joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c0d00
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6474dd
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6d3438]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
call fcn.004213d0
mov edi, eax
test edi, edi
je 0x4c0dd9
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x659730]
mov ecx, edi
call esi
add eax, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], 1
sub ecx, 0
je 0x4c0da2
sub ecx, 1
je 0x4c0d79
sub ecx, 1
je 0x4c0d72
mov eax, str._s__d_:__UNKNOWN_:___s_:__s_n
jmp 0x4c0d7e
mov eax, str._s__d_:__ERROR_:___s_:__s_n
jmp 0x4c0d7e
mov eax, 0x6611cc
mov esi, dword [ebp + 0x18]
push esi
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0042bdd0
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp - 0x10]
lea ecx, [eax - 0x10]
or eax, 0xffffffff
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x4c0dc6
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x659730]
mov ecx, edi
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
push 0x80004005
call fcn.00421010
int3

Function at 0x4c1090
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64751e
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x6d3438]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
xor eax, eax
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x108
mov dword [ebp - 4], 0
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
call fcn.0042ea70
mov edx, eax
mov dword [esi + 0x10], 0x104
xor eax, eax
mov dword [esi + 0x14], 0x107
mov ecx, 0x82
mov edi, edx
rep stosd dword es:[edi], eax
mov word [edx + 0x208], ax
mov dword [esi], edx
cmp dword [esi + 0x14], 8
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x14], eax
mov eax, esi
mov dword [ebp - 0x10], 1
jb 0x4c112c
mov eax, edx
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
cmp dword [esi + 0x14], 8
mov edi, esi
mov ebx, dword [esi + 0x10]
jb 0x4c1144
mov edi, dword [esi]
test ebx, ebx
je 0x4c116d
xor edx, edx
mov ecx, ebx
mov eax, edi
cmp word [edi], dx
je 0x4c1161
cmp ecx, 1
je 0x4c1163
add eax, 2
dec ecx
cmp word [eax], dx
jne 0x4c1153
mov edx, eax
test edx, edx
je 0x4c116d
sub edx, edi
sar edx, 1
jmp 0x4c1170
or edx, 0xffffffff
cmp ebx, edx
jb 0x4c119b
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4c117e
mov eax, dword [esi]
xor ecx, ecx
mov dword [esi + 0x10], edx
mov word [eax + edx*2], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0042b9a0
int3
Function at 0x4c11b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64755e
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6d3438]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
xor eax, eax
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x108
mov dword [ebp - 4], 0
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
call fcn.0042ea70
mov edx, eax
mov dword [esi + 0x10], 0x104
xor eax, eax
mov dword [esi + 0x14], 0x107
mov ecx, 0x82
mov edi, edx
rep stosd dword es:[edi], eax
mov word [edx + 0x208], ax
mov dword [esi], edx
cmp dword [esi + 0x14], 8
mov dword [ebp - 4], eax
mov eax, esi
mov dword [ebp - 0x10], 1
jb 0x4c1244
mov eax, edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp dword [esi + 0x14], 8
mov edi, esi
mov ebx, dword [esi + 0x10]
jb 0x4c1260
mov edi, dword [esi]
test ebx, ebx
je 0x4c128a
xor edx, edx
mov ecx, ebx
mov eax, edi
cmp word [edi], dx
je 0x4c127e
nop
cmp ecx, 1
je 0x4c1280
add eax, 2
dec ecx
cmp word [eax], dx
jne 0x4c1270
mov edx, eax
test edx, edx
je 0x4c128a
sub edx, edi
sar edx, 1
jmp 0x4c128d
or edx, 0xffffffff
cmp ebx, edx
jb 0x4c12b8
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4c129b
mov eax, dword [esi]
xor ecx, ecx
mov dword [esi + 0x10], edx
mov word [eax + edx*2], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0042b9a0
int3

Function at 0x4c13d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x643a50
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
mov eax, dword [0x6d3438]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor esi, esi
cmp dword [eax + 0x14], 8
jb 0x4c1404
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push ecx
push 1
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4c1467
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x14], 8
jb 0x4c1434
mov eax, dword [eax]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 4
push ecx
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4c1467
cmp dword [ebp - 0x1c], 4
jne 0x4c1467
mov ecx, dword [ebp + 0x10]
mov bl, 1
mov eax, dword [ebp - 0x14]
mov dword [ecx], eax
jmp 0x4c1469
xor bl, bl
test esi, esi
je 0x4c1474
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4cb720
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x14], 8
jb 0x4cb72e
mov eax, dword [eax]
push esi
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov edx, dword [str.FALSE]
test eax, eax
mov esi, dword [ebp + 8]
cmovne edx, dword [str.TRUE]
xor eax, eax
mov ecx, edx
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
lea edi, [ecx + 2]
mov word [esi], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4cb767
sub ecx, edi
sar ecx, 1
push ecx
push edx
mov ecx, esi
call fcn.0042e850
pop edi
mov eax, esi
pop esi
pop ebp
ret 0xc
Function at 0x4d6960
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x649130
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x6d3438]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
mov esi, dword [edi + 4]
mov dword [ebp - 4], 0
test esi, esi
je 0x4d69f3
cmp dword [esi], 0
je 0x4d69e8
push 0x68ec80
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4d6a0e
push str.CreateFileTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4d69ee
push 0
push 0
push dword [esi]
mov ecx, eax
push 0
push 0x80
push 3
push 0
push 1
push 1
push ebx
call dword [0x659730]
call dword [ebp - 0x14]
jmp 0x4d6a09
cmp dword [esi + 4], 0
jne 0x4d69f3
or eax, 0xffffffff
jmp 0x4d6a09
push 0
push 0x80
push 3
push 0
push 1
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x4d6a15
call fcn.004d60d0
jmp 0x4d6a19
mov dword [edi], eax
xor eax, eax
mov dword [ebp - 4], 0xffffffff
test eax, eax
jns 0x4d6a4d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x664818
push 0x32
push str.XMLUpdater::v2::CFileMemMap::Init
push str.E:BT3f715c85_ff0b_44ed_ac13_dd63d3f5c42aWebAdvisor_XmlUpdater_srcXmlUpdaterFileMemMap.h
push 1
call fcn.004acee0
add esp, 0x18
xor al, al
jmp 0x4d6aee
mov esi, dword [edi]
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ecx, eax
mov dword [edi + 0x10], ecx
test ecx, ecx
jne 0x4d6a80
call fcn.004d60d0
mov esi, eax
jmp 0x4d6ac9
mov eax, dword [ebp - 0x18]
push 0
push eax
push 0
push 0
push 4
push ecx
mov dword [edi + 0xc], eax
mov dword [edi + 0x20], 4
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov dword [edi + 8], eax
test eax, eax
jne 0x4d6aec
call fcn.004d60d0
push dword [edi + 0x10]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x10], 0
test esi, esi
jns 0x4d6aec
push str.Failed_to_map_file_to_memory
push 0x38
push str.XMLUpdater::v2::CFileMemMap::Init
push str.E:BT3f715c85_ff0b_44ed_ac13_dd63d3f5c42aWebAdvisor_XmlUpdater_srcXmlUpdaterFileMemMap.h
push 1
call fcn.004acee0
add esp, 0x14
xor al, al
jmp 0x4d6aee
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00608185
mov esp, ebp
pop ebp
ret 4
Function at 0x4d9010
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
push 0x40
push 0
lea eax, [esi + 4]
mov dword [esi], vtable.XMLUpdater::v2::CMD5Checksum.0
push eax
call fcn.0060a8e0
add esp, 0xc
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov eax, esi
mov dword [esi + 0x4c], 0x67452301
mov dword [esi + 0x50], 0xefcdab89
mov dword [esi + 0x54], 0x98badcfe
mov dword [esi + 0x58], 0x10325476
pop esi
ret

Function at 0x4d9fd0
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x6d3438]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ecx + 8]
test edi, edi
je 0x4da057
test esi, esi
je 0x4da057
push 0x80
lea eax, [ebp - 0x84]
push 0
push eax
call fcn.0060a8e0
add esp, 0xc
mov dword [ebp - 0x88], 0x7f
lea eax, [ebp - 0x88]
push 0
push eax
lea eax, [ebp - 0x84]
push eax
push 0
push 5
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x4da057
lea eax, [ebp - 0x84]
push eax
call fcn.0061fb1b
add esp, 4
mov dword [esi], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00608185
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.00608185
mov esp, ebp
pop ebp
ret 4

Function at 0x4da070
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x6d3438]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ecx + 8]
test esi, esi
je 0x4da0e8
push 0x100
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.0060a8e0
add esp, 0xc
mov dword [ebp - 0x108], 0xff
lea eax, [ebp - 0x108]
push 0
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0x13
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x4da0e8
lea eax, [ebp - 0x104]
push eax
call fcn.0061fb1b
add esp, 4
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00608185
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.00608185
mov esp, ebp
pop ebp
ret
Function at 0x4da8a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x643a50
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x6d3438]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
push 8
mov dword [ebp - 0x14], esi
mov dword [esi], vtable.std::basic_streambuf_unsigned_char__struct_std::char_traits_unsigned_char__.0
call fcn.0060862c
mov edi, eax
add esp, 4
test edi, edi
je 0x4da906
xorps xmm0, xmm0
movq qword [edi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.005f3b84
add esp, 4
mov dword [edi + 4], eax
jmp 0x4da908
xor edi, edi
mov eax, dword [ebp - 0x10]
lea ebx, [esi + 4]
mov dword [ebp - 0x18], ebx
lea edx, [esi + 8]
mov ebx, dword [ebp - 0x10]
lea ecx, [esi + 0x18]
mov dword [esi + 0x34], edi
lea edi, [esi + 0x14]
mov dword [ebp - 0x14], edx
add esi, 0x24
mov edx, dword [ebp - 0x10]
add eax, 0x28
mov dword [ebx], vtable.std::basic_filebuf_unsigned_char__struct_std::char_traits_unsigned_char__.0
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x3d], 0
mov ebx, dword [ebp - 0x18]
mov dword [edx + 0xc], ebx
mov ebx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x10], edx
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x20], ecx
mov dword [ebx + 0x2c], esi
mov ebx, dword [ebp - 0x18]
mov dword [edx], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [esi], 0
mov dword [eax + 0x4c], 0
mov ecx, dword [0x6e14b0]
mov edx, dword [0x6e14b4]
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], edx
mov dword [eax + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4de770
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], edi
test eax, eax
jg 0x4de79c
jl 0x4de790
test ecx, ecx
jne 0x4de79c
pop edi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
push esi
je 0x4de85c
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
nop dword [eax]
mov ecx, ebx
call fcn.0042aba0
mov esi, eax
mov eax, edx
mov dword [ebp - 0xc], eax
test eax, eax
jl 0x4de803
jg 0x4de7c8
test esi, esi
je 0x4de803
mov ecx, dword [ebp - 4]
cmp ecx, eax
jg 0x4de7dd
mov eax, dword [ebp - 8]
jl 0x4de7d8
cmp eax, esi
jae 0x4de7dd
mov esi, eax
mov dword [ebp - 0xc], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.0060a360
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
sub ecx, esi
sbb edx, dword [ebp - 0xc]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x4de82c
mov eax, dword [ebx]
mov esi, dword [eax + 0x1c]
mov ecx, esi
call dword [0x659730]
mov ecx, ebx
call esi
mov edx, dword [ebp - 4]
cmp eax, 0xffffffff
je 0x4de846
mov ecx, dword [ebp - 8]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
test edx, edx
jg 0x4de7b0
jl 0x4de846
test ecx, ecx
jne 0x4de7b0
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 8]
mov ecx, dword [ebp + 0x10]
pop esi
sbb ecx, edx
pop edi
mov edx, ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x4de899
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x4de899
mov edi, dword [ebp - 4]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.0060a360
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp - 4], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
cmp dword [ebx + 0x4c], 0
mov ecx, edi
je 0x4de90b
mov esi, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [esi], eax
jne 0x4de8bf
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov esi, dword [ebp - 4]
mov ecx, edi
cmp edi, 0xfff
jbe 0x4de8f4
nop dword [eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.00614438
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x4de91f
cmp edi, eax
ja 0x4de8d0
test ecx, ecx
je 0x4de90b
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.00614438
mov ecx, edi
add esp, 0x10
sub ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, ecx
pop esi
pop edi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop esi
pop edi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4def60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x649cbc
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x6d3438]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp dword [ebp + 8], 0
mov dword [ebp - 0x14], 0
je 0x4defd4
mov dword [ebx], 0x666e3c
mov dword [ebx + 0x58], 0
mov dword [ebx + 0x78], 0
mov dword [ebx + 0x7c], 0
mov dword [ebx + 0x80], 0
mov dword [ebx + 0x50], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 1
push 0
lea esi, [ebx + 4]
mov ecx, ebx
push 0
push esi
mov dword [ebp - 0x10], esi
call fcn.004ded80
mov eax, dword [ebx]
push 8
mov dword [ebp - 4], 1
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x50]
mov dword [ecx + ebx - 4], eax
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0060862c
mov esi, eax
add esp, 4
test esi, esi
je 0x4df035
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov byte [ebp - 4], 2
call fcn.005f3b84
add esp, 4
mov dword [esi + 4], eax
jmp 0x4df037
xor esi, esi
lea eax, [ebx + 4]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
lea edi, [eax + 0x14]
mov dword [eax + 0x1c], edi
lea ecx, [eax + 0x18]
mov dword [eax + 0x20], ecx
lea edx, [eax + 0x24]
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov dword [eax], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov dword [eax + 0x38], 0
mov dword [eax + 0x3c], 4
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4e2ca0
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6d3438]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x24], esi
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
mov dword [ebp - 0x24], edx
cmp edx, eax
jne 0x4e2cf0
xor eax, eax
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00608185
mov esp, ebp
pop ebp
ret
push ebx
push edi
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0
push ecx
push 0
sub eax, edx
push 0x40000001
push eax
push edx
mov dword [ebp - 0x28], eax
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
mov ebx, dword [ebp - 0x20]
dec ebx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 7
cmp ebx, 7
ja 0x4e2d52
mov dword [ebp - 0xc], ebx
test ebx, ebx
je 0x4e2d46
xor eax, eax
lea edi, [ebp - 0x1c]
mov ecx, ebx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
xor eax, eax
mov word [ebp + ebx*2 - 0x1c], ax
mov edx, dword [ebp - 0x1c]
jmp 0x4e2db4
cmp ebx, 0x7ffffffe
ja 0x4e2e0c
mov edi, ebx
lea ecx, [ebp - 0x1c]
or edi, 7
cmp edi, 0x7ffffffe
jbe 0x4e2d81
push accept
call fcn.0042ea70
mov dword [ebp - 8], SysReAllocStringLen
jmp 0x4e2d97
mov eax, 0xa
cmp edi, eax
cmovb edi, eax
lea eax, [edi + 1]
push eax
call fcn.0042ea70
mov dword [ebp - 8], edi
mov edx, eax
mov dword [ebp - 0xc], ebx
xor eax, eax
mov ecx, ebx
shr ecx, 1
mov edi, edx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
xor eax, eax
mov word [edx + ebx*2], ax
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 8], 8
lea ecx, [ebp - 0x20]
push ecx
lea eax, [ebp - 0x1c]
cmovae eax, edx
push eax
push 0x40000001
push dword [ebp - 0x28]
push dword [ebp - 0x24]
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
movups xmm0, xmmword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov eax, esi
mov dword [esi], 0
xor ecx, ebp
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
pop edi
movq xmm0, qword [ebp - 0xc]
pop ebx
movq qword [esi + 0x10], xmm0
pop esi
call fcn.00608185
mov esp, ebp
pop ebp
ret
call fcn.0042f3b0
int3

Function at 0x4e7630
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
xor bl, bl
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4e7657
mov ebx, eax
shr ebx, 4
not bl
and bl, 1
mov edx, dword [ebp + 0x1c]
cmp edx, 8
jb 0x4e768d
mov ecx, dword [ebp + 8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4e7683
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4e7692
push edx
push ecx
call fcn.00608415
add esp, 8
mov al, bl
pop ebx
pop ebp
ret
call fcn.0060e0d0
int3
Function at 0x4ea650
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64afa5
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x6d3438]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x1c], 1
cmp dword [ebx + 0x10], 0
je 0x4ea7e2
cmp dword [ebx + 0x14], 8
mov eax, ebx
jb 0x4ea696
mov eax, dword [ebx]
lea ecx, [ebp - 0x1c]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x4ea7e2
inc eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], 0
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
call fcn.00608193
mov esi, eax
mov dword [ebp - 0x24], esi
push 0x10
mov byte [ebp - 4], 1
call fcn.0060862c
mov edi, eax
add esp, 8
mov dword [ebp - 0x24], edi
test edi, edi
je 0x4ea718
xorps xmm0, xmm0
movq qword [edi], xmm0
mov dword [edi + 8], 0
mov dword [edi + 4], 1
mov dword [edi + 8], 1
mov dword [edi], vtable.std::_Ref_count_void_.0
mov dword [edi + 0xc], esi
jmp 0x4ea71a
xor edi, edi
push 0
push 0
call fcn.00608415
add esp, 8
cmp dword [ebx + 0x14], 8
jb 0x4ea72e
mov ebx, dword [ebx]
push esi
push dword [ebp - 0x20]
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4ea790
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x68e7fc
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4ea790
cmp dword [ebp - 0x14], 0
je 0x4ea790
mov edx, dword [ebp - 0x18]
cmp dword [edx], 0xfeef04bd
jne 0x4ea790
movzx ecx, word [edx + 0x12]
mov eax, dword [ebp + 0xc]
mov byte [ebp - 0xd], 1
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
movzx ecx, word [edx + 0x10]
mov dword [eax], ecx
mov eax, dword [ebp + 0x14]
movzx ecx, word [edx + 0x16]
mov dword [eax], ecx
mov eax, dword [ebp + 0x18]
movzx ecx, word [edx + 0x14]
mov dword [eax], ecx
jmp 0x4ea794
mov byte [ebp - 0xd], 0
test edi, edi
je 0x4ea7cd
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [edi + 4], eax
jne 0x4ea7cd
mov eax, dword [edi]
mov esi, dword [eax]
mov ecx, esi
call dword [0x659730]
mov ecx, edi
call esi
lock xadd dword [edi + 8], ebx
dec ebx
jne 0x4ea7cd
mov edx, dword [edi]
mov esi, dword [edx + 4]
mov ecx, esi
call dword [0x659730]
mov ecx, edi
call esi
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret