joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47a640
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b2008
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x4ea008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov ebx, dword [ebp + 8]
test eax, eax
je 0x47a683
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
lea ecx, [ebp - 0x14]
mov word [edi + 4], 0
mov dword [ebp - 0x14], 0
call fcn.0048cb80
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x14]
cmp dword [esi], 0
je 0x47a6ac
lea eax, [esi + 8]
jmp 0x47a6ae
xor eax, eax
cmp dword [ebx + 0x10], 0
je 0x47a6be
cmp dword [ebx + 0x14], 8
jb 0x47a6c0
mov ebx, dword [ebx]
jmp 0x47a6c0
xor ebx, ebx
push ebx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
test eax, eax
je 0x47a6e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x47a6e1
mov byte [edi + 5], 1
cmp dword [edi], 0
setne bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x47a70a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x47a71f
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 4], 0
push 0x2c
push esi
call fcn.004a3252
add esp, 8
mov dword [ebp - 0x14], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a2e83
mov esp, ebp
pop ebp
ret 4
Function at 0x47eb40
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x414]
sub esp, 0x414
push 0xfffffffffffffffe
push 0x4e05d8
push 0x4a36ec
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x4ea008]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x410], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], 0
mov dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x47eba6
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
mov edx, esi
mov ecx, edi
call fcn.0047ec80
mov bl, al
mov byte [ebp - 0x19], bl
mov dword [ebp - 4], 0xfffffffe
jmp 0x47ebdd
test bl, bl
jne 0x47ec5a
cmp edi, 0x1a
jne 0x47ec5a
mov dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x47ebf7
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
push 0x410
push ecx
lea eax, [ebp]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x207
lea eax, [ebp]
push eax
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [ebp]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47ec30
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.004126a0
movzx ebx, bl
mov eax, 1
cmp dword [esi + 0x10], 0
cmovne ebx, eax
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.004a2e83
lea esp, [ebp + 0x414]
pop ebp
ret
Function at 0x47f220
Capabilities:
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x808]
sub esp, 0x808
push 0xffffffffffffffff
push 0x4b2830
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4ea008]
xor eax, ebp
mov dword [ebp + 0x804], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
lea eax, [ebp + 4]
push eax
push 0x3fe
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov ebx, eax
mov dword [ebp - 0x10], ebx
test ebx, ebx
je 0x47f2e7
lea edi, [ebp + 4]
mov dword [ebp], 0
xor esi, esi
mov dword [ebp - 0x14], edi
mov dword [ebp], esi
mov dword [ebp - 4], esi
cmp ebx, 0x3fe
jbe 0x47f30c
xor ecx, ecx
lea eax, [ebx + 2]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004a36e3
add esp, 4
mov dword [ebp - 0x14], eax
mov edi, eax
mov esi, edi
mov dword [ebp], esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x47f2d3
cmp eax, ebx
ja 0x47f2d3
xor ecx, ecx
mov ebx, eax
mov dword [edi + eax*2], ecx
mov dword [ebp - 0x10], ebx
jmp 0x47f330
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x47f2e7
push edi
call fcn.004a34ce
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x804]
xor ecx, ebp
call fcn.004a2e83
lea esp, [ebp + 0x808]
pop ebp
ret
lea eax, [ebx + ebx]
cmp eax, 0x800
jae 0x47f3a3
xor ecx, ecx
mov word [ebp + eax + 4], cx
add eax, 2
cmp eax, 0x800
jae 0x47f3a3
mov word [ebp + eax + 4], cx
xor ecx, ecx
xor edi, edi
test ebx, ebx
je 0x47f388
mov esi, dword [ebp - 0x14]
mov ebx, 2
mov eax, dword [ebp - 0x10]
cmp word [esi + ebx - 2], 0
jne 0x47f37d
cmp ecx, edi
je 0x47f37d
lea eax, [esi + ecx*2]
push eax
lea ecx, [ebp - 0x30]
call fcn.004124f0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 0x18]
push eax
call fcn.0042ee60
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00412640
mov eax, dword [ebp - 0x10]
lea ecx, [edi + 1]
inc edi
add ebx, 2
cmp edi, eax
jb 0x47f343
mov esi, dword [ebp]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x47f39c
push esi
call fcn.004a34ce
add esp, 4
mov al, 1
jmp 0x47f2e9
call fcn.004a35fd
int3
Function at 0x47fdd0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b295b
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x4ea008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi], 0
je 0x47fe09
call fcn.0047ff70
cmp byte [0x4f70f8], 0
jne 0x47fe1c
mov eax, 0x80000001
jmp 0x47ff4c
mov eax, dword [esi]
test eax, eax
jne 0x47fe9c
push 8
call fcn.004a2ea7
mov edi, eax
add esp, 4
mov dword [ebp - 0x138], edi
mov dword [ebp - 4], 0
push 1
call fcn.004a2ea7
add esp, 4
mov dword [edi + 4], eax
mov byte [eax], 0
lea eax, [ebp - 0x130]
push 0x118
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x134], 0x11c
lea eax, [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x47fe8b
cmp dword [ebp - 0x130], 6
mov eax, dword [edi + 4]
setae cl
mov byte [eax], cl
mov dword [ebp - 4], 0xffffffff
mov dword [esi], edi
mov dword [edi], 0
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x47ff3b
call fcn.0048a680
test al, al
jne 0x47fed6
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esi]
push eax
add ecx, 4
call fcn.0048a800
test al, al
je 0x47ff3b
mov ecx, dword [esi]
add ecx, 4
call fcn.0048a150
call fcn.0048a680
test al, al
je 0x47ff3b
push str.Advapi32.dll
lea ecx, [ebp - 0x150]
call fcn.004124f0
mov dword [ebp - 4], 2
lea eax, [ebp - 0x150]
push eax
call fcn.00482190
mov ecx, eax
call fcn.00482250
mov edi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x150]
call fcn.00412640
test edi, edi
je 0x47ff3b
push str.RegOpenCurrentUser
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x47ff3b
push dword [esi]
push dword [ebp + 8]
call eax
test eax, eax
je 0x47ff3b
mov eax, dword [esi]
mov dword [eax], 0
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x47ff4a
mov dword [eax], 0x80000001
mov eax, dword [esi]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a2e83
mov esp, ebp
pop ebp
ret 4
Function at 0x483030
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b303f
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4ea008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
mov edi, dword [ebp + 0xc]
mov ebx, dword [eax + 4]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
lea esi, [edi + 0x94]
cmp esi, ebx
je 0x483093
push esi
mov ecx, edi
call fcn.00484620
add esi, 0x94
add edi, 0x94
cmp esi, ebx
jne 0x483073
mov edi, dword [ebp - 0x10]
mov ebx, dword [edi + 4]
jmp 0x483095
mov edi, eax
lea esi, [ebx - 0x94]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.00412640
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.00412640
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.00412640
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.00412640
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.00412640
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00412640
mov eax, dword [ebp - 0x14]
add dword [edi + 4], 0xffffff6c
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x483d20
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b328f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4ea008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.00412640
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.00412640
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.00412640
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.00412640
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.00412640
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00412640
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x487ca0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x4ea008]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
cmp dword [ebp + 0x10], 0xffffffff
mov edi, dword [esp + 0x20]
je 0x487d22
mov ecx, 0x100000
nop dword [eax]
nop word [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x487d22
test ecx, ecx
je 0x487d1e
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x487ce0
xor eax, eax
jmp 0x487d27
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x487d31
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004a2e83
add esp, 0xc
ret 0xc
Function at 0x48c120
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x4ea008]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
test eax, eax
je 0x48c183
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x48c183
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x48c15e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x48c183
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.004a2e83
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.004a2e83
add esp, 8
ret 4

Function at 0x48c370
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b1b38
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4ea008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
cmp esi, 0xffffffff
jne 0x48c3a8
xor al, al
jmp 0x48c427
and esi, 0xffffb1af
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x48c3b8
mov eax, dword [edi]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
push eax
call ebx
test eax, eax
je 0x48c3ca
mov al, 1
jmp 0x48c427
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x28]
mov ecx, edi
call fcn.0048cae0
test al, al
je 0x48c414
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push esi
cmovae eax, dword [ebp - 0x28]
push eax
call ebx
test eax, eax
je 0x48c414
mov bl, 1
jmp 0x48c416
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00412640
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a2e83
mov esp, ebp
pop ebp
ret
Function at 0x48c450
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b1b38
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4ea008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x48c486
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x48c4ea
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.0048cae0
test al, al
je 0x48c4db
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00412640
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a2e83
mov esp, ebp
pop ebp
ret
Function at 0x48c510
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b4400
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4ea008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x48c547
mov eax, dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call edi
test eax, eax
je 0x48c55b
mov al, 1
jmp 0x48c6e2
cmp dword [esi + 0x14], 8
mov edx, esi
jb 0x48c565
mov edx, dword [esi]
mov ecx, edx
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea ebx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x48c590
sub ecx, ebx
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.004126a0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0048c450
mov ebx, eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00412640
cmp ebx, 0xffffffff
jne 0x48c5d8
xor al, al
jmp 0x48c6e2
cmp dword [esi + 0x14], 8
mov edx, esi
jb 0x48c5e2
mov edx, dword [esi]
mov ecx, edx
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea ebx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x48c610
sub ecx, ebx
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.004126a0
mov dword [ebp - 4], 1
xor edx, edx
lea ecx, [ebp - 0x28]
call fcn.0048c370
mov bl, al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00412640
test bl, bl
je 0x48c5d1
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x48c659
mov eax, dword [esi]
push eax
call edi
test eax, eax
jne 0x48c554
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 2
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.0048cae0
test al, al
je 0x48c6a3
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call edi
test eax, eax
je 0x48c6a3
mov bl, 1
jmp 0x48c6d1
cmp dword [esi + 0x14], 8
jb 0x48c6ab
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x44]
call fcn.004124f0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x44]
mov edx, dword [ebp - 0x2c]
call fcn.0048c370
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x44]
call fcn.00412640
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00412640
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a2e83
mov esp, ebp
pop ebp
ret
Function at 0x48c700
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x624]
sub esp, 0x624
push 0xffffffffffffffff
push 0x4b4438
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4ea008]
xor eax, ebp
mov dword [ebp + 0x620], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 4
lea ecx, [ebp - 0x10]
call fcn.00417630
mov eax, dword [0x4f71b8]
mov dword [ebp - 0x10], 0x4f71b8
test eax, eax
je 0x48c758
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
mov edx, dword [0x4f5cb0]
test edx, edx
je 0x48c7b6
cmp esi, 0x4f5ca0
je 0x48c78d
cmp dword [0x4f5cb4], 8
mov eax, 0x4f5ca0
push edx
cmovae eax, dword [0x4f5ca0]
mov ecx, esi
push eax
call fcn.004126a0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x48c7af
mov eax, dword [eax]
test eax, eax
je 0x48c7a8
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x10], 0
mov al, 1
jmp 0x48c8d0
push 0x20c
lea eax, [ebp + 0x414]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp + 0x414]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x48c8ac
xor eax, eax
push 0x412
push eax
mov word [ebp + 0x61e], ax
lea eax, [ebp]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp]
push 0x208
push eax
lea eax, [ebp + 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x48c850
test eax, eax
je 0x48c850
add eax, eax
cmp eax, 0x412
jae 0x48c8f1
xor ecx, ecx
mov word [ebp + eax], cx
lea ecx, [ebp]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x48c840
lea eax, [ebp]
jmp 0x48c871
lea ecx, [ebp + 0x414]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x48c860
lea eax, [ebp + 0x414]
sub ecx, edx
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.004126a0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x48c7af
mov eax, dword [eax]
test eax, eax
je 0x48c7a8
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x10], 0
mov al, 1
jmp 0x48c8d0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x48c8ce
mov eax, dword [eax]
test eax, eax
je 0x48c8c7
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x10], 0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp + 0x620]
xor ecx, ebp
call fcn.004a2e83
lea esp, [ebp + 0x624]
pop ebp
ret
call fcn.004a35fd
int3
Function at 0x48ccf0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4e22e0
push 0x4a36ec
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x4ea008]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], 0
xor esi, esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x2c], esi
xor ebx, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x24], ebx
mov word [ebp - 0x20], 0x100
mov eax, dword [ecx]
mov edi, dword [eax + 0x28]
mov dword [ebp - 0x40], edi
test edi, edi
jne 0x48cd59
xor eax, eax
jmp 0x48cecf
mov dword [ebp - 4], ebx
push str.InitializeSecurityDescriptor
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48ce9a
push 1
push dword [ebp - 0x34]
call eax
test eax, eax
je 0x48ce9a
push str.AllocateAndInitializeSid
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48ce9a
lea ecx, [ebp - 0x28]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x24]
push ecx
call eax
test eax, eax
je 0x48ce9a
push str.GetLengthSid
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48ce9a
push dword [ebp - 0x28]
call eax
add eax, 0x10
mov dword [ebp - 0x30], eax
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x3c], esi
test esi, esi
je 0x48ce9a
push str.InitializeAcl
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48ce9a
push 2
push dword [ebp - 0x30]
push esi
call eax
test eax, eax
je 0x48ce9a
push str.AddAccessAllowedAce
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x48ce9a
push dword [ebp - 0x28]
push 0x10000000
push 2
push esi
call eax
test eax, eax
je 0x48ce9a
push str.SetSecurityDescriptorDacl
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x30], eax
test eax, eax
je 0x48ce9a
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x48ce83
push 0
push ecx
push 1
push dword [ebp - 0x34]
call eax
test eax, eax
je 0x48ce70
mov ebx, 1
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x2c], 0
je 0x48ce80
jmp 0x48ce9a
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x30]
push 0
push esi
push 1
push dword [ebp - 0x34]
call eax
mov ecx, 1
test eax, eax
cmovne ebx, ecx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 4], 0xfffffffe
call fcn.0048cef6
test ebx, ebx
jne 0x48cecd
test esi, esi
je 0x48cebf
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x48cecd
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004a2e83
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4901d0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b317f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4ea008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, dword [ebp + 8]
mov ecx, edi
push esi
mov dword [ebp - 0x10], edi
call fcn.00412560
mov dword [ebp - 4], 0
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.00412560
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.00412560
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.00412560
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.00412560
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.00412560
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x491ea0
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x4ea008]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x491f05
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x491ee0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x491f05
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.004a2e83
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.004a2e83
add esp, 8
ret 4