joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4944c0
Capabilities:
Enumerate disk volumes

Disassembly:
push 0xffffffffffffffff
push 0x55cdb6
mov eax, dword fs:[0]
push eax
sub esp, 0x26c
mov eax, dword [0x5b3890]
xor eax, esp
mov dword [esp + 0x268], eax
push ebx
push ebp
push esi
mov eax, dword [0x5b3890]
xor eax, esp
push eax
lea eax, [esp + 0x27c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x28c]
push 0x206
xor ebx, ebx
lea edx, [esp + 0x76]
xor ecx, ecx
push ebx
push edx
mov dword [esp + 0x30], eax
mov word [esp + 0x7c], cx
call fcn.00519500
add esp, 0xc
call fcn.004939b0
mov dword [esp + 0x28], eax
push 0x104
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov ebp, eax
or esi, 0xffffffff
cmp ebp, esi
jne 0x494553
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x49467a
or esi, 0xffffffff
mov byte [esp + 0x2c], bl
mov dword [esp + 0x6c], esi
lea ecx, [esp + 0x70]
push ecx
lea ecx, [esp + 0x30]
mov dword [esp + 0x288], ebx
call fcn.00492b20
cmp eax, ebx
je 0x49458d
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x284], esi
cmp eax, esi
je 0x494658
push eax
jmp 0x494652
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x6c]
push edx
push eax
push 0x492420
push esi
call fcn.00494190
add esp, 0x10
cmp eax, ebx
jle 0x494641
push 0x104
lea ecx, [esp + 0x18]
call fcn.0049f020
mov dword [esp + 0x14], vtable.cWCStr.0
mov byte [esp + 0x284], 1
mov dword [esp + 0x10], ebx
cmp byte [esp + 0x290], bl
je 0x494618
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push edx
push eax
lea ecx, [esp + 0x7c]
push ecx
call fcn.004bba30
add esp, 0x10
test eax, eax
je 0x494618
lea ecx, [esp + 0x14]
call fcn.0049e900
test al, al
jne 0x494618
mov edx, dword [edi]
mov eax, dword [esp + 0x18]
mov edx, dword [edx + 0xc]
push ebx
push 0xffffffffffffffff
push eax
jmp 0x494625
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push ebx
push 0xffffffffffffffff
lea ecx, [esp + 0x78]
push ecx
mov ecx, edi
call edx
lea ecx, [esp + 0x14]
mov byte [esp + 0x284], bl
mov dword [esp + 0x14], vtable.cWCS.0
call fcn.0049ee80
mov dword [esp + 0x284], 0xffffffff
cmp esi, 0xffffffff
je 0x494658
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x104
lea eax, [esp + 0x74]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
test eax, eax
jne 0x494550
push ebp
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
xor eax, eax
mov ecx, dword [esp + 0x27c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x268]
xor ecx, esp
call fcn.0051916c
add esp, 0x278
ret

Function at 0x495c30
Capabilities:
Hide graphical window

Disassembly:
cmp byte [esp + 4], 0
push esi
mov esi, ecx
je 0x495c4f
cmp byte [esi], 0
jne 0x495c62
mov eax, dword [esi + 4]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret 4
mov ecx, dword [esi + 4]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
sete dl
mov byte [esi], dl
pop esi
ret 4
Function at 0x496390
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x4963f1
mov eax, dword [esp + 0x24]
push esi
push edi
mov edi, dword [esp + 0x20]
push eax
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
test esi, esi
je 0x4963ef
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [esp + 0xc]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
push 2
lea edx, [esp + 0x10]
push edx
push edi
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x24]
push ebx
push eax
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawIcon]
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x497ec0
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x55d0e8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x5b3890]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x6c]
test eax, eax
je 0x497f20
dec dword [esi + 0x84]
cmp dword [esi + 0x84], 0
jg 0x497f36
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
test eax, eax
je 0x497f20
push 0
push eax
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + esi + 0x10]
push 0x111
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret 0xc
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x14]
call fcn.0049eff0
mov dword [esp + 0xc], vtable.cWCStr.0
mov eax, dword [esi + 0x84]
mov ecx, dword [esi + 0x78]
push eax
push ecx
lea edx, [esp + 0x14]
push 0x577a9c
push edx
mov dword [esp + 0x34], 0
call fcn.00401080
mov eax, dword [esp + 0x20]
mov ecx, dword [esi + 0x6c]
add esp, 0x10
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, dword [esi + 0x6c]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + esi + 0x10]
push 0x496740
push 0x3e8
push 0xbcd
push edx
call dword [sym.imp.USER32.dll_SetTimer]
mov edi, eax
lea ecx, [esp + 0xc]
mov dword [esi + 0x70], edi
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0xc], vtable.cWCS.0
call fcn.0049ee80
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret 0xc
Function at 0x499a40
Capabilities:
Create process on windows
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x55d1e8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebp
push esi
push edi
mov eax, dword [0x5b3890]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 0x78]
mov ebp, dword [esp + 0x30]
xor edi, edi
test ecx, ecx
jle 0x499a8c
mov eax, dword [esi + 0x7c]
movzx edx, bp
jmp 0x499a80
cmp dword [eax], edx
je 0x499ab5
inc edi
add eax, 4
cmp edi, ecx
jl 0x499a80
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + esi + 0x20]
push ebp
push edx
call dword [sym.imp.USER32.dll_EndDialog]
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x1c
ret 8
mov eax, dword [esi + 0x8c]
test eax, eax
je 0x499afe
cmp dword [eax + edi*4], 0
je 0x499afe
cmp byte [0x5b9040], 0
jne 0x499a9e
mov byte [0x5b9040], 1
mov ecx, dword [esi + 0x7c]
mov edx, dword [ecx + edi*4]
mov ecx, dword [esi + 0x10]
mov eax, dword [esi + 0x8c]
push edx
mov edx, dword [ecx + 4]
mov ecx, dword [edx + esi + 0x20]
mov edx, dword [eax + edi*4]
push ecx
call edx
add esp, 8
mov byte [0x5b9040], 0
jmp 0x499a9e
mov eax, dword [esi + 0x80]
xor ebp, ebp
test eax, eax
je 0x499b0d
mov ebp, dword [eax + edi*4]
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x18]
call fcn.0049eff0
mov dword [esp + 0x10], vtable.cWCStr.0
mov dword [esp + 0x28], 0
test ebp, ebp
jne 0x499b54
mov eax, dword [esi + 0x7c]
mov ecx, dword [eax + edi*4]
mov edx, dword [esi + 0x10]
mov eax, dword [edx + 4]
push ecx
mov ecx, dword [eax + esi + 0x20]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
lea ecx, [esp + 0x14]
call fcn.004b9f80
mov ebp, dword [esp + 0x14]
cmp word [ebp], 0x21
mov byte [esp + 0x30], 0
mov eax, str.open
jne 0x499b72
mov byte [esp + 0x30], 1
mov eax, str.runas
add ebp, 2
cmp word [ebp], 0x22
push 0
push 0
push 0
jne 0x499ba8
mov edx, dword [esp + 0x3c]
push 0
push 0
push 0
push 0
push 0
push edx
push 0
push 0
push 0
push 0
push ebp
call fcn.004bde50
add esp, 0x38
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x499bbb
push ebp
push eax
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + esi + 0x20]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x10], vtable.cWCS.0
call fcn.0049ee80
jmp 0x499a9e
Function at 0x49cbf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x55d4f0
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5b3890]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov edx, dword [eax]
call edx
mov ecx, dword [esp + 0x80]
xor ebx, ebx
cmp ecx, ebx
je 0x49ce09
mov eax, dword [esp + 0x84]
cmp eax, ebx
je 0x49ce09
movzx edx, byte [edi + 0x14]
push edx
push eax
push ecx
lea ecx, [esp + 0x50]
call fcn.00446270
mov dword [esp + 0x78], ebx
cmp byte [esp + 0x8c], bl
je 0x49cc61
mov byte [esp + 0x6c], 1
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x1c]
call fcn.0049eff0
mov dword [esp + 0x14], vtable.cWCStr.0
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x7c], 1
call fcn.00406b50
mov ebp, vtable.cWCS.0
test al, al
je 0x49cdbe
cmp byte [edi + 0x1c], bl
je 0x49cd32
lea ecx, [esp + 0x14]
call fcn.0049e970
cmp eax, ebx
je 0x49cd32
lea esi, [eax - 1]
push esi
lea ecx, [esp + 0x18]
call fcn.0049ead0
cmp ax, 0x5c
jne 0x49cd32
push esi
lea ecx, [esp + 0x18]
call fcn.0049f100
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x2c]
call fcn.0049eff0
mov dword [esp + 0x24], vtable.cWCStr.0
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x48]
mov byte [esp + 0x7c], 2
call fcn.00406b50
test al, al
je 0x49cd20
mov edx, dword [esp + 0x28]
push 0xffffffffffffffff
push edx
lea ecx, [esp + 0x1c]
call fcn.0049eeb0
lea ecx, [esp + 0x24]
mov byte [esp + 0x78], 1
mov dword [esp + 0x24], ebp
call fcn.0049ee80
cmp byte [edi + 0x1c], bl
jne 0x49cc9e
jmp 0x49cd32
lea ecx, [esp + 0x24]
mov byte [esp + 0x78], 1
mov dword [esp + 0x24], ebp
call fcn.0049ee80
mov eax, dword [esp + 0x88]
cmp eax, ebx
je 0x49cd89
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x3c]
call fcn.0049eff0
mov dword [esp + 0x34], vtable.cWCStr.0
mov eax, dword [esp + 0x18]
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x80], 3
call fcn.0049eeb0
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esp + 0x18]
call fcn.0049e930
lea ecx, [esp + 0x34]
mov byte [esp + 0x78], 1
mov dword [esp + 0x34], ebp
call fcn.0049ee80
mov edx, dword [edi]
mov eax, dword [esp + 0x18]
mov edx, dword [edx + 0x10]
push ebx
push eax
mov ecx, edi
call edx
test eax, eax
je 0x49cde7
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x48]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
call fcn.00406b50
test al, al
jne 0x49cc95
mov edi, dword [edi + 8]
lea ecx, [esp + 0x14]
mov byte [esp + 0x78], bl
mov dword [esp + 0x14], ebp
call fcn.0049ee80
lea ecx, [esp + 0x48]
mov dword [esp + 0x78], 0xffffffff
call fcn.00420ae0
mov eax, edi
jmp 0x49ce0b
lea ecx, [esp + 0x14]
mov byte [esp + 0x78], bl
mov dword [esp + 0x14], ebp
call fcn.0049ee80
lea ecx, [esp + 0x48]
mov dword [esp + 0x78], 0xffffffff
call fcn.00420ae0
xor eax, eax
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x68
ret 0x10
Function at 0x49e520
Capabilities:
Create thread
Resume thread

Disassembly:
sub esp, 0xc
push esi
push 8
call fcn.0051a2f5
mov esi, eax
add esp, 4
test esi, esi
je 0x49e595
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov dword [esi], eax
mov dword [esi + 4], ecx
test ecx, ecx
je 0x49e54a
call fcn.00414e80
push ebx
push edi
mov edi, dword [esp + 0x28]
xor ebx, ebx
test edi, edi
je 0x49e55b
mov ebx, 4
lea ecx, [esp + 0x14]
push ecx
push ebx
push esi
push 0x49e4d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esp + 0xc], eax
test eax, eax
jne 0x49e59d
mov edx, dword [esi + 4]
push edx
call fcn.0043e680
push esi
call fcn.0051964d
add esp, 8
pop edi
pop ebx
or eax, 0xffffffff
pop esi
add esp, 0xc
ret
or eax, 0xffffffff
pop esi
add esp, 0xc
ret
test edi, edi
je 0x49e5b1
push edi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_SetThreadToken]
mov eax, dword [esp + 0xc]
test bl, 4
je 0x49e5bd
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp + 0x14]
push str.cThreadPool::StartThread
push ecx
call fcn.004661d0
add esp, 8
cmp byte [esp + 0x24], 0
mov dword [esp + 0x10], 0
je 0x49e603
mov edx, dword [esp + 0xc]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [esp + 0x10], eax
test eax, eax
jne 0x49e603
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop edi
pop ebx
pop esi
add esp, 0xc
ret
Function at 0x49e680
Capabilities:
Get disk information
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x55d77b
mov eax, dword fs:[0]
push eax
sub esp, 0xe9c
mov eax, dword [0x5b3890]
xor eax, esp
mov dword [esp + 0xe98], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5b3890]
xor eax, esp
push eax
lea eax, [esp + 0xeb0]
mov dword fs:[0], eax
lea eax, [esp + 0x74]
push 0x104
xor ebx, ebx
push eax
mov ebp, ecx
mov dword [esp + 0x1c], ebx
call fcn.004b84f0
add esp, 8
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
push 1
mov dword [esp + 0x20], edi
mov byte [esp + 0x28], 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [esp + 0x28], eax
mov dword [esp + 0xeb8], ebx
cmp esi, 0xffffffff
je 0x49e803
push 0x618
lea ecx, [esp + 0x898]
push 0
push ecx
inc ebx
mov dword [esp + 0x2c], 0
call fcn.00519500
lea edx, [esp + 0x2c]
push edx
push 0x30c
lea eax, [esp + 0x290]
push eax
lea ecx, [esp + 0x8c]
push ecx
call fcn.004bba30
add esp, 0x1c
test eax, eax
je 0x49e7db
lea eax, [esp + 0x27c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x49e755
sub eax, edx
sar eax, 1
je 0x49e7db
lea edi, [esp + 0x18]
lea eax, [esp + 0x27c]
mov dword [esp + 0x18], 0
call fcn.0049e620
test al, al
je 0x49e793
mov ecx, dword [esp + 0x18]
mov edx, 1
shl edx, cl
not edx
and dword [esp + 0x1c], edx
mov eax, dword [ebp]
mov edx, dword [eax]
lea ecx, [esp + 0x27c]
push ecx
push ebx
mov ecx, ebp
call edx
test eax, eax
je 0x49e7db
add dword [esp + 0x14], eax
push 0
push 0x20
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x38]
push ecx
push 0
push 0
push 0
lea edx, [esp + 0x298]
push 0
push edx
mov dword [esp + 0x50], 0
call fcn.004b2f80
add esp, 0x24
push 0x104
lea eax, [esp + 0x78]
push eax
push esi
call fcn.004b85a0
add esp, 0xc
test eax, eax
jne 0x49e704
push esi
call fcn.004b8660
mov edi, dword [esp + 0x20]
add esp, 4
test edi, edi
je 0x49e856
xor esi, esi
lea esp, [esp]
mov edx, 1
mov ecx, esi
shl edx, cl
test edi, edx
je 0x49e850
mov ecx, dword [0x56f420]
mov eax, dword [0x56f41c]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x2c], eax
mov eax, dword [ebp]
lea ecx, [esp + 0x2c]
lea edx, [esi + 0x41]
push ecx
mov word [esp + 0x30], dx
mov edx, dword [eax]
inc ebx
push ebx
mov ecx, ebp
call edx
test eax, eax
je 0x49e850
add dword [esp + 0x14], eax
inc esi
cmp esi, 0x1a
jl 0x49e810
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xeb0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xe98]
xor ecx, esp
call fcn.0051916c
add esp, 0xea8
ret

Function at 0x49e8c0
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [esp + 4]
push esi
push eax
call fcn.00518c06
mov esi, eax
add esp, 4
test esi, esi
jne 0x49e8e1
push str.Assertion__Error_in_memory_allocation_
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, esi
pop esi
ret
Function at 0x49fdc0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push 0xffffffffffffffff
push 0x55d8d8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5b3890]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
push edi
push 0x58e864
push 1
push 0
push 0x58e934
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x49fe8d
mov eax, dword [esp + 0x20]
push eax
lea ecx, [esp + 0x10]
call fcn.0049fa90
mov eax, dword [eax]
mov dword [esp + 0x18], 0
test eax, eax
je 0x49fe22
mov ecx, dword [eax]
jmp 0x49fe24
xor ecx, ecx
mov eax, dword [edi]
mov edx, dword [eax]
push ebx
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
push eax
mov eax, dword [edx + 0xc]
call eax
lea ecx, [esp + 0xc]
mov esi, eax
mov dword [esp + 0x18], 0xffffffff
call fcn.0049fd70
test esi, esi
jge 0x49fe5a
mov edi, dword [edi]
mov ecx, dword [edi]
push edi
jmp 0x49fe86
mov eax, dword [ebx]
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push eax
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
mov esi, eax
test esi, esi
jge 0x49fe8b
mov eax, dword [ebx]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [edi]
mov ecx, dword [eax]
push eax
mov edx, dword [ecx + 8]
call edx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x4a0ce0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
push esi
mov esi, ecx
cmp dword [esi + 0x48], 0
je 0x4a0d0d
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esi + 0x48]
mov ecx, dword [esp + 0x20]
xor edx, edx
div ecx
test edx, edx
je 0x4a0d0d
inc eax
imul eax, ecx
mov dword [esi + 0x48], eax
mov eax, dword [esi + 0x30]
test eax, eax
je 0x4a0d2f
cmp dword [esi + 0x48], 0
jne 0x4a0d21
mov al, 1
pop esi
add esp, 0x24
ret
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 0x30], 0
mov edx, dword [esi + 0x40]
push edi
mov edi, dword [esi + 0x44]
mov ecx, edx
or ecx, edi
je 0x4a0d5b
mov ecx, dword [esi + 0x4c]
xor eax, eax
add ecx, dword [esi + 0x38]
adc eax, dword [esi + 0x3c]
cmp eax, dword [esi + 0x2c]
jb 0x4a0d5b
ja 0x4a0d53
cmp ecx, dword [esi + 0x28]
jb 0x4a0d5b
pop edi
xor al, al
pop esi
add esp, 0x24
ret
mov ecx, dword [esi + 0x28]
push ebx
mov dword [esi + 0x38], edx
mov ebx, edx
mov edx, dword [esi + 0x2c]
mov dword [esi + 0x3c], edi
cmp edi, edx
jb 0x4a0d81
ja 0x4a0d74
cmp ebx, ecx
jb 0x4a0d81
or ecx, edx
je 0x4a0de3
pop ebx
pop edi
xor al, al
pop esi
add esp, 0x24
ret
mov eax, dword [esi + 0x48]
add eax, eax
sub ecx, ebx
sbb edx, edi
mov dword [esi + 0x4c], eax
test eax, eax
je 0x4a0d9d
xor edi, edi
cmp edi, edx
jb 0x4a0da0
ja 0x4a0d9d
cmp eax, ecx
jbe 0x4a0da0
mov dword [esi + 0x4c], ecx
mov edx, dword [esi + 0x4c]
mov ecx, dword [esi + 0x3c]
push edx
mov edx, dword [esi + 0x50]
mov eax, ebx
push eax
mov eax, dword [esi + 0x1c]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x30], eax
test eax, eax
jne 0x4a0dd2
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebx
mov dword [esi + 0x24], eax
pop edi
xor al, al
pop esi
add esp, 0x24
ret
mov ecx, dword [esi + 0x48]
xor edx, edx
add ecx, dword [esi + 0x38]
adc edx, dword [esi + 0x3c]
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], edx
pop ebx
pop edi
mov al, 1
pop esi
add esp, 0x24
ret

Function at 0x4a0e80
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
jne 0x4a0e8e
lea edi, [esp + 0x1c]
mov esi, dword [esp + 0xc]
cmp esi, 0xffffffff
jne 0x4a0ea4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
pop edi
xor eax, eax
pop esi
ret
cmp byte [esp + 0x18], 0
je 0x4a0ebd
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x4a0e97
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push 0
lea eax, [esp + 0x18]
push eax
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4a0e97
mov eax, dword [esp + 0x14]
pop edi
pop esi
ret
Function at 0x4a13e0
Capabilities:
Write file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
push 0
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4a1451
push esi
cmp eax, 0xfde9
je 0x4a1416
mov eax, 0x579d64
mov esi, 2
jmp 0x4a1420
mov eax, 0x579d6c
mov esi, 3
push 0
lea ecx, [esp + 0xc]
push ecx
push esi
push eax
push edi
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4a144b
cmp dword [esp + 8], esi
jne 0x4a144b
pop esi
mov eax, 1
pop edi
pop ecx
ret
pop esi
xor eax, eax
pop edi
pop ecx
ret
mov al, 1
pop edi
pop ecx
ret

Function at 0x4a1850
Capabilities:
Get system information on windows

Disassembly:
xor eax, eax
mov dword [ecx + 0x38], eax
mov dword [ecx + 0x3c], eax
mov dword [ecx + 0x40], eax
mov dword [ecx + 0x44], eax
jmp fcn.004a0ce0

Function at 0x4a1ae0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x55da38
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x5b3890]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x18]
call fcn.0049eff0
mov dword [esp + 0x10], vtable.cWCStr.0
mov eax, dword [esp + 0x34]
push eax
lea ecx, [esp + 0x14]
push str._s_r_n
push ecx
mov dword [esp + 0x34], 0
call fcn.00401080
mov eax, dword [esp + 0x44]
mov edi, dword [esp + 0x20]
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4a1b5f
mov eax, edi
lea edx, [eax + 2]
jmp 0x4a1b50
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4a1b50
sub eax, edx
sar eax, 1
push 0
lea edx, [esp + 0x10]
push edx
lea esi, [eax + eax]
mov eax, dword [esp + 0x38]
push esi
push edi
push eax
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4a1bb5
cmp dword [esp + 0xc], esi
jne 0x4a1bb5
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x10], vtable.cWCS.0
call fcn.0049ee80
mov al, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x10], vtable.cWCS.0
call fcn.0049ee80
xor al, al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret

Function at 0x4a3220
Capabilities:
Get file version info

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, esi
call fcn.004a31e0
test eax, eax
jne 0x4a3232
pop esi
ret
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push eax
push ecx
push edx
push esi
call sub.VERSION.dll_GetFileVersionInfoW
pop esi
ret
Function at 0x4a41c0
Capabilities:
Create directory

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
push ebx
push esi
call fcn.004a3dd0
mov edi, eax
add esp, 8
test edi, edi
jne 0x4a423b
push ebx
push esi
call fcn.004a3fd0
add esp, 8
test eax, eax
jne 0x4a41fc
mov eax, dword [esp + 0x18]
push eax
push ebx
push esi
call fcn.004b2f30
add esp, 0xc
pop edi
pop esi
pop ebx
ret
mov ecx, str.Temp
lea edi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x4a4204
sub ecx, edi
sar ecx, 1
lea edi, [ecx + eax]
lea ecx, [edi + 1]
cmp ecx, esi
jbe 0x4a4223
pop edi
pop esi
mov eax, ecx
pop ebx
ret
push 1
mov ecx, esi
sub ecx, eax
push ecx
lea edx, [ebx + eax*2]
push str.Temp
push edx
call fcn.004ae920
add esp, 0x10
push ebx
call fcn.004ba280
add esp, 4
test eax, eax
jne 0x4a4256
cmp byte [esp + 0x18], al
jne 0x4a4256
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 1
sub esi, edi
push esi
lea eax, [ebx + edi*2]
push 0x56b9a8
push eax
call fcn.004ae920
add esp, 0x10
lea eax, [edi + 1]
pop edi
pop esi
pop ebx
ret