi
mov dword [0x634bd0], eax
call edi
mov dword [0x634bd4], eax
mov dword [0x634ba4], 2
pop edi
pop esi
pop ebx
ret

Function at 0x4dccd0
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
sub esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 7
lea ecx, [esp + 0xc]
push ecx
movzx eax, ax
push 0x1004
push eax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x4dcd1a
push esi
push 0xa
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
call fcn.004a47c0
add esp, 0x10
test eax, eax
mov eax, dword [esp + 4]
jne 0x4dcd1c
mov eax, esi
pop esi
add esp, 0xc
ret
Function at 0x4dcdc0
Capabilities:
Get keyboard layout

Disassembly:
mov eax, dword [0x634ba4]
sub esp, 8
test eax, eax
push edi
mov edi, str.UNKNOWN
jne 0x4dcdd7
call fcn.004dcbc0
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
cmp dword [0x634ba4], 2
jne 0x4dcef8
mov eax, dword [0x634bc4]
test eax, eax
je 0x4dcef8
mov eax, dword [esp + 0x10]
push esi
push eax
call dword [0x634ba8]
mov esi, eax
test esi, esi
je 0x4dcef7
push ebx
call fcn.004dccd0
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push esi
mov ebx, eax
call dword [0x634bc4]
test eax, eax
je case.0x4dce70.17
mov eax, dword [esp + 0xc]
cmp eax, 0x400
jbe 0x4dce40
sub eax, 0x400
lea ecx, [ebx - 0x3a4]
cmp ecx, 0x12
ja case.0x4dce70.17
movzx ecx, byte [ecx + 0x4dcf10]
jmp dword [ecx*4 + 0x4dcf00]
add eax, 0xfffffff0
cmp eax, 0xb
ja case.0x4dce70.17
movzx edx, byte [eax + 0x4dcf3c]
jmp dword [edx*4 + 0x4dcf24]
pop ebx
mov edi, 0x5e23cc
pop esi
mov eax, edi
pop edi
add esp, 8
ret
pop ebx
mov edi, 0x5e23b4
pop esi
mov eax, edi
pop edi
add esp, 8
ret
pop ebx
mov edi, 0x5e239c
pop esi
mov eax, edi
pop edi
add esp, 8
ret
pop ebx
mov edi, 0x5e2388
pop esi
mov eax, edi
pop edi
add esp, 8
ret
cmp eax, 9
ja case.0x4dce70.17
movzx eax, byte [eax + 0x4dcf58]
jmp dword [eax*4 + 0x4dcf48]
pop ebx
mov edi, str.ALPHANUMERIC_HALF
pop esi
mov eax, edi
pop edi
add esp, 8
ret
pop ebx
mov edi, str.KOREAN
pop esi
mov eax, edi
pop edi
add esp, 8
ret
cmp eax, 9
ja case.0x4dce70.17
movzx ecx, byte [eax + 0x4dcf74]
jmp dword [ecx*4 + 0x4dcf64]
mov edi, str.CHINESE
pop ebx
pop esi
mov eax, edi
pop edi
add esp, 8
ret
Function at 0x4dd970
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push ebx
xor eax, eax
push esi
mov dword [esp + 0xc], eax
push edi
mov dword [esp + 0x14], eax
mov ecx, 0x10
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov dword [esp + 0x18], eax
mov al, byte [esp + 0x68]
xor bl, bl
test al, al
mov dword [esp + 0xc], 0
mov dword [esp + 0x1c], 0x44
je 0x4dd9b8
mov dword [esp + 0x48], 1
mov word [esp + 0x4c], 5
mov ecx, dword [esp + 0x64]
push ecx
call fcn.0043a540
mov esi, eax
add esp, 4
test esi, esi
je 0x4dda10
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
push esi
setne bl
call fcn.0043f0a0
add esp, 4
test bl, bl
je 0x4dda10
mov ecx, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call esi
pop edi
pop esi
mov al, bl
pop ebx
add esp, 0x54
ret
Function at 0x4df2c0
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push esi
lea eax, [esp + 4]
push eax
mov esi, str.Windows
mov dword [esp + 8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x14]
dec eax
je 0x4df345
dec eax
jne 0x4df363
mov eax, dword [esp + 8]
cmp eax, 6
jne 0x4df301
mov esi, str.Windows_Vista
mov eax, esi
pop esi
add esp, 0x94
ret
cmp eax, 5
jne 0x4df331
mov eax, dword [esp + 0xc]
cmp eax, 1
jne 0x4df31e
mov esi, str.Windows_XP
mov eax, esi
pop esi
add esp, 0x94
ret
test eax, eax
jne 0x4df363
mov esi, str.Windows_2000
mov eax, esi
pop esi
add esp, 0x94
ret
cmp eax, 4
jne 0x4df363
mov esi, str.Windows_NT
mov eax, esi
pop esi
add esp, 0x94
ret
mov eax, dword [esp + 0xc]
test eax, eax
jbe 0x4df35c
mov esi, str.Windows_98_ME
mov eax, esi
pop esi
add esp, 0x94
ret
jne 0x4df363
mov esi, str.Windows_95
mov eax, esi
pop esi
add esp, 0x94
ret

Function at 0x4dfaf0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x44
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x24]
dec eax
push 0x1c
not eax
lea ecx, [esp + 4]
lea edx, [esp + 8]
and eax, ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov ecx, dword [esp + 8]
sub eax, 0x1c
neg eax
sbb eax, eax
not eax
and eax, ecx
add esp, 0x44
ret

Function at 0x4dfbc0
Capabilities:
Identify system language via api

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x64
cmp eax, 7
jl 0x4dfc18
push esi
lea ecx, [esp + 4]
call fcn.004de850
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4dfbe2
call eax
jmp 0x4dfbe8
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov esi, eax
mov eax, dword [esp + 8]
test eax, eax
je 0x4dfbfe
cmp eax, 0xffffffff
je 0x4dfbfe
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test si, si
je 0x4dfc11
push esi
call fcn.004df370
add esp, 4
pop esi
add esp, 0x64
ret
xor eax, eax
pop esi
add esp, 0x64
ret
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
push eax
call fcn.004df370
add esp, 4
add esp, 0x64
ret
Function at 0x4e20a0
Capabilities:
Create thread
Extract resource via kernel32 functions
Identify system language via api

Disassembly:
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0xd3c]
test eax, eax
je 0x4e2110
mov eax, dword [edi]
call dword [eax + 0xe4]
test eax, eax
jne 0x4e20c9
mov dword [edi + 0x6c8], 1
pop edi
pop esi
ret 0xc
mov esi, dword [edi + 0xd3c]
mov dword [esi + 0x18], eax
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0xe8]
mov dword [esi + 0x1c], eax
mov dword [edi + 0xd3c], 0
lea eax, [esp + 0x14]
push eax
push 0
push esi
push 0x4e04c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x4e210b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
ret 0xc
push 0x20
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x4e210b
mov eax, dword [esp + 0xc]
push eax
call fcn.0043a540
mov ecx, dword [esp + 0x14]
push ecx
mov dword [esi], eax
call fcn.0043a540
mov dl, byte [esp + 0x1c]
add esp, 8
mov dword [esi + 4], eax
mov byte [esi + 8], dl
call fcn.004df210
mov byte [esi + 9], al
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xec]
mov dword [esi + 0x14], eax
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0xe4]
mov dword [esi + 0x18], eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xe8]
mov ecx, edi
mov dword [esi + 0x1c], eax
call fcn.004df710
test al, al
je 0x4e2188
mov ecx, dword [edi + 0xc64]
mov dword [esi + 0xc], ecx
jmp 0x4e218f
mov dword [esi + 0xc], 0
mov edx, dword [edi]
push ebx
push ebp
mov ecx, edi
call dword [edx + 0xec]
mov ebx, eax
call fcn.004df210
test al, al
mov ebp, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
je 0x4e21d5
call ebp
and eax, 0x3ff
mov dword [esp + 0x1c], eax
call ebp
mov ecx, dword [esp + 0x1c]
and eax, 0xfc00
or ecx, eax
push ecx
push 0x238d
push 5
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
jmp 0x4e21fc
call ebp
and eax, 0x3ff
mov dword [esp + 0x1c], eax
call ebp
mov ecx, dword [esp + 0x1c]
and eax, 0xfc00
or ecx, eax
push ecx
push 0x238d
push 5
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
pop ebp
mov dword [esi + 0x10], eax
pop ebx
je 0x4e210b
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x4e20e9
mov dword [edi + 0xd3c], esi
mov dword [edi + 0x6c8], 1
pop edi
pop esi
ret 0xc

Function at 0x4e30b0
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
xor eax, eax
test esi, esi
mov ecx, esi
je 0x4e30e3
lea esp, [esp]
mov dl, byte [ecx]
inc ecx
test dl, dl
je 0x4e30e3
cmp eax, 0x104
jge 0x4e30e3
inc eax
test ecx, ecx
jne 0x4e30d0
add eax, esi
pop esi
ret
Function at 0x4e4470
Capabilities:
Get file attributes

Disassembly:
push ecx
mov eax, dword [ecx + 0x40]
push ebx
xor ebx, ebx
test eax, eax
push esi
mov dword [esp + 8], ebx
je 0x4e4489
mov ecx, dword [esp + 0x10]
push ecx
call eax
jmp 0x4e44a5
mov edx, dword [esp + 0x10]
push edx
lea ecx, [esp + 0x14]
mov ebx, 1
call fcn.004e4300
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test bl, 1
mov esi, eax
je 0x4e44b9
mov eax, dword [esp + 0x10]
push eax
call fcn.0043f0a0
add esp, 4
mov eax, esi
pop esi
pop ebx
pop ecx
ret 4

Function at 0x4e44d0
Capabilities:
Create directory

Disassembly:
push ecx
mov eax, dword [ecx + 0xc]
push ebx
xor ebx, ebx
test eax, eax
push esi
mov dword [esp + 8], ebx
je 0x4e44ea
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call eax
jmp 0x4e4508
mov edx, dword [esp + 0x10]
push edx
lea ecx, [esp + 0x14]
mov ebx, 1
call fcn.004e4300
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test bl, 1
mov esi, eax
je 0x4e451c
mov eax, dword [esp + 0x10]
push eax
call fcn.0043f0a0
add esp, 4
mov eax, esi
pop esi
pop ebx
pop ecx
ret 4

Function at 0x4e4530
Capabilities:
Delete file

Disassembly:
push ecx
mov eax, dword [ecx + 0x18]
push ebx
xor ebx, ebx
test eax, eax
push esi
mov dword [esp + 8], ebx
je 0x4e4549
mov ecx, dword [esp + 0x10]
push ecx
call eax
jmp 0x4e4565
mov edx, dword [esp + 0x10]
push edx
lea ecx, [esp + 0x14]
mov ebx, 1
call fcn.004e4300
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test bl, 1
mov esi, eax
je 0x4e4579
mov eax, dword [esp + 0x10]
push eax
call fcn.0043f0a0
add esp, 4
mov eax, esi
pop esi
pop ebx
pop ecx
ret 4

Function at 0x4e46c0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebp
push 0x8000000
push 3
push 1
push closesocket
push eax
mov byte [esp + 0x1b], 0
call fcn.004e43f0
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4e4785
push esi
push edi
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [esp + 0x18]
mov ecx, dword [esi]
push ecx
mov edi, eax
call fcn.0043f0a0
add esp, 4
test edi, edi
je 0x4e4715
push edi
call fcn.0043f080
add esp, 4
jmp 0x4e4717
xor eax, eax
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edi
test eax, eax
mov dword [esi], eax
mov dword [esi + 4], ecx
je 0x4e477c
push 0
lea edx, [esp + 0x18]
push edx
push ecx
push eax
push ebp
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4e4764
mov eax, dword [esi + 4]
cmp eax, dword [esp + 0x14]
jne 0x4e4764
push ebp
mov byte [esp + 0x13], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebp
pop ecx
ret 8
mov ecx, dword [esi]
push ecx
call fcn.0043f0a0
add esp, 4
mov dword [esi], 0
mov dword [esi + 4], 0
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, byte [esp + 7]
pop ebp
pop ecx
ret 8
Function at 0x4e4c60
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x210
push esi
mov esi, ecx
mov eax, dword [esi + 0x9c]
test eax, eax
push edi
jne 0x4e4d6e
mov eax, dword [esi + 0x80]
test eax, eax
je 0x4e4cbe
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push 0x1a
push 0
call eax
cmp eax, 0x80070057
je 0x4e4d3f
push 0x5daafc
lea edx, [esp + 0x14]
push edx
mov ecx, esi
call fcn.004e4370
mov dword [esi + 0x9c], eax
jmp 0x4e4d3f
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push closesocket
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4e4d3f
mov byte [esp + 0x10], al
mov ecx, 0x40
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
stosw word es:[edi], ax
push 0
push 0
stosb byte es:[edi], al
mov eax, dword [esp + 0x18]
push str.AppData
push eax
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4e4d34
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.004e4800
mov dword [esi + 0x9c], eax
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [esi + 0x9c]
test edi, edi
je 0x4e4d6e
push edi
call fcn.005d2b4d
add esp, 4
test eax, eax
jbe 0x4e4d6e
mov cx, word [edi + eax*2 - 2]
cmp cx, 0x2f
je 0x4e4d67
cmp cx, 0x5c
jne 0x4e4d6e
mov word [edi + eax*2 - 2], 0
mov eax, dword [esi + 0x9c]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4e4f30
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
push ebp
mov ebx, ecx
mov eax, dword [ebx + 0x90]
test eax, eax
push esi
push edi
je 0x4e4f89
mov ecx, dword [ebx + 0x94]
test ecx, ecx
je 0x4e4f89
mov ebp, dword [esp + 0x18]
lea ecx, [esp + 0x18]
push ecx
push ebp
call eax
mov esi, eax
test esi, esi
je 0x4e4fe5
push esi
call fcn.0043f080
mov edi, eax
add esp, 4
test edi, edi
je 0x4e4fe5
push edi
push esi
push 0
push ebp
call dword [ebx + 0x94]
test eax, eax
je 0x4e4fe5
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
mov edx, dword [esp + 0x18]
push edx
lea ecx, [esp + 0x1c]
call fcn.004e4300
mov ebx, dword [esp + 0x18]
lea eax, [esp + 0x10]
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x4e4fdc
push esi
call fcn.0043f080
mov edi, eax
add esp, 4
test edi, edi
je 0x4e4fdc
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4e4fdc
push ebx
call fcn.0043f0a0
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
push ebx
call fcn.0043f0a0
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 4
Function at 0x4e5550
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x14], ecx
push edi
lea ecx, [esp + 0x20]
mov byte [esp + 0x17], 0
xor ebp, ebp
xor esi, esi
call fcn.004e4300
mov eax, dword [eax]
push eax
call fcn.004402b0
mov bl, al
mov eax, dword [esp + 0x20]
push eax
call fcn.0043f0a0
add esp, 8
test bl, bl
je 0x4e5648
push 0x5daafc
push edi
mov edi, dword [esp + 0x1c]
mov ecx, edi
call fcn.004e4370
mov ebp, eax
test ebp, ebp
je 0x4e5648
mov ax, word [ebp]
test ax, ax
mov ecx, ebp
je 0x4e55d3
cmp ax, 0x41
jb 0x4e55c7
cmp ax, 0x5a
ja 0x4e55c7
add word [ecx], 0x20
mov ax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x4e55b7
push 0x5daafc
push str.MacromediaMutexGamma
mov ecx, edi
call fcn.004e4370
mov esi, eax
test esi, esi
je 0x4e5648
push ebp
push esi
mov ecx, edi
call fcn.004e4370
push esi
mov edi, eax
call fcn.0043f0a0
add esp, 4
push edi
lea ecx, [esp + 0x20]
mov esi, edi
call fcn.004e4300
mov eax, dword [eax]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, dword [esp + 0x1c]
push ecx
mov edi, eax
call fcn.0043f0a0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4e5638
mov byte [esp + 0x13], 1
test edi, edi
je 0x4e5648
cmp edi, 0xffffffff
je 0x4e5648
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.0043f0a0
push ebp
call fcn.0043f0a0
mov al, byte [esp + 0x1b]
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4

Function at 0x4e5670
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x58
push ebx
push ebp
mov ebp, dword [esp + 0x64]
push esi
xor eax, eax
push edi
mov dword [esp + 0x18], eax
mov edi, ecx
mov dword [esp + 0x1c], eax
xor esi, esi
push ebp
lea ecx, [esp + 0x14]
xor bl, bl
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], eax
call fcn.004e4300
mov eax, dword [eax]
push eax
call fcn.004402b0
mov ecx, dword [esp + 0x14]
push ecx
mov byte [esp + 0x74], al
call fcn.0043f0a0
mov al, byte [esp + 0x74]
add esp, 8
test al, al
je 0x4e5774
push ebp
mov ecx, edi
call fcn.004e4ff0
mov esi, eax
test esi, esi
je 0x4e5774
mov edx, dword [edi + 0x14]
xor eax, eax
test edx, edx
lea edi, [esp + 0x28]
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov dword [esp + 0x24], 0x44
je 0x4e5712
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push esi
call edx
test eax, eax
setne bl
jmp 0x4e574f
push esi
lea ecx, [esp + 0x70]
call fcn.004e4300
mov eax, dword [eax]
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edx, dword [esp + 0x6c]
test eax, eax
push edx
setne bl
call fcn.0043f0a0
add esp, 4
test bl, bl
je 0x4e5774
mov eax, dword [esp + 0x14]
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov ecx, dword [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call edi
mov edx, dword [esp + 0x18]
push edx
call edi
push esi
call fcn.0043f0a0
add esp, 4
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x58
ret 4
Function at 0x4e6770
Capabilities:
Get common file path

Disassembly:
sub esp, 0x410
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x4e67e1
mov ecx, dword [eax + 0x54]
test ecx, ecx
je 0x4e67e1
mov ecx, dword [eax + 0x58]
test ecx, ecx
je 0x4e67e1
lea ecx, [esp + 0x20c]
push ecx
push 0x104
call dword [eax + 0x54]
test eax, eax
jbe 0x4e6833
mov edx, dword [esi + 4]
lea eax, [esp + 4]
push eax
push 0
push str.flash
lea ecx, [esp + 0x218]
push ecx
call dword [edx + 0x58]
test eax, eax
jbe 0x4e6833
mov ecx, dword [esp + 0x418]
lea edx, [esp + 4]
push edx
call fcn.00438e90
mov al, 1
pop esi
add esp, 0x410
ret 4
lea eax, [esp + 4]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jbe 0x4e6833
lea ecx, [esp + 0x20c]
push ecx
push 0
push 0x5e3cf8
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jbe 0x4e6833
mov ecx, dword [esp + 0x418]
lea eax, [esp + 0x20c]
push eax
call fcn.00438df0
mov al, 1
pop esi
add esp, 0x410
ret 4
xor al, al
pop esi
add esp, 0x410
ret 4

Function at 0x4e6776
Capabilities:
Get common file path

Disassembly:
sub esp, 0x410
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x4e67e1
mov ecx, dword [eax + 0x54]
test ecx, ecx
je 0x4e67e1
mov ecx, dword [eax + 0x58]
test ecx, ecx
je 0x4e67e1
lea ecx, [esp + 0x20c]
push ecx
push 0x104
call dword [eax + 0x54]
test eax, eax
jbe 0x4e6833
mov edx, dword [esi + 4]
lea eax, [esp + 4]
push eax
push 0
push str.flash
lea ecx, [esp + 0x218]
push ecx
call dword [edx + 0x58]
test eax, eax
jbe 0x4e6833
mov ecx, dword [esp + 0x418]
lea edx, [esp + 4]
push edx
call fcn.00438e90
mov al, 1
pop esi
add esp, 0x410
ret 4
lea eax, [esp + 4]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jbe 0x4e6833
lea ecx, [esp + 0x20c]
push ecx
push 0
push 0x5e3cf8
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jbe 0x4e6833
mov ecx, dword [esp + 0x418]
lea eax, [esp + 0x20c]
push eax
call fcn.00438df0
mov al, 1
pop esi
add esp, 0x410
ret 4
xor al, al
pop esi
add esp, 0x410
ret 4

Function at 0x4e6870
Capabilities:
Get common file path

Disassembly:
mov eax, dword [ecx + 4]
sub esp, 0x230
push ebx
xor bl, bl
test eax, eax
je 0x4e68b5
mov ecx, dword [eax + 0x30]
test ecx, ecx
je 0x4e68b5
push 0x105
lea ecx, [esp + 8]
push ecx
call dword [eax + 0x30]
test eax, eax
je 0x4e68e6
mov ecx, dword [esp + 0x238]
lea edx, [esp + 4]
push edx
call fcn.00438e90
mov al, 1
pop ebx
add esp, 0x230
ret 4
push 0x105
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4e68e6
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 0x23c]
call fcn.00438df0
mov al, 1
pop ebx
add esp, 0x230
ret 4
mov al, bl
pop ebx
add esp, 0x230
ret 4
Function at 0x4e6900
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x68
push ebx
mov ebx, dword [esp + 0x70]
push ebp
xor eax, eax
push esi
mov dword [esp + 0x14], eax
push edi
mov ebp, ecx
mov dword [esp + 0x1c], eax
push ebx
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], 0
mov dword [esp + 0x24], eax
call fcn.00438d50
push 0
lea ecx, [esp + 0x28]
call fcn.004390d0
mov eax, dword [ebp + 4]
test eax, eax
je 0x4e69c5
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x4e69c5
xor eax, eax
mov ecx, 0x10
lea edi, [esp + 0x38]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], 0x44
call fcn.004e5ae0
mov esi, dword [eax]
push ebx
lea ecx, [esp + 0x80]
call fcn.004e5ae0
mov eax, dword [eax]
mov edx, dword [ebp + 4]
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x38]
push ecx
push esi
push 0
push 0
push 0
push 0
push 0
push 0
push eax
call dword [edx + 0x14]
mov edx, dword [esp + 0x7c]
test eax, eax
push edx
setne bl
call fcn.0043f0a0
mov eax, dword [esp + 0x14]
push eax
mov dword [esp + 0x84], 0
call fcn.0043f0a0
add esp, 8
jmp 0x4e6a0d
xor eax, eax
mov ecx, 0x10
lea edi, [esp + 0x38]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x3c], 0x44
call fcn.004391e0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, ebx
call fcn.004391e0
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
setne bl
test bl, bl
je 0x4e6a3c
mov eax, dword [esp + 0x80]
test eax, eax
jbe 0x4e6a28
push eax
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov ecx, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x18]
push edx
call esi
lea ecx, [esp + 0x24]
call fcn.00438ca0
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x68
ret 8