joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c8910
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x52c7c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push ebp
push esi
mov ebp, ecx
push edi
push 0x400
lea ecx, [esp + 0x20]
call fcn.004f1260
xor edi, edi
lea ecx, [esp + 0x28]
mov dword [esp + 0x44], edi
call fcn.004bc610
mov ecx, dword [ebp + 0x114]
mov edx, dword [ebp + 0x118]
mov eax, dword [ebp + 0x110]
mov dword [esp + 0x30], ecx
mov cx, word [ebp + 0x10c]
mov dword [esp + 0x34], edx
mov dword [esp + 0x2c], eax
mov ax, word [ebp + 0x10e]
lea edx, [esp + 0x28]
mov word [esp + 0x28], cx
push 0x12
push edx
lea ecx, [esp + 0x24]
mov word [esp + 0x32], ax
mov word [esp + 0x40], 0x64
call fcn.004bc5d0
mov eax, dword [ebp + 0x140]
cmp eax, edi
je 0x4c8aa7
test byte [ebp + 0x10e], 1
je 0x4c8aa7
push 0x38
push eax
lea ecx, [esp + 0x24]
call fcn.004bc5d0
mov eax, dword [ebp + 0x140]
xor ebx, ebx
cmp dword [eax + 0x34], edi
jle 0x4c8aa7
mov esi, dword [eax + 0x38]
push 0x100
lea ecx, [esp + 0x14]
add esi, edi
call fcn.004f1260
push 4
push esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x4c], 1
call fcn.004f12a0
lea eax, [esi + 4]
push 4
push eax
lea ecx, [esp + 0x18]
call fcn.004f12a0
lea ecx, [esi + 8]
push 0x28
push ecx
lea ecx, [esp + 0x18]
call fcn.004f12a0
lea edx, [esi + 0x30]
push 8
push edx
lea ecx, [esp + 0x18]
call fcn.004f12a0
mov eax, dword [esi + 0x38]
lea ecx, [esp + 0x10]
push eax
call fcn.004f1370
lea ecx, [esi + 0x3c]
push 8
push ecx
lea ecx, [esp + 0x18]
call fcn.004f12a0
lea edx, [esi + 0x44]
push 4
push edx
lea ecx, [esp + 0x18]
call fcn.004f12a0
lea eax, [esi + 0x48]
push 4
push eax
lea ecx, [esp + 0x18]
call fcn.004f12a0
mov esi, dword [esi + 0x4c]
test esi, esi
jne 0x4c8a67
mov esi, 0x5688a4
push esi
lea ecx, [esp + 0x14]
call fcn.004f1350
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
sub ecx, eax
push ecx
push eax
lea ecx, [esp + 0x24]
call fcn.004bc5d0
lea ecx, [esp + 0x10]
mov byte [esp + 0x44], 0
call fcn.004f1290
mov eax, dword [ebp + 0x140]
inc ebx
add edi, 0x50
cmp ebx, dword [eax + 0x34]
jl 0x4c89d0
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x4c]
sub edx, eax
push edx
add ebp, 4
push eax
push ebp
call fcn.00478130
xor ecx, ecx
mov dword [esp + 0x44], 0xffffffff
test eax, eax
sete cl
mov esi, ecx
lea ecx, [esp + 0x1c]
call fcn.004f1290
mov ecx, dword [esp + 0x3c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x4cb0f0
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov eax, dword [esi + 0x108]
push str.DCP_Init
push eax
call edi
mov ecx, dword [esi + 0x108]
push str.DCP_Free
push ecx
mov dword [esi + 0x144], eax
call edi
mov edx, dword [esi + 0x108]
push str.DCP_GetPlugInInfo
push edx
mov dword [esi + 0x148], eax
call edi
mov dword [esi + 0x14c], eax
mov eax, dword [esi + 0x108]
push str.DCP_ShowPlugInDialog
push eax
call edi
mov ecx, dword [esi + 0x108]
push str.DCP_GetError
push ecx
mov dword [esi + 0x150], eax
call edi
mov edx, dword [esi + 0x108]
push str.DCP_Connect
push edx
mov dword [esi + 0x154], eax
call edi
mov dword [esi + 0x158], eax
mov eax, dword [esi + 0x108]
push str.DCP_Disconnect
push eax
call edi
mov ecx, dword [esi + 0x108]
push str.DCP_GetDirInfo
push ecx
mov dword [esi + 0x15c], eax
call edi
mov edx, dword [esi + 0x108]
push str.DCP_FreeDirInfo
push edx
mov dword [esi + 0x160], eax
call edi
mov dword [esi + 0x164], eax
mov eax, dword [esi + 0x108]
push str.DCP_FreeFileInfo
push eax
call edi
mov ecx, dword [esi + 0x108]
push str.DCP_GetFileInfo
push ecx
mov dword [esi + 0x168], eax
call edi
mov edx, dword [esi + 0x108]
push str.DCP_GetFile
push edx
mov dword [esi + 0x16c], eax
call edi
mov dword [esi + 0x170], eax
mov eax, dword [esi + 0x108]
push str.DCP_GetFileStart
push eax
call edi
mov ecx, dword [esi + 0x108]
push str.DCP_GetFileStep
push ecx
mov dword [esi + 0x174], eax
call edi
mov edx, dword [esi + 0x108]
push str.DCP_GetFileStop
push edx
mov dword [esi + 0x178], eax
call edi
mov dword [esi + 0x17c], eax
mov eax, dword [esi + 0x108]
push str.DCP_DeleteFile
push eax
call edi
mov ecx, dword [esi + 0x108]
push str.DCP_TakePicture
push ecx
mov dword [esi + 0x180], eax
call edi
mov edx, dword [esi + 0x108]
push str.DCP_TakePictureConfig
push edx
mov dword [esi + 0x184], eax
call edi
mov dword [esi + 0x188], eax
mov eax, dword [esi + 0x108]
push str.DCP_Help
push eax
call edi
mov ecx, dword [esi + 0x108]
push str.DCP_ErrorHandler
push ecx
mov dword [esi + 0x18c], eax
call edi
mov edx, dword [esi]
mov ecx, esi
mov dword [esi + 0x190], eax
call dword [edx + 0xc]
pop edi
pop esi
ret
Function at 0x4cb860
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x52c998
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
push edi
push 0x400
lea ecx, [esp + 0xc]
call fcn.004f1260
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0
call fcn.004bc610
mov ecx, dword [esi + 0x114]
mov edx, dword [esi + 0x118]
mov eax, dword [esi + 0x110]
mov dword [esp + 0x1c], ecx
mov cx, word [esi + 0x10c]
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], eax
mov ax, word [esi + 0x10e]
lea edx, [esp + 0x14]
mov word [esp + 0x14], cx
push 0x12
push edx
lea ecx, [esp + 0x10]
mov word [esp + 0x1e], ax
mov word [esp + 0x2c], 0x64
call fcn.004bc5d0
mov eax, dword [esi + 0x140]
test eax, eax
je 0x4cb93a
test byte [esi + 0x10e], 1
je 0x4cb93a
push 0x38
push eax
lea ecx, [esp + 0x10]
call fcn.004bc5d0
mov eax, dword [esi + 0x140]
xor edi, edi
mov ecx, dword [eax + 0x34]
test ecx, ecx
jle 0x4cb93a
push ebx
xor ebx, ebx
mov eax, dword [eax + 0x38]
push 0x34
add eax, ebx
lea ecx, [esp + 0x10]
push eax
call fcn.004bc5d0
mov eax, dword [esi + 0x140]
inc edi
add ebx, 0x34
cmp edi, dword [eax + 0x34]
jl 0x4cb919
pop ebx
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
sub ecx, eax
add esi, 4
push ecx
mov ecx, dword [esp + 0x3c]
push eax
push esi
call fcn.00478130
xor edx, edx
lea ecx, [esp + 8]
test eax, eax
sete dl
mov esi, edx
mov dword [esp + 0x30], 0xffffffff
call fcn.004f1290
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x4cd5a0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x52cb58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
push edi
push 0x400
lea ecx, [esp + 0xc]
call fcn.004f1260
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0
call fcn.004bc610
mov ecx, dword [esi + 0x114]
mov edx, dword [esi + 0x118]
mov eax, dword [esi + 0x110]
mov dword [esp + 0x1c], ecx
mov cx, word [esi + 0x10c]
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], eax
mov ax, word [esi + 0x10e]
lea edx, [esp + 0x14]
mov word [esp + 0x14], cx
push 0x12
push edx
lea ecx, [esp + 0x10]
mov word [esp + 0x1e], ax
mov word [esp + 0x2c], 0x64
call fcn.004bc5d0
mov eax, dword [esi + 0x140]
test eax, eax
je 0x4cd680
test byte [esi + 0x10e], 1
je 0x4cd680
push 0x38
push eax
lea ecx, [esp + 0x10]
call fcn.004bc5d0
mov eax, dword [esi + 0x140]
xor edi, edi
mov ecx, dword [eax + 0x34]
test ecx, ecx
jle 0x4cd680
push ebx
xor ebx, ebx
mov eax, dword [eax + 0x38]
push 0x114
add eax, ebx
lea ecx, [esp + 0x10]
push eax
call fcn.004bc5d0
mov eax, dword [esi + 0x140]
inc edi
add ebx, 0x114
cmp edi, dword [eax + 0x34]
jl 0x4cd659
pop ebx
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
sub ecx, eax
add esi, 4
push ecx
mov ecx, dword [esp + 0x3c]
push eax
push esi
call fcn.00478130
xor edx, edx
lea ecx, [esp + 8]
test eax, eax
sete dl
mov esi, edx
mov dword [esp + 0x30], 0xffffffff
call fcn.004f1290
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x4ce160
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov eax, dword [esi + 0x108]
push str.AMP_Init
push eax
call edi
mov ecx, dword [esi + 0x108]
push str.AMP_Free
push ecx
mov dword [esi + 0x144], eax
call edi
mov edx, dword [esi + 0x108]
push str.AMP_GetPlugInInfo
push edx
mov dword [esi + 0x148], eax
call edi
mov dword [esi + 0x14c], eax
mov eax, dword [esi + 0x108]
push str.AMP_GetError
push eax
call edi
mov ecx, dword [esi + 0x108]
push str.AMP_ShowPlugInDialog
push ecx
mov dword [esi + 0x154], eax
call edi
mov edx, dword [esi + 0x108]
push str.AMP_OpenArchive
push edx
mov dword [esi + 0x150], eax
call edi
mov dword [esi + 0x158], eax
mov eax, dword [esi + 0x108]
push str.AMP_CloseArchive
push eax
call edi
mov ecx, dword [esi + 0x108]
push str.AMP_GetArchiveInfo
push ecx
mov dword [esi + 0x15c], eax
call edi
mov edx, dword [esi + 0x108]
push str.AMP_FileDecode
push edx
mov dword [esi + 0x160], eax
call edi
mov dword [esi + 0x164], eax
mov eax, dword [esi + 0x108]
push str.AMP_FileDecodeStart
push eax
call edi
mov ecx, dword [esi + 0x108]
push str.AMP_FileDecodeStep
push ecx
mov dword [esi + 0x168], eax
call edi
mov edx, dword [esi + 0x108]
push str.AMP_FileDecodeStop
push edx
mov dword [esi + 0x16c], eax
call edi
mov dword [esi + 0x170], eax
mov eax, dword [esi + 0x108]
push str.AMP_CreateArchive
push eax
call edi
mov ecx, dword [esi + 0x108]
push str.AMP_DeleteFiles
push ecx
mov dword [esi + 0x174], eax
call edi
mov edx, dword [esi + 0x108]
push str.AMP_AddFiles
push edx
mov dword [esi + 0x178], eax
call edi
mov dword [esi + 0x17c], eax
mov eax, dword [esi + 0x108]
push str.AMP_RenameFiles
push eax
call edi
mov ecx, dword [esi + 0x108]
push str.AMP_GetDefaultAddParams
push ecx
mov dword [esi + 0x180], eax
call edi
mov edx, dword [esi + 0x108]
push str.AMP_ShowAddParamsDialog
push edx
mov dword [esi + 0x184], eax
call edi
mov dword [esi + 0x188], eax
mov eax, dword [esi + 0x108]
push str.AMP_Help
push eax
call edi
mov ecx, dword [esi + 0x108]
push str.AMP_ErrorHandler
push ecx
mov dword [esi + 0x18c], eax
call edi
mov edx, dword [esi]
mov ecx, esi
mov dword [esi + 0x190], eax
call dword [edx + 0xc]
pop edi
pop esi
ret

Function at 0x4ce730
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x52cc30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push ebp
push esi
mov ebp, ecx
push edi
push 0x400
lea ecx, [esp + 0x20]
call fcn.004f1260
add al, 0x2b
add al, byte [eax]
Function at 0x4d1440
Capabilities:
Create process on windows
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
push ebx
push esi
push edi
mov dword [esp + 0x1c], ecx
push 0x2710
call sub.MFC42.DLL_operatornew
add esp, 4
mov ebx, eax
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0x2710
xor esi, esi
push ebx
push 2
push esi
push 6
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x34], esi
call sub.WINSPOOL.DRV_EnumPrintersA
test eax, eax
jne 0x4d14bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4d14bf
push ebx
call sub.MFC42.DLL_operatordelete
mov edx, dword [esp + 0x14]
push edx
call sub.MFC42.DLL_operatornew
mov edx, dword [esp + 0x18]
add esp, 8
mov ebx, eax
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push ecx
push edx
push ebx
push 2
push esi
push 6
call sub.WINSPOOL.DRV_EnumPrintersA
cmp dword [esp + 0xc], esi
jne 0x4d15e8
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x3c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], 0x3c
push eax
mov dword [esp + 0x44], 0x140
mov dword [esp + 0x5c], 1
mov dword [esp + 0x4c], str.open
mov dword [esp + 0x50], str.rundll32.exe
mov dword [esp + 0x54], str.shell32.dll_SHHelpShortcuts_RunDLL_AddPrinter
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x4d15f0
mov edx, dword [esp + 0x74]
lea ecx, [esp + 0x14]
push ecx
push edx
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x4d15a1
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebp
mov ebp, dword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [esp + 0x18], 0x103
jne 0x4d159e
push 1
push 0
push 0
lea eax, [esp + 0x30]
push 0
push eax
call esi
test eax, eax
je 0x4d1582
lea ecx, [esp + 0x24]
push ecx
call edi
lea edx, [esp + 0x24]
push edx
call ebp
push 1
push 0
push 0
lea eax, [esp + 0x30]
push 0
push eax
call esi
test eax, eax
jne 0x4d1561
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esp + 0x78]
lea ecx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x4d1544
xor esi, esi
pop ebp
mov eax, dword [esp + 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
push edx
push 0x2710
push ebx
push 2
push esi
push 6
mov dword [esp + 0x28], esi
call sub.WINSPOOL.DRV_EnumPrintersA
test eax, eax
je 0x4d15f0
cmp dword [esp + 0xc], esi
je 0x4d15f0
mov eax, dword [ebx + 4]
mov ecx, dword [ebx + 0x1c]
mov edx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, dword [edx + 0x14]
call fcn.004d5310
mov dword [esp + 0x18], 1
push ebx
call sub.MFC42.DLL_operatordelete
mov eax, dword [esp + 0x1c]
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0x6c
ret 4
Function at 0x4d1610
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push ebx
lea eax, [esp + 4]
push edi
mov edi, ecx
push eax
mov dword [esp + 0xc], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0xc], 5
jne 0x4d168e
cmp dword [esp + 0x10], 1
jne 0x4d168e
push str.uxtheme.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x4d168e
push esi
push str.EnableThemeDialogTexture
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4d1686
mov ecx, dword [edi]
push 6
push ecx
call esi
mov edx, dword [edi + 4]
push 6
push edx
call esi
mov eax, dword [edi + 8]
push 6
push eax
call esi
mov ecx, dword [edi + 0xc]
push 6
push ecx
call esi
mov edx, dword [edi + 0x10]
push 6
push edx
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
pop edi
pop ebx
add esp, 0x94
ret
Function at 0x4d4660
Capabilities:
Access peb ldr_data
Create thread
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x52d02b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push 0x7f02
mov ebx, ecx
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x38]
test eax, eax
jne 0x4d46c7
mov ecx, dword [ebx + 0x30]
push eax
mov eax, dword [ebx + 0x34]
push 0x3ec
push 0x43d
push eax
push ecx
call fcn.00472ce0
add esp, 0x14
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
push 0x26
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
test al, 1
jne 0x4d4702
mov edx, dword [ebx + 0x34]
mov eax, dword [ebx + 0x30]
push 0
push 0x3ec
push 0x3eb
push edx
push eax
call fcn.00472ce0
add esp, 0x14
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
test ah, 0x28
jne 0x4d473a
mov ecx, dword [ebx + 0x34]
mov edx, dword [ebx + 0x30]
push 1
push 0x3ec
push 0x3ed
push ecx
push edx
call fcn.00472ce0
add esp, 0x14
cmp eax, 1
je 0x4d473a
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov eax, dword [ebx + 0x260]
push ebp
test eax, eax
push esi
jne 0x4d47a2
mov eax, dword [ebx + 0x1f4]
xor ebp, ebp
test eax, eax
jle 0x4d47a2
cmp ebp, eax
push edi
jge 0x4d4766
test ebp, ebp
jl 0x4d4766
mov eax, dword [ebx + 0x1f0]
mov edi, dword [eax + ebp*4]
jmp 0x4d4768
xor edi, edi
mov eax, dword [edi + 8]
xor esi, esi
test eax, eax
jle 0x4d4796
cmp esi, eax
jge 0x4d4781
test esi, esi
jl 0x4d4781
mov ecx, dword [edi + 4]
mov eax, dword [ecx + esi*4]
jmp 0x4d4783
xor eax, eax
mov edx, dword [eax + 4]
mov ecx, dword [eax]
push edx
call fcn.004e10c0
mov eax, dword [edi + 8]
inc esi
cmp esi, eax
jl 0x4d4775
mov eax, dword [ebx + 0x1f4]
inc ebp
cmp ebp, eax
jl 0x4d4757
pop edi
mov eax, dword [ebx + 0x34]
test eax, eax
je 0x4d481f
mov eax, dword [ebx + 0x260]
test eax, eax
jne 0x4d481f
push 0x280
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
mov dword [esp + 0x20], 0
je 0x4d47dc
push ebx
mov ecx, eax
call fcn.004d2b90
mov esi, eax
jmp 0x4d47de
xor esi, esi
mov eax, dword [esp + 0xc]
mov dword [esp + 0x20], 0xffffffff
push eax
call dword [sym.imp.USER32.dll_SetCursor]
lea ecx, [esp + 0x14]
push ecx
push 4
push esi
push 0x4d17b0
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x4d4826
mov ecx, ebx
call fcn.004d1d50
mov eax, dword [ebx + 0x48]
pop esi
test eax, eax
pop ebp
je 0x4d4836
mov ecx, ebx
call fcn.004d4020
mov ecx, dword [esp + 0x10]
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x4d6b70
Capabilities:
Create thread
Hide graphical window
Resume thread

Disassembly:
sub esp, 0x20
push esi
mov esi, ecx
mov eax, dword [esi + 0x250]
test eax, eax
jne 0x4d6b87
xor eax, eax
pop esi
add esp, 0x20
ret
mov eax, dword [esi + 0x24c]
test eax, eax
jne 0x4d6b98
xor eax, eax
pop esi
add esp, 0x20
ret
mov eax, dword [esi + 0x254]
test eax, eax
jne 0x4d6ba9
xor eax, eax
pop esi
add esp, 0x20
ret
mov eax, dword [esi + 0x258]
test eax, eax
jne 0x4d6bba
xor eax, eax
pop esi
add esp, 0x20
ret
mov ecx, esi
call fcn.004d6d30
test eax, eax
jne 0x4d6bca
pop esi
add esp, 0x20
ret
mov ecx, esi
call fcn.004d6e60
test eax, eax
jne 0x4d6bda
pop esi
add esp, 0x20
ret
mov eax, dword [esi + 0x4c]
test eax, eax
je 0x4d6be8
xor eax, eax
pop esi
add esp, 0x20
ret
mov eax, dword [esi + 0x240]
push edi
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov dword [esi + 0x40], 0
mov eax, dword [esi + 0x1fc]
test eax, eax
je 0x4d6c45
mov eax, dword [esi + 0x1f4]
xor edi, edi
test eax, eax
jle 0x4d6c45
cmp edi, eax
push ebx
jge 0x4d6c39
test edi, edi
jl 0x4d6c39
mov ecx, dword [esi + 0x1f0]
mov ebx, dword [ecx + edi*4]
test ebx, ebx
je 0x4d6c39
mov ecx, ebx
call fcn.004d3720
push ebx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov eax, dword [esi + 0x1f4]
inc edi
cmp edi, eax
jl 0x4d6c18
pop ebx
mov edx, dword [esi + 0x1f0]
push edx
call sub.MFC42.DLL_operatordelete
push 0x80
call sub.MFC42.DLL_operatornew
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
add esp, 8
mov dword [esi + 0x1f0], eax
mov dword [esi + 0x1f4], 0
mov dword [esi + 0x1f8], 0x1f
mov dword [esi + 0x200], 0x40
mov eax, dword [esi + 0x240]
push 1
push 0x403
push 0x403
lea ecx, [esp + 0x18]
push eax
push ecx
call edi
test eax, eax
je 0x4d6cc4
mov edx, dword [esi + 0x240]
push 1
push 0x403
push 0x403
lea eax, [esp + 0x18]
push edx
push eax
call edi
test eax, eax
jne 0x4d6ca6
push 0
mov ecx, esi
call fcn.004d7070
lea ecx, [esp + 8]
push ecx
push 4
push esi
push 0x4d1770
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0x4c], eax
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [esi + 0x4c]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esi + 0x240]
push 5
push 0xa21
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
mov eax, 1
pop esi
add esp, 0x20
ret

Function at 0x4d6d30
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x4c]
test eax, eax
je 0x4d6d8c
push 0xbb8
push eax
mov dword [esi + 0x40], 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4d6d60
push 0x20
call dword [sym.imp.USER32.dll_MessageBeep]
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esi + 0x240]
push 0
push 0xa21
push ecx
mov dword [esi + 0x4c], 0
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
pop esi
ret
Function at 0x4d6da0
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x250]
test eax, eax
jne 0x4d6db3
xor eax, eax
pop esi
pop ecx
ret
mov eax, dword [esi + 0x24c]
test eax, eax
jne 0x4d6dc2
xor eax, eax
pop esi
pop ecx
ret
mov eax, dword [esi + 0x254]
test eax, eax
jne 0x4d6dd1
xor eax, eax
pop esi
pop ecx
ret
mov eax, dword [esi + 0x258]
test eax, eax
jne 0x4d6de0
xor eax, eax
pop esi
pop ecx
ret
mov ecx, esi
call fcn.004d6e60
test eax, eax
jne 0x4d6dee
pop esi
pop ecx
ret
mov eax, dword [esi + 0x50]
test eax, eax
je 0x4d6dfa
xor eax, eax
pop esi
pop ecx
ret
mov eax, dword [esi + 0x4c]
test eax, eax
je 0x4d6e16
mov eax, dword [esi + 0x1c8]
mov ecx, dword [esi + 0x1f4]
cmp eax, ecx
jne 0x4d6e16
xor eax, eax
pop esi
pop ecx
ret
lea ecx, [esp + 4]
mov dword [esi + 0x44], 0
push ecx
push 4
push esi
push 0x4d22b0
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0x50], eax
push 0xfffffffffffffffe
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [esi + 0x50]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
pop esi
pop ecx
ret
Function at 0x4d6eb0
Capabilities:
Check os version

Disassembly:
sub esp, 0x4a0
push ebx
push esi
lea eax, [esp + 0x14]
xor esi, esi
push eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x18], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x24]
cmp eax, 1
jne 0x4d6f91
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
push ecx
push edx
push esi
push esi
push 2
push esi
push eax
call sub.WINSPOOL.DRV_EnumPrintersA
mov eax, dword [esp + 8]
cmp eax, esi
je 0x4d6f33
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
cmp ebx, esi
je 0x4d6f33
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
lea ecx, [esp + 8]
push eax
push ecx
push edx
push ebx
push 2
push esi
push 1
call sub.WINSPOOL.DRV_EnumPrintersA
test eax, eax
jne 0x4d6f40
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop esi
xor eax, eax
pop ebx
add esp, 0x4a0
ret 8
mov eax, dword [ebx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, dword [esp + 0x4b0]
jg 0x4d6f33
push edi
mov edi, dword [ebx + 4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x4b4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x4a0
ret 8
cmp eax, 2
jne 0x4d6f33
cmp dword [esp + 0x18], 5
jb 0x4d6fcb
mov edx, dword [esp + 0x4ac]
mov eax, dword [esp + 0x4b0]
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], eax
push ecx
push edx
call sub.WINSPOOL.DRV_Ordinal_201
neg eax
sbb eax, eax
pop esi
neg eax
pop ebx
add esp, 0x4a0
ret 8
lea eax, [esp + 0xa8]
push 0x400
push eax
push 0x55afa0
push str.device
push str.windows
call dword [sym.imp.KERNEL32.dll_GetProfileStringA]
test eax, eax
jbe 0x4d6f33
lea ecx, [esp + 0xa8]
push 0x558a78
push ecx
call dword [sym.imp.MSVCRT.dll_strtok]
add esp, 8
lea edx, [esp + 0xa8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, dword [esp + 0x4b0]
jae 0x4d6f33
mov ecx, dword [esp + 0x4ac]
lea eax, [esp + 0xa8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop esi
mov eax, 1
pop ebx
add esp, 0x4a0
ret 8