joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ea00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e85cb
mov eax, dword fs:[0]
push eax
sub esp, 0x55c
mov eax, dword [0x519220]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call esi
push 1
mov edi, eax
call esi
push 0
mov ebx, eax
mov dword [ebp - 0x548], 0
lea eax, [ebp - 0x548]
push eax
push 0
push 0x72
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
cmp dword [ebp - 0x548], 0
je 0x43ea6d
mov al, 1
jmp 0x43ec5a
mov esi, dword [sym.imp.USER32.dll_WindowFromPoint]
dec ebx
push 0
push 0
dec edi
call esi
push ebx
push 0
mov dword [ebp - 0x54c], eax
call esi
push 0
push edi
mov dword [ebp - 0x564], eax
call esi
push ebx
push edi
mov dword [ebp - 0x568], eax
call esi
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp - 0x550], eax
lea eax, [ebp - 0x558]
push eax
push dword [ebp - 0x54c]
call esi
mov edi, dword [ebp - 0x564]
lea eax, [ebp - 0x554]
push eax
push edi
call esi
mov ebx, dword [ebp - 0x568]
lea eax, [ebp - 0x55c]
push eax
push ebx
call esi
lea eax, [ebp - 0x560]
push eax
push dword [ebp - 0x550]
call esi
push 0x104
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
sub esp, 0x10
lea eax, [ebp - 0x420]
lea ecx, [ebp - 0x544]
push str.explorer.exe
push eax
call fcn.0040f6f0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x218]
cmp byte [ebp - 0x428], 0
lea esi, [ebp - 0x538]
push 0x208
cmove esi, dword [ebp - 0x53c]
push 0
push eax
call fcn.00491400
mov ecx, dword [ebp - 0x558]
lea edx, [ebp - 0x218]
add esp, 8
call fcn.0043e6c0
add esp, 4
test al, al
je 0x43eb7a
lea eax, [esi + 4]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004ba77a
add esp, 8
test eax, eax
sete al
test al, al
jne 0x43ec2a
cmp byte [ebp - 0x428], 0
lea edx, [ebp - 0x538]
mov ecx, dword [ebp - 0x554]
cmove edx, dword [ebp - 0x53c]
add edx, 4
call fcn.0043e980
test al, al
jne 0x43ec2a
cmp byte [ebp - 0x428], al
lea edx, [ebp - 0x538]
mov ecx, dword [ebp - 0x55c]
cmove edx, dword [ebp - 0x53c]
add edx, 4
call fcn.0043e980
test al, al
jne 0x43ec2a
cmp byte [ebp - 0x428], al
lea edx, [ebp - 0x538]
mov ecx, dword [ebp - 0x560]
cmove edx, dword [ebp - 0x53c]
add edx, 4
call fcn.0043e980
test al, al
jne 0x43ec2a
cmp dword [ebp - 0x54c], edi
jne 0x43ec06
cmp ebx, dword [ebp - 0x550]
jne 0x43ec06
cmp edi, ebx
jne 0x43ec06
mov bl, 1
jmp 0x43ec2c
mov eax, dword [ebp - 0x554]
cmp dword [ebp - 0x558], eax
jne 0x43ec2a
mov ecx, dword [ebp - 0x55c]
cmp eax, ecx
jne 0x43ec2a
cmp ecx, dword [ebp - 0x560]
jne 0x43ec2a
mov bl, 1
jmp 0x43ec2c
xor bl, bl
cmp byte [ebp - 0x428], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x43ec58
mov eax, dword [ebp - 0x53c]
lea ecx, [ebp - 0x538]
cmp eax, ecx
je 0x43ec58
push eax
call fcn.0049c7b1
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048f1b0
mov esp, ebp
pop ebp
ret
Function at 0x4419d0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov ecx, dword [ebp + 8]
mov esi, edi
cmp ecx, 3
jl 0x441a67
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
lea eax, [edx + edx*2]
sub ecx, eax
mov dword [ebp + 8], ecx
nop dword [eax]
movzx eax, byte [ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], al
movzx ecx, byte [ebx]
movzx eax, byte [ebx + 1]
and ecx, 3
shr eax, 4
shl ecx, 4
or ecx, eax
movzx eax, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 1], al
movzx ecx, byte [ebx + 1]
movzx eax, byte [ebx + 2]
and ecx, 0xf
shr eax, 6
shl ecx, 2
or ecx, eax
movzx eax, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 2], al
movzx eax, byte [ebx + 2]
add ebx, 3
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 3], al
add esi, 4
sub edx, 1
jne 0x441a00
mov ecx, dword [ebp + 8]
test ecx, ecx
jle 0x441abb
movzx eax, byte [ebx]
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], al
mov dl, byte [ebx]
and dl, 3
shl dl, 4
cmp ecx, 1
jle 0x441a8e
mov al, byte [ebx + 1]
shr al, 4
or dl, al
movzx eax, dl
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 1], al
cmp ecx, 2
jge 0x441aa3
mov al, 0x3d
jmp 0x441ab1
movzx eax, byte [ebx + 1]
and eax, 0xf
mov al, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi + 2], al
mov byte [esi + 3], 0x3d
add esi, 4
mov byte [esi], 0
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x441ac1
sub edi, ecx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4435d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea edx, [ebp - 4]
mov dword [ebp - 4], 0
call fcn.004449d0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x443740
cmp dword [0x51a7f8], eax
je 0x4436ea
push esi
push 0x535c20
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea edx, [ebp - 4]
call fcn.004449d0
mov esi, dword [ebp - 4]
test esi, esi
jne 0x4436d8
push 0x2014
call fcn.0048ed6f
add esp, 4
mov dword [ebp - 4], eax
mov ecx, eax
call fcn.004434d0
cmp dword [0x51a7f8], 0
mov esi, eax
je 0x4436d8
push ebx
push dword [0x51a800]
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call ebx
test eax, eax
je 0x4436d7
cmp dword [eax], 0xd
jbe 0x4436d7
mov eax, dword [eax + 8]
push edi
mov edi, dword [eax + 0x34]
test edi, edi
jne 0x4436a0
push 8
call fcn.0048ed6f
mov edi, eax
add esp, 4
mov dword [ebp - 4], edi
mov dword [edi], vtable.t_visualDataItemPtr_class_t_perfManager_.0
mov dword [edi + 4], esi
cmp dword [0x51a7f8], 0
je 0x4436d6
push dword [0x51a800]
call ebx
test eax, eax
je 0x4436d6
cmp dword [eax], 0xd
jbe 0x4436d6
mov eax, dword [eax + 8]
mov dword [eax + 0x34], edi
jmp 0x4436d6
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
cmp eax, vtable.t_visualDataItemPtr_class_t_perfManager_.0
jne 0x443744
mov ebx, dword [edi + 4]
test ebx, ebx
je 0x4436d3
mov ecx, ebx
mov dword [edi + 4], 0
call fcn.00443520
push 0x2014
push ebx
call fcn.0048ed9f
add esp, 8
mov dword [edi + 4], esi
pop edi
pop ebx
push 0x535c20
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [0x5360dc]
test eax, eax
jne 0x443740
push 0x535c20
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x537628]
test al, 1
jne 0x443726
or eax, 1
mov ecx, 0x537630
mov dword [0x537628], eax
call fcn.004434d0
push 0x4ecb10
call fcn.0048f19b
add esp, 4
push 0x535c20
mov dword [0x5360dc], 0x537630
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0x5360dc]
mov esp, ebp
pop ebp
ret
push esi
mov ecx, edi
call edx
jmp 0x4436d6

Function at 0x4449d0
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x51a7f8], 0
push esi
mov esi, edx
je 0x444a2f
push dword [0x51a800]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x444a2f
cmp dword [eax], 0xd
jbe 0x444a2f
mov eax, dword [eax + 8]
mov eax, dword [eax + 0x34]
test eax, eax
je 0x444a2f
push 0
push 0x51c230
push 0x51c268
push 0
push eax
call fcn.004e49f1
add esp, 0x14
test eax, eax
je 0x444a2f
mov edx, dword [eax]
cmp edx, vtable.t_visualDataItemPtr_class_t_perfManager_.0
jne 0x444a33
mov eax, dword [eax + 4]
mov dword [esi], eax
mov al, 1
pop esi
ret
mov dword [esi], eax
mov al, 1
pop esi
ret
xor al, al
pop esi
ret
mov ecx, eax
call dword [edx + 8]
jmp 0x444a29
Function at 0x445950
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e8a0b
mov eax, dword fs:[0]
push eax
sub esp, 0x35c
mov eax, dword [0x519220]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x368]
call fcn.00432d90
mov dword [ebp - method.t_fileWrite.virtual_0], vtable.t_fileWrite.0
mov dword [ebp - 0x14], vtable.t_fileWrite.1.0
mov dword [ebp - 4], 0
lea eax, [edi + 0xc]
cmp byte [edi + 0x11c], 0
jne 0x4459b9
mov eax, dword [edi + 8]
push 0x80
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 1
push edi
push ebx
lea ecx, [ebp - 0x368]
call fcn.00432f30
test al, al
je 0x445a31
push 2
push 0x505ea4
push ebx
lea ecx, [ebp - 0x14]
call fcn.00446bc0
test al, al
je 0x445a31
push dword [esi + 0xc]
lea ecx, [ebp - 0x14]
push dword [esi + 4]
push ebx
call fcn.00446bc0
test al, al
je 0x445a31
lea ecx, [ebp - 0x368]
call fcn.00433310
push dword [esi + 4]
call fcn.0049c7b1
add esp, 4
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov bl, 1
mov dword [esi + 0xc], 0
jmp 0x445a33
xor bl, bl
lea ecx, [ebp - 0x368]
mov dword [ebp - method.t_fileWrite.virtual_0], vtable.t_fileWrite.0
mov dword [ebp - 0x14], vtable.t_byteStreamWrite.0
call fcn.00432e70
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048f1b0
mov esp, ebp
pop ebp
ret 0xc
Function at 0x446100
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e8a6b
mov eax, dword fs:[0]
push eax
sub esp, 0x36c
mov eax, dword [0x519220]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test eax, eax
je 0x446159
push eax
call fcn.0049c7b1
add esp, 4
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
push ecx
lea ecx, [ebp - 0x370]
call fcn.00432d90
mov dword [ebp - method.t_fileRead.1.virtual_0], vtable.t_fileRead.1.0
mov dword [ebp - 0x1c], vtable.t_fileRead.0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
push 0
push esi
push ebx
lea ecx, [ebp - 0x370]
mov dword [ebp - 4], 0
call fcn.00432f30
test al, al
je 0x4462e0
lea eax, [ebp - 0x374]
mov dword [ebp - 0x374], 0
push eax
push dword [ebp - 0x36c]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x378], eax
cmp eax, 0xffffffff
jne 0x4461de
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4461d8
xor eax, eax
jmp 0x4461de
mov eax, dword [ebp - 0x378]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x378]
push eax
push dword [ebp - 0x36c]
mov dword [ebp - 0x378], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x374], eax
cmp eax, 0xffffffff
jne 0x446223
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x44621d
xor eax, eax
mov dword [ebp - 0x374], eax
jmp 0x446223
mov eax, dword [ebp - 0x374]
add eax, 4
push eax
call fcn.004af1b3
add esp, 4
mov dword [ebp - 0x378], eax
test eax, eax
jne 0x44625c
mov dword [edi + 0x24], 2
cmp byte [esi + 0x11c], al
je 0x446252
add esi, 0xc
push 0x5092ec
jmp 0x44628d
mov esi, dword [esi + 8]
push 0x5092ec
jmp 0x44628d
push dword [ebp - 0x374]
lea ecx, [ebp - 0x1c]
push eax
push ebx
call fcn.00446df0
test al, al
jne 0x4462a8
mov dword [edi + 0x24], 3
cmp byte [esi + 0x11c], 0
je 0x446285
add esi, 0xc
jmp 0x446288
mov esi, dword [esi + 8]
push 0x506244
mov ecx, ebx
call fcn.004062d0
lea ecx, [esi + 4]
push ecx
push 0x50258c
push eax
call fcn.00405280
add esp, 0xc
jmp 0x4462e7
lea ecx, [ebp - 0x370]
call fcn.00433310
mov ecx, dword [ebp - 0x378]
xor edx, edx
mov eax, dword [ebp - 0x374]
push ecx
push eax
push ecx
mov dword [ecx + eax], edx
mov ecx, edi
push ebx
call fcn.00446600
test al, al
jne 0x4462dc
mov dword [edi + 0x24], 4
jmp 0x446277
mov bl, 1
jmp 0x4462e9
mov dword [edi + 0x24], 1
xor bl, bl
lea ecx, [ebp - 0x370]
mov dword [ebp - method.t_fileRead.1.virtual_0], vtable.t_fileRead.1.0
mov dword [ebp - 0x1c], vtable.t_byteStreamRead.0
call fcn.00432e70
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048f1b0
mov esp, ebp
pop ebp
ret 0x10
Function at 0x446b80
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x446b99
mov eax, dword [esi + 8]
push 0x80
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 1
push esi
push dword [ebp + 8]
mov ecx, edi
call fcn.00432f30
test al, al
pop edi
setne al
pop esi
pop ebp
ret 0xc

Function at 0x446bc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push 0
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], 0
push dword [esi - 0x350]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x446c40
lea edi, [esi - 0x33c]
cmp byte [esi - 0x22c], al
jne 0x446c09
mov edi, dword [esi - 0x340]
mov ecx, dword [ebp + 8]
call fcn.00429910
push 0x5062a4
mov esi, eax
push 0x50258c
push esi
call fcn.00405280
lea ecx, [edi + 4]
push ecx
push 0x50258c
push esi
call fcn.00405280
add esp, 0x18
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp - 4]
cmp edi, ebx
je 0x446cd6
cmp byte [esi - 0x22c], 0
lea ebx, [esi - 0x33c]
jne 0x446c60
mov ebx, dword [esi - 0x340]
mov ecx, dword [ebp + 8]
push 0x509410
call fcn.004062d0
push 0x509420
mov esi, eax
push 0x50258c
push esi
call fcn.00405280
push dword [ebp + 0x10]
push 0x50256c
push esi
call fcn.00405280
push 0x50942c
push 0x50258c
push esi
call fcn.00405280
push edi
push 0x50256c
push esi
call fcn.00405280
push 0x50943c
push 0x50258c
push esi
call fcn.00405280
lea eax, [ebx + 4]
push eax
push 0x50258c
push esi
call fcn.00405280
add esp, 0x48
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x446df0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x446ef3
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push edi
push dword [ebp + 0xc]
push dword [esi - 0x350]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x446e76
lea edi, [esi - 0x33c]
cmp byte [esi - 0x22c], al
jne 0x446e40
mov edi, dword [esi - 0x340]
mov ecx, dword [ebp + 8]
call fcn.00429910
push 0x506274
mov esi, eax
push 0x50258c
push esi
call fcn.00405280
lea ecx, [edi + 4]
push ecx
push 0x50258c
push esi
call fcn.00405280
add esp, 0x18
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
test ecx, ecx
jne 0x446ebc
cmp byte [esi - 0x22c], cl
je 0x446e8d
add esi, 0xfffffcc4
jmp 0x446e93
mov esi, dword [esi - 0x340]
mov ecx, dword [ebp + 8]
push 0x506284
call fcn.004062d0
lea ecx, [esi + 4]
push ecx
push 0x50258c
push eax
call fcn.00405280
add esp, 0xc
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
cmp ecx, edi
je 0x446ef3
cmp byte [esi - 0x22c], 0
lea eax, [esi - 0x33c]
jne 0x446ed5
mov eax, dword [esi - 0x340]
add eax, 4
push eax
push ecx
push edi
push str.penc_rN
push dword [ebp + 8]
call fcn.00428940
add esp, 0x14
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
add dword [esi + 8], edi
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x447680
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e8ae7
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x519220]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
lea edx, [esi + 0x20]
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], fcn.004af1b3
mov dword [esi + 0x18], fcn.004e1c5f
mov dword [esi + 0x1c], fcn.0049c7b1
mov dword [edx + 4], fcn.004af1b3
mov dword [edx + 8], fcn.004e1c5f
mov dword [edx + 0xc], fcn.0049c7b1
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0x1fff8
mov dword [edx], vtable.t_heap.0
mov dword [esi + 0x3c], fcn.004af1b3
mov dword [esi + 0x40], fcn.004e1c5f
mov dword [esi + 0x44], fcn.0049c7b1
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0x8000
mov dword [esi + 0x38], vtable.t_heap.0
mov dword [esi + 0x50], 0
mov byte [esi + 0x54], 1
mov dword [ebp - 4], 0
lea eax, [esi + 0x58]
mov dword [esi], vtable.t_configSignatureFile.0
mov dword [ebp - 0x14], eax
mov byte [eax + 4], 0
mov dword [eax + 8], str.setting
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], fcn.004af1b3
mov dword [eax + 0x20], fcn.004e1c5f
mov dword [eax + 0x24], fcn.0049c7b1
mov dword [eax + 0x28], edx
mov dword [eax], vtable.t_configSignatureFile::t_setting.0
mov byte [eax + 0x30], 0
mov dword [eax + 0x34], str.exeCnt
mov dword [eax + 0x38], 0
mov dword [eax + 0x3c], 0
mov dword [eax + 0x2c], vtable.n_config::t_int.0
mov byte [eax + 0x44], 0
mov dword [eax + 0x48], str.dllCnt
mov dword [eax + 0x4c], 0
mov dword [eax + 0x50], 0
mov dword [eax + 0x40], vtable.n_config::t_int.0
lea ecx, [esi + 0xac]
mov dword [ebp - 0x14], ecx
mov byte [ecx + 4], 0
mov dword [ecx + 8], 0x503f30
mov dword [ecx + 0xc], edx
mov dword [ecx + 0x10], 0
lea eax, [esi + 0x84]
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x20], fcn.004af1b3
mov dword [ecx + 0x24], fcn.004e1c5f
mov dword [ecx + 0x28], fcn.0049c7b1
mov dword [ecx], vtable.n_config::t_arraySection_class_t_configSignatureFile::t_signature_.0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], eax
lea ecx, [esi + 0xe0]
mov dword [ebp - 0x14], ecx
mov byte [ecx + 4], 0
mov dword [ecx + 8], 0x5094b8
mov dword [ecx + 0xc], edx
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x20], fcn.004af1b3
mov dword [ecx + 0x24], fcn.004e1c5f
mov dword [ecx + 0x28], fcn.0049c7b1
lea eax, [esi + 0x98]
mov dword [ecx], vtable.n_config::t_arraySection_class_t_configSignatureFile::t_signature_.0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], eax
mov ecx, esi
mov byte [ebp - 4], 6
call fcn.004478b0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x449790
Capabilities:
Hash data with md5
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b0
mov eax, dword [0x519220]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x5029a8
push ecx
lea eax, [ebp - 0x4b0]
mov dword [ebp - 0x4b0], 0
push eax
mov ebx, edx
call fcn.0049cf87
mov eax, dword [ebp - 0x4b0]
add esp, 0xc
test eax, eax
jne 0x4497e0
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048f1b0
mov esp, ebp
pop ebp
ret
push esi
push edi
push eax
push 0x400
lea eax, [ebp - 0x404]
mov dword [ebp - 0x4a4], 0x67452301
push 1
xor edi, edi
mov dword [ebp - 0x4a0], 0xefcdab89
xor esi, esi
mov dword [ebp - 0x4a8], edi
push eax
mov dword [ebp - 0x4ac], esi
mov dword [ebp - 0x49c], 0x98badcfe
mov dword [ebp - 0x498], 0x10325476
call fcn.004af79d
add esp, 0x10
test eax, eax
je 0x449875
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x4ac]
push eax
call fcn.004013c0
push dword [ebp - 0x4b0]
lea eax, [ebp - 0x404]
push 0x400
push 1
push eax
call fcn.004af79d
add esp, 0x1c
test eax, eax
jne 0x449835
mov edi, dword [ebp - 0x4a8]
mov esi, dword [ebp - 0x4ac]
mov dword [ebp - 0x40c], esi
mov ecx, 0x38
shr esi, 3
mov eax, 0x78
and esi, 0x3f
mov dword [ebp - 0x408], edi
sub eax, esi
sub ecx, esi
cmp esi, 0x38
cmovb eax, ecx
push eax
lea eax, [ebp - 0x4ac]
push 0x519b90
push eax
call fcn.004013c0
add esp, 0xc
lea edx, [ebp - 0x492]
xor esi, esi
nop dword [eax + eax]
movzx ecx, byte [edx + 1]
lea edx, [edx + 4]
movzx eax, byte [edx - 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 6]
shl ecx, 8
or ecx, eax
mov dword [ebp + esi*4 - 0x444], ecx
inc esi
cmp esi, 0xe
jb 0x4498c0
lea edx, [ebp - 0x444]
lea ecx, [ebp - 0x4a4]
call fcn.00401590
mov eax, dword [ebp - 0x4a4]
mov byte [ebx], al
mov byte [ebx + 1], ah
movzx eax, byte [ebp - 0x4a2]
mov byte [ebx + 2], al
movzx eax, byte [ebp - 0x4a1]
push dword [ebp - 0x4b0]
mov byte [ebx + 3], al
mov eax, dword [ebp - 0x4a0]
mov byte [ebx + 4], al
mov byte [ebx + 5], ah
movzx eax, byte [ebp - 0x49e]
mov byte [ebx + 6], al
movzx eax, byte [ebp - 0x49d]
mov byte [ebx + 7], al
mov eax, dword [ebp - 0x49c]
mov byte [ebx + 8], al
mov byte [ebx + 9], ah
movzx eax, byte [ebp - 0x49a]
mov byte [ebx + 0xa], al
movzx eax, byte [ebp - 0x499]
mov byte [ebx + 0xb], al
mov eax, dword [ebp - 0x498]
mov byte [ebx + 0xc], al
mov byte [ebx + 0xd], ah
movzx eax, byte [ebp - 0x496]
mov byte [ebx + 0xe], al
movzx eax, byte [ebp - 0x495]
mov byte [ebx + 0xf], al
call fcn.0049cc86
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov al, 1
pop edi
pop esi
pop ebx
call fcn.0048f1b0
mov esp, ebp
pop ebp
ret
Function at 0x44b0f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e8e67
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x519220]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov al, byte [ebp + 8]
lea edx, [esi + 0x20]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], fcn.004af1b3
mov dword [esi + 0x18], fcn.004e1c5f
mov dword [esi + 0x1c], fcn.0049c7b1
mov dword [edx + 4], fcn.004af1b3
mov dword [edx + 8], fcn.004e1c5f
mov dword [edx + 0xc], fcn.0049c7b1
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0x1fff8
mov dword [edx], vtable.t_heap.0
mov dword [esi + 0x3c], fcn.004af1b3
mov dword [esi + 0x40], fcn.004e1c5f
mov dword [esi + 0x44], fcn.0049c7b1
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0x8000
mov dword [esi + 0x38], vtable.t_heap.0
mov dword [esi + 0x50], 0
mov byte [esi + 0x54], al
mov dword [ebp - 4], 0
lea eax, [esi + 0x58]
mov dword [esi], vtable.t_hookConfigFile.0
mov dword [ebp + 8], eax
mov byte [eax + 4], 0
mov dword [eax + 8], str.setting
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x1c], fcn.004af1b3
mov dword [eax + 0x20], fcn.004e1c5f
mov dword [eax + 0x24], fcn.0049c7b1
mov dword [eax + 0x28], edx
mov dword [eax], vtable.t_hookConfigFile::t_setting.0
mov byte [eax + 0x30], 0
mov dword [eax + 0x34], str.cfwcnt
mov dword [eax + 0x38], 0
mov dword [eax + 0x3c], 0
mov dword [eax + 0x2c], vtable.n_config::t_int.0
mov byte [eax + 0x44], 0
mov dword [eax + 0x48], str.gmfnwcnt
mov dword [eax + 0x4c], 0
mov dword [eax + 0x50], 0
mov dword [eax + 0x40], vtable.n_config::t_int.0
mov byte [eax + 0x58], 0
mov dword [eax + 0x5c], str.version
mov dword [eax + 0x60], 0x4fc160
mov dword [eax + 0x64], 0x4fc160
mov dword [eax + 0x54], vtable.n_config::t_str.0
mov dword [eax + 0x68], 0
lea ecx, [esi + 0xc4]
mov dword [ebp + 8], ecx
mov byte [ecx + 4], 0
mov dword [ecx + 8], 0x5095e4
mov dword [ecx + 0xc], edx
mov dword [ecx + 0x10], 0
lea eax, [esi + 0x84]
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x20], fcn.004af1b3
mov dword [ecx + 0x24], fcn.004e1c5f
mov dword [ecx + 0x28], fcn.0049c7b1
mov dword [ecx], vtable.n_config::t_arraySection_class_t_hookConfigFile::t_item_.0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], eax
lea ecx, [esi + 0xf8]
mov dword [ebp + 8], ecx
mov byte [ecx + 4], 0
mov dword [ecx + 8], str.gmfn
mov dword [ecx + 0xc], edx
mov dword [ecx + 0x10], 0
lea eax, [esi + 0x98]
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x20], fcn.004af1b3
mov dword [ecx + 0x24], fcn.004e1c5f
mov dword [ecx + 0x28], fcn.0049c7b1
mov dword [ecx], vtable.n_config::t_arraySection_class_t_hookConfigFile::t_item_.0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], eax
mov ecx, esi
mov byte [ebp - 4], 6
call fcn.0044b3e0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4