joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b6440
Capabilities:
Hash data using murmur3
Read file via mapping

Disassembly:
not edi
xor edx, 0x45611cf2
ror eax, 9
add esi, 0xd0152bc7
xchg eax, esi
add esi, edi
not edi
call fcn.00522d1d
sub eax, 0xe17cb328
rol ebx, 6
sub ecx, esi
add ecx, 0xaea740da
xor edi, esi
call fcn.004acade
xor edi, esi
sub ecx, 0xaea740da
add ecx, esi
ror ebx, 6
add eax, 0xe17cb328
call fcn.004d06ee
not edi
sub esi, edi
xchg eax, esi
sub esi, 0xd0152bc7
rol eax, 9
push edx
sub edx, 0x59f0c536
call fcn.004ae27e
inc esi
xor esi, esp
inc edx
inc edx
xchg edx, esi
call fcn.0051f316
ror esi, 0x1f
inc edi
add eax, ebp
ror esi, 0x1e
rol esi, 0x1e
invalid

Function at 0x4b6580
Capabilities:
Hash data using murmur3
Read file via mapping

Disassembly:
pop edx
xchg esi, eax
sub eax, 0x35de621d
rol ebx, 3
neg ecx
sub eax, 0xd45ae4d
xor esi, ebp
call fcn.004d31e4
call fcn.004f1149
xor esi, ebp
add eax, 0xd45ae4d
neg ecx
ror ebx, 3
add eax, 0x35de621d
xchg esi, eax
add esi, 0x5a4bf7aa
call fcn.004d0cae
neg edi
xchg ebx, eax
add esi, eax
not ebx
xor eax, 0xad6b40f7
not esi
ror ebx, 4
neg esi
inc eax
inc ebx
xor ecx, 0x7b71a9fe
xchg ecx, eax
sub esi, ebx
call fcn.004a7b1d
inc edx
ror edx, 0xd
call fcn.004f797a
neg eax
ror ebx, 8
rol ebx, 8
neg eax
call fcn.004be6b7
rol edx, 0xd
dec edx
add esi, ebx
xchg ecx, eax
xor ecx, 0x7b71a9fe
dec ebx
dec eax
neg esi
rol ebx, 4
not esi
sub eax, 0x8e11ae27
xor edi, 0x918f33df
inc esi
sub edx, 0x8f257826
dec ebx
not ebx
xor ebx, eax
xchg ebx, edx
xor edi, eax
call fcn.004d2f00
dec edx
call fcn.004c1f32
xor ebx, 0xd57eb163
neg ecx
call fcn.004ec939
rol ecx, 6
xor ebx, 0xc0720155
xor edi, ebx
xchg ecx, edx
call fcn.004e9f67
xchg edi, esi
xchg edi, eax
xchg edi, eax
xchg edi, esi
call fcn.0051a884
xchg ecx, edx
xor edi, ebx
xor ebx, 0xc0720155
ror ecx, 6
call fcn.004db8e4
neg ecx
xor ebx, 0xd57eb163
call fcn.004bc8d3
inc edx
xor edi, eax
xchg ebx, edx
xor ebx, eax
not ebx
inc ebx
add edx, 0x8f257826
dec esi
xor edi, 0x918f33df
push eax
inc esi
rol ebx, 0x1c
xor ecx, ebp
not ecx
call fcn.00539b83
xor esi, ecx
xchg esi, eax
rol eax, 7
call fcn.004bc8d3
xchg edi, eax
xor eax, 0xf4d745e0
add edi, eax
xor ecx, 0x2db3e2f1
xchg esi, eax
xor ecx, esp
ror edx, 0x13
call fcn.0052665e
xchg eax, edx
inc ecx
dec ecx
xchg eax, edx
call fcn.004f2c20
rol edx, 0x13
xor ecx, esp
xchg esi, eax
xor ecx, 0x2db3e2f1
sub edi, eax
invalid
invalid

Function at 0x4b6a30
Capabilities:
Hash data using murmur3
Read file via mapping

Disassembly:
sub edx, ecx
ror edx, 0x1c
call fcn.00517a4b
xor edx, eax
xor edx, 0xf5ceff37
xchg edi, edx
inc ebx
call fcn.004ae86d
neg ebx
inc ecx
call fcn.00501306
dec ecx
neg ebx
dec ebx
xchg edi, edx
xor edx, 0xf5ceff37
xor edx, eax
call fcn.004f196a
rol edx, 0x1c
add edx, ecx
rol ecx, 0x10
ror esi, 8
inc edi
dec ebx
neg edi
sub edx, 0xf48127e6
inc edi
dec esi
invalid
loopne 0x4b6a16
push ss
Function at 0x4b6b20
Capabilities:
Hash data using murmur3
Read file via mapping

Disassembly:
xor esi, ebp
inc edx
push eax
not edi
call fcn.00516af9
ror edi, 0x16
dec ebx
xchg edi, edx
ror esi, 0x13
inc ecx
xchg edi, eax
neg edx
dec ebx
add ecx, 0xe1f8d76b
xor ebx, 0x16351ccf
not edx
xor ebx, edi
neg edx
rol esi, 0x1d
xor edi, 0x1396a539
not ebx
call fcn.004e9f67
not ebx
xor edi, 0x1396a539
ror esi, 0x1d
neg edx
xor ebx, edi
not edx
xor ebx, 0x16351ccf
sub ecx, 0xe1f8d76b
inc ebx
neg edx
xchg edi, eax
dec ecx
rol esi, 0x13
xchg edi, edx
inc ebx
rol edi, 0x16
not edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
not esi
sub ecx, ebp
xor ecx, 0x96afe800
sub ebx, edi
xchg edx, esi
sub edx, edi
ror eax, 8
dec eax
rol esi, 2
not edi
add edi, ecx
sub esi, 0x32021d1b
rol ebx, 7
add edi, 0x653c9707
call fcn.00549dc0
not ebx
call fcn.004c0fd2
call fcn.00525223
not ebx
sub edi, 0x653c9707
ror ebx, 7
add esi, 0x32021d1b
sub edi, ecx
not edi
ror esi, 2
inc eax
rol eax, 8
add edx, edi
xchg edx, esi
add ebx, edi
xor ecx, 0x96afe800
add ecx, ebp
not esi
push ebx
add ecx, 0x7380b9c8
call fcn.00511b8d
add ecx, esp
inc esi
xchg edx, eax
sub ecx, 0xa396249e
call fcn.004fed40
xor eax, ebx
not esi
xor eax, 0x28df1257
xor esi, edx
ror edi, 0x1e
not edi
sub edx, eax
add edx, eax
not edi
rol edi, 0x1e
xor esi, edx
xor eax, 0x28df1257
not esi
xor eax, ebx
add ecx, 0xa396249e
xchg edx, eax
dec esi
sub ecx, esp
call fcn.004d1982
sub ecx, 0x7380b9c8
mov esi, 0x490e0a1b
dec esi
rol edx, 0xb
not esi
rol eax, 0x17
xor esi, edi
inc ecx
add esi, 0xbce4e169
sub ecx, edi
call fcn.00526abc
not esi
call fcn.00517e8f
rol edx, 0x1e
xchg edi, edx
call fcn.0051ef55
sub esi, 0xb8db30ee
call fcn.004bb92d
call fcn.004b97b9
add esi, 0xb8db30ee
xchg edi, edx
ror edx, 0x1e
not esi
add ecx, edi
sub esi, 0xbce4e169
dec ecx
xor esi, edi
ror eax, 0x17
not esi
ror edx, 0xb
inc esi
or esi, 0x8d8c531b
xor ecx, 0xd7dd41fb
dec ebx
call fcn.004f13aa
xor eax, 0xb2623c36
not esi
ror eax, 6
xchg eax, esi
xor ebx, esp
rol edx, 7
call fcn.004b5fd5
call fcn.00510e8d
ror edx, 7
xor ebx, esp
xchg eax, esi
rol eax, 6
not esi
xor eax, 0xb2623c36
call fcn.004b2f97
inc ebx
xor ecx, 0xd7dd41fb
add esi, 0x3271a4e5
dec esi
xor edi, ecx
call fcn.004acb9d
xor edi, 0x94d068c7
invalid
Function at 0x4b7070
Capabilities:
Hash data using murmur3
Read file via mapping

Disassembly:
add al, byte [ecx]
add byte [eax - 0x7f], al
sub byte [esi + 0x42], ch
stosd dword es:[edi], eax
Function at 0x4c0930
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xf8
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x78]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
add edx, dword [ecx + 0x20]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + 0x1c]
mov dword [ebp - 8], eax
mov dword [ebp - 0x24], 0
jmp 0x4c099c
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
cmp eax, dword [edx + 0x18]
jae 0x4c09e3
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.00514968
add esp, 8
test eax, eax
jne 0x4c09e1
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x4c09e5
jmp 0x4c0993
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4e5b50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4e5bb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0x4e5ba7
mov edx, dword [0x58f7e8]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4e5b9b
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4e5b80
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
jmp 0x4e5ba9
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x4e7e50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x555248
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x574f24]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x80], ecx
mov eax, dword [ebp - 0x80]
movsx ecx, byte [eax + 2]
test ecx, ecx
jne 0x4e7e96
movzx edx, byte [ebp + 0x10]
test edx, edx
jne 0x4e7e96
mov ecx, dword [ebp - 0x80]
call fcn.004e7d50
mov eax, dword [ebp - 0x80]
movzx ecx, byte [eax + 1]
test ecx, ecx
jne 0x4e7f66
mov edx, dword [ebp - 0x80]
movzx eax, byte [edx]
test eax, eax
jne 0x4e7f66
mov ecx, dword [ebp - 0x80]
cmp dword [ecx + 0x20c], 0
je 0x4e7f05
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax + 0x20c]
push ecx
call fcn.004f2800
add esp, 8
mov dword [ebp - 0x78], eax
push 0
mov edx, dword [ebp - 0x78]
push edx
push 0x186
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax + 0x20c]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [ebp - 0x80]
mov eax, dword [edx + 0x20c]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x4e7f66
movzx ecx, byte [ebp + 0x10]
test ecx, ecx
jne 0x4e7f66
mov edx, dword [ebp - 0x80]
add edx, 2
push edx
lea ecx, [ebp - 0x74]
call fcn.004ee180
mov dword [ebp - 4], 0
push 0x10001
lea eax, [ebp - 0x74]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004f25f0
add esp, 0x10
xor ecx, ecx
cmp eax, 2
sete cl
mov byte [ebp - 0x79], cl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.004a75d0
movzx edx, byte [ebp - 0x79]
test edx, edx
je 0x4e7f66
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050fa0e
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4ef370
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x555ff7
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x574f24]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.004ee260
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.004ee260
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.004ee260
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x44
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.004eec70
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.004eec70
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.004eec70
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x14], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0x1c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
mov dword [edx + 0x20], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
mov dword [edx + 0x24], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [edx + 0x28], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0x2c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x30]
mov word [edx + 0x30], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x32]
mov word [edx + 0x32], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x38]
mov dword [edx + 0x38], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov dword [edx + 0x3c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
mov dword [edx + 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4ef650
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5560e7
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x574f24]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.004ee180
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.004ee180
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.004ee180
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x44
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.004eec90
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xa4
call fcn.004eec90
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x104
call fcn.004eec90
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [edx + 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [edx + 0x14], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [edx + 0x18], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0x1c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
mov dword [edx + 0x20], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
mov dword [edx + 0x24], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
mov dword [edx + 0x28], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
mov dword [edx + 0x2c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x30]
mov word [edx + 0x30], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x32]
mov word [edx + 0x32], cx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x38]
mov dword [edx + 0x38], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov dword [edx + 0x3c], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x40]
mov dword [edx + 0x40], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4f14c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5568bd
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x574f24]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0x7c], 0x8000
mov dword [ebp - 0x78], 0x578668
mov byte [ebp - 0xa9], 0
lea eax, [ebp - 0xa9]
push eax
push 0x8000
lea ecx, [ebp - 0xa8]
call fcn.004c1e60
mov dword [ebp - 4], 1
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x74]
call fcn.004f0000
mov dword [ebp - 0xb4], eax
mov edx, dword [ebp - 0xb4]
mov dword [ebp - 0xb8], edx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0xb8]
call fcn.004ee990
push eax
push 0x8000
push 0
lea ecx, [ebp - 0xa8]
call fcn.004c1f40
push eax
mov eax, dword [ebp - 0x78]
push eax
mov ecx, dword [ebp + 0x14]
call fcn.004ee990
push eax
mov ecx, dword [ebp + 0x10]
call fcn.004ee990
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x74]
call fcn.004a75d0
push 0
lea ecx, [ebp - 0xa8]
call fcn.004c1f40
push eax
lea ecx, [ebp - 0x98]
call fcn.004a3390
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x78]
push ecx
lea edx, [ebp - 0x98]
push edx
call fcn.004f71e0
add esp, 8
movzx eax, al
test eax, eax
je 0x4f1608
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp + 0x18]
call fcn.004eecb0
mov edx, dword [ebp - 0xb0]
or edx, 1
mov dword [ebp - 0xb0], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x98]
call fcn.004a3420
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa8]
call fcn.004c1ee0
mov eax, dword [ebp + 8]
jmp 0x4f1667
lea eax, [ebp - 0x98]
push eax
mov ecx, dword [ebp + 8]
call fcn.004f4c60
mov ecx, dword [ebp - 0xb0]
or ecx, 1
mov dword [ebp - 0xb0], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x98]
call fcn.004a3420
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa8]
call fcn.004c1ee0
mov eax, dword [ebp + 8]
jmp 0x4f1667
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050fa0e
mov esp, ebp
pop ebp
ret
Function at 0x4f1d50
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x556a91
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x574f24]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
call fcn.004ee990
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x4f1e06
mov byte [ebp - 0x21], 0
lea eax, [ebp - 0x21]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 2
push ecx
lea ecx, [ebp - 0x20]
call fcn.004c1e60
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x10]
add edx, 1
push edx
push 0
lea ecx, [ebp - 0x20]
call fcn.004c1f40
push eax
mov ecx, dword [ebp + 0xc]
call fcn.004ee990
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0
lea ecx, [ebp - 0x20]
call fcn.004c1f40
push eax
mov ecx, dword [ebp + 8]
call fcn.004a3390
mov eax, dword [ebp - 0x28]
or eax, 1
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.004c1ee0
mov eax, dword [ebp + 8]
jmp 0x4f1e25
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004b86f0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x28]
or edx, 1
mov dword [ebp - 0x28], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x4f2270
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x556b91
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x574f24]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], 0
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x4f2318
mov byte [ebp - 0x21], 0
lea ecx, [ebp - 0x21]
push ecx
mov edx, dword [ebp - 0x10]
add edx, 1
push edx
lea ecx, [ebp - 0x20]
call fcn.004c1e60
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x10]
add eax, 1
push eax
push 0
lea ecx, [ebp - 0x20]
call fcn.004c1f40
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0
lea ecx, [ebp - 0x20]
call fcn.004c1f40
push eax
mov ecx, dword [ebp + 8]
call fcn.004a3390
mov edx, dword [ebp - 0x28]
or edx, 1
mov dword [ebp - 0x28], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.004c1ee0
mov eax, dword [ebp + 8]
jmp 0x4f2333
mov ecx, dword [ebp + 8]
call fcn.004b7bd0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x28]
or eax, 1
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4f2d90
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x556e21
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x574f24]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], 0
push 0
push 0
push 0xe
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x21], 0
lea ecx, [ebp - 0x21]
push ecx
mov edx, dword [ebp - 0x10]
add edx, 1
push edx
lea ecx, [ebp - 0x20]
call fcn.004c1e60
mov dword [ebp - 4], 1
push 0
lea ecx, [ebp - 0x20]
call fcn.004c1f40
push eax
mov eax, dword [ebp - 0x10]
add eax, 1
push eax
push 0xd
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
lea ecx, [ebp - 0x20]
call fcn.004c1f40
push eax
mov ecx, dword [ebp + 8]
call fcn.004a3390
mov edx, dword [ebp - 0x28]
or edx, 1
mov dword [ebp - 0x28], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.004c1ee0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
Function at 0x5041e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x558d40
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x574f24]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], 0
push 0x578ca0
lea ecx, [esp + 0x10]
mov dword [esp + 0x3c], 0
mov dword [esi], 0x578d80
call fcn.004ba870
mov byte [esp + 0x38], 1
call fcn.005033b4
lea ecx, [esp + 0xc]
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
mov byte [esp + 0x38], 0
call fcn.004ba940
mov dword [esi], 0x578da4
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret
Function at 0x509200
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x55964b
mov eax, dword fs:[0]
push eax
sub esp, 0x278
mov eax, dword [0x574f24]
xor eax, esp
mov dword [esp + 0x274], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x574f24]
xor eax, esp
push eax
lea eax, [esp + 0x28c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x29c]
mov ecx, dword [esp + 0x2a8]
mov ebx, dword [esp + 0x2a0]
mov esi, dword [esp + 0x2ac]
mov ebp, dword [esp + 0x2b0]
push 0xffffffffffffffff
xor edi, edi
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x2a8]
push edi
mov dword [esp + 0x20], ecx
xor edx, edx
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], edi
mov word [esp + 0x28], dx
call fcn.004b8a50
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x294], edi
cmp eax, edi
je 0x5092e4
mov edi, dword [esp + 0x30]
mov ecx, dword [esp + 0x1c]
mov edx, ecx
cmp edi, 8
jae 0x5092b1
lea edx, [esp + 0x1c]
cmp word [edx + eax*2 - 2], 0x5c
je 0x5092dd
mov edx, ecx
cmp edi, 8
jae 0x5092c4
lea edx, [esp + 0x1c]
cmp word [edx + eax*2 - 2], 0x2f
je 0x5092dd
cmp edi, 8
jae 0x5092d5
lea ecx, [esp + 0x1c]
cmp word [ecx + eax*2 - 2], 0x3a
jne 0x5092e4
mov edx, 0x578e74
jmp 0x5092e9
mov edx, 0x578e6c
mov eax, edx
lea edi, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x5092f0
sub eax, edi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x24]
call fcn.004c51b0
mov eax, dword [esp + 0x1c]
mov edi, 8
cmp dword [esp + 0x30], edi
jae 0x50931d
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x38]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebx], eax
cmp eax, 0xffffffff
jne 0x50937b
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], 0
call edi
cmp eax, 2
je 0x509350
call edi
cmp eax, 0x12
je 0x509350
call edi
mov esi, eax
jmp 0x509352
xor esi, esi
call fcn.0050e700
cmp dword [esp + 0x30], 8
mov edi, dword [esp + 0x14]
mov dword [edi], esi
mov dword [edi + 4], eax
jb 0x509374
mov edx, dword [esp + 0x1c]
push edx
call fcn.0050f506
add esp, 4
mov eax, edi
jmp 0x509401
lea eax, [esp + 0x64]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x509382
mov ecx, dword [esp + 0x18]
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x68]
push eax
call fcn.004c5270
mov eax, dword [esp + 0x38]
test eax, 0x400
je 0x5093ba
mov dword [esi], 0
mov dword [ebp], 0
jmp 0x5093da
test al, 0x10
je 0x5093cd
mov dword [esi], 3
mov dword [ebp], 3
jmp 0x5093da
mov dword [esi], 2
mov dword [ebp], 2
mov esi, dword [esp + 0x14]
mov dword [esi], 0
call fcn.0050e700
mov dword [esi + 4], eax
cmp dword [esp + 0x30], edi
jb 0x5093ff
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.0050f506
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x274]
xor ecx, esp
call fcn.0050fa0e
add esp, 0x284
ret