joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469230
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x530790]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x9c], 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x46926e
mov eax, dword [ebp - 0x9c]
jmp 0x46933f
mov edx, dword [ebp - 8]
push edx
call fcn.004cf158
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x46932d
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x14]
push ecx
push 0x502fe4
mov edx, dword [ebp - 0x10]
push edx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x46932d
cmp dword [ebp + 0xc], 0
je 0x46932d
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
shr ecx, 0x10
and ecx, 0xffff
movzx edx, cx
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
and ecx, 0xffff
movzx edx, cx
push edx
push str.StringFileInfo_04x_04xProductName
push 0x80
lea eax, [ebp - 0x98]
push eax
call fcn.004282b0
add esp, 0x14
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x98]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x46932d
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0041b310
test eax, eax
jl 0x46932d
mov dword [ebp - 0x9c], 1
mov edx, dword [ebp - 0x10]
push edx
call fcn.004cf25c
add esp, 4
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.004cd040
mov esp, ebp
pop ebp
ret

Function at 0x469520
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2018
call fcn.004cf4e0
mov eax, dword [0x530790]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x469556
cmp dword [ebp - 8], 0x1fff
jbe 0x46955a
xor eax, eax
jmp 0x4695bd
lea edx, [ebp - 0x2010]
push edx
mov eax, dword [ebp - 8]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4695bb
lea edx, [ebp - 0x2018]
push edx
lea eax, [ebp - 0x2014]
push eax
push 0x503080
lea ecx, [ebp - 0x2010]
push ecx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4695bb
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x2014]
mov ecx, dword [eax + 0xc]
mov dword [edx], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x2014]
mov ecx, dword [eax + 8]
mov dword [edx + 4], ecx
mov eax, 1
jmp 0x4695bd
xor eax, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004cd040
mov esp, ebp
pop ebp
ret
Function at 0x46c700
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4a0
mov eax, dword [0x530790]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x430], 0
mov dword [ebp - 8], 0
mov byte [ebp - 1], 0
mov dword [ebp - 0x438], 0x209
xor eax, eax
mov word [ebp - 0x428], ax
push 0x410
push 0
lea ecx, [ebp - 0x426]
push ecx
call fcn.004ccbe0
add esp, 0xc
push 0x208
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x428]
push eax
call fcn.0046ff30
add esp, 0xc
lea ecx, [ebp - 0x42c]
push ecx
push 0x8b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 0
je 0x46c901
lea edx, [ebp - 0x43c]
push edx
push 1
push 2
push 0
push 0
mov eax, dword [ebp - 0x42c]
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 0
je 0x46c901
lea ecx, [ebp - 0x430]
push ecx
push 0x507e48
call sub.ADVAPI32.dll_ConvertStringSidToSidW
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 0
je 0x46c901
mov dword [ebp - 0x444], 0
xor edx, edx
mov dword [ebp - 0x440], edx
mov dword [ebp - 0x440], 0x20
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x444], eax
mov ecx, dword [ebp - 0x430]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
add eax, 8
push eax
lea edx, [ebp - 0x444]
push edx
push 0x19
mov eax, dword [ebp - 0x43c]
push eax
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 0
je 0x46c901
mov dword [ebp - 0x4a0], 0
xor ecx, ecx
mov dword [ebp - 0x49c], ecx
mov dword [ebp - 0x498], ecx
mov dword [ebp - 0x494], ecx
mov dword [ebp - 0x490], 0
push 0x40
push 0
lea edx, [ebp - 0x48c]
push edx
call fcn.004ccbe0
add esp, 0xc
lea eax, [ebp - 0x4a0]
push eax
lea ecx, [ebp - 0x490]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x428]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x43c]
push eax
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x4a0], 0
je 0x46c8eb
mov ecx, dword [ebp - 0x4a0]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x49c], 0
je 0x46c901
mov edx, dword [ebp - 0x49c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x430], 0
je 0x46c917
mov eax, dword [ebp - 0x430]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x43c], 0
je 0x46c92d
mov ecx, dword [ebp - 0x43c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x42c], 0
je 0x46c943
mov edx, dword [ebp - 0x42c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 1], 0
cmp dword [ebp - 0x434], 1
jne 0x46c954
mov byte [ebp - 1], 1
mov al, byte [ebp - 1]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004cd040
mov esp, ebp
pop ebp
ret
Function at 0x470ba0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop ebp
ret 0x18
Function at 0x472510
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
movzx eax, byte [ebp + 0x10]
test eax, eax
jne 0x472550
movzx ecx, byte [ebp + 0xc]
test ecx, ecx
je 0x47253f
push 0x43
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x47254b
push 5
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4726a0
lea ecx, [ebp - 0x10]
call fcn.00419640
lea ecx, [ebp - 0x20]
call fcn.00419640
lea ecx, [ebp - 0x10]
call fcn.00419640
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
lea ecx, [ebp - 0x20]
call fcn.00419640
push eax
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0x10]
call fcn.00419900
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x10]
call fcn.004198f0
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x20]
call fcn.00419900
mov esi, eax
lea ecx, [ebp - 0x10]
call fcn.00419900
sub esi, eax
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x20]
call fcn.004198f0
mov esi, eax
lea ecx, [ebp - 0x10]
call fcn.004198f0
sub esi, eax
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0x24]
mov dword [ebp - 4], ecx
push 0
push 0x14
lea edx, [ebp - 0x10]
push edx
call fcn.00417930
add esp, 0xc
movzx eax, byte [ebp + 0x14]
test eax, eax
jne 0x472658
mov dword [ebp - 0x2c], 1
movzx ecx, byte [ebp + 0xc]
test ecx, ecx
jne 0x472627
mov edx, dword [ebp - 0x2c]
or edx, 4
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
push eax
push 0
push 0
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x10]
push edx
movzx eax, byte [ebp + 0xc]
neg eax
sbb eax, eax
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 5
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4726a0
push 1
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
push 0xffffffffffffffff
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 5
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
movzx ecx, byte [ebp + 0xc]
test ecx, ecx
jne 0x4726a0
push 1
push 0
push 0
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 0xfffffffffffffffe
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x48a5a0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jne 0x48a5b3
xor al, al
jmp 0x48a687
mov byte [ebp - 5], 0
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x48a665
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x48a654
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0xc]
mov dword [edx], eax
push 0x534af4
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
call fcn.004cffe9
add esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov edx, dword [ebp + 0xc]
cmp dword [edx], 0
je 0x48a654
mov dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x48a654
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0xc]
jne 0x48a654
mov byte [ebp - 5], 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0
movzx ecx, byte [ebp - 5]
test ecx, ecx
jne 0x48a684
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0048a4d0
add esp, 0xc
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x4b99b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push eax
movzx ecx, word [ebp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4b9a2a
mov edx, dword [ebp - 0xc]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x14]
jae 0x4b9a2a
mov ecx, dword [ebp - 0xc]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4b9a2a
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4b9a2a
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.004cf990
add esp, 0xc
mov eax, 1
jmp 0x4b9a2c
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4b9a30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x14]
push eax
movzx ecx, word [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4b9a8e
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4b9a8e
cmp dword [ebp + 0x10], 0
je 0x4b9a82
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x4b9a90
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4b9aa0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004b9a30
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4b9b1f
cmp dword [ebp - 4], 0
jbe 0x4b9b1f
mov dword [ebp - 0xc], 0
push 0x509f24
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0xc]
push edx
call fcn.004d1e82
add esp, 0xc
cmp dword [ebp - 0xc], 0
je 0x4b9b1f
mov eax, dword [ebp - 0xc]
push eax
push 1
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.004d1d3a
add esp, 0x10
mov eax, dword [ebp - 0xc]
push eax
call fcn.004d1b5c
add esp, 4
mov eax, 1
jmp 0x4b9b21
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4c0c30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f805e
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x530790]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x240], 0
mov eax, dword [0x534910]
and eax, 1
jne 0x4c0ca3
mov ecx, dword [0x534910]
or ecx, 1
mov dword [0x534910], ecx
mov dword [ebp - 4], 0
mov ecx, 0x5348f4
call fcn.0041bcf0
push 0x4fd120
call fcn.004cf0b3
add esp, 4
mov dword [ebp - 4], 0xffffffff
movzx edx, byte [0x5348f0]
cmp edx, 1
jne 0x4c0cd3
push 0x5348f4
mov ecx, dword [ebp + 8]
call fcn.0041bd10
mov eax, dword [ebp - 0x240]
or eax, 1
mov dword [ebp - 0x240], eax
mov eax, dword [ebp + 8]
jmp 0x4c0da8
xor ecx, ecx
mov word [ebp - 0x21c], cx
push 0x206
push 0
lea edx, [ebp - 0x21a]
push edx
call fcn.004ccbe0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4c0d82
mov dword [ebp - 0x23c], 0
lea ecx, [ebp - 0x238]
call fcn.0041bcf0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x23c]
push ecx
movzx edx, word [ebp - 0x21c]
push edx
call fcn.0042aa30
add esp, 8
movzx eax, al
test eax, eax
je 0x4c0d70
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp - 0x23c]
push edx
call fcn.0042b130
add esp, 8
movzx eax, al
test eax, eax
je 0x4c0d70
lea ecx, [ebp - 0x238]
push ecx
mov ecx, 0x5348f4
call fcn.0041bd40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x238]
call fcn.0041ab00
mov byte [0x5348f0], 1
push 0x5348f4
mov ecx, dword [ebp + 8]
call fcn.0041bd10
mov edx, dword [ebp - 0x240]
or edx, 1
mov dword [ebp - 0x240], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004cd040
mov esp, ebp
pop ebp
ret
Function at 0x4c6d60
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f8d89
mov eax, dword fs:[0]
push eax
sub esp, 0x58
mov eax, dword [0x530790]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x5c], 0
cmp dword [ebp + 0xc], 0
jne 0x4c6db5
mov ecx, dword [ebp + 8]
call fcn.0041bcf0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x5c]
or eax, 1
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 8]
jmp 0x4c6f0b
lea ecx, [ebp - 0x2c]
call fcn.0041bcf0
mov dword [ebp - 4], 1
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
je 0x4c6ee7
push 0
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x4c6ed6
push 0x534af4
mov eax, dword [ebp - 0x34]
push eax
call fcn.004cffe9
add esp, 8
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x38], 0
je 0x4c6ed6
mov edx, dword [ebp - 0x34]
push edx
push 0
mov eax, dword [ebp - 0x38]
push eax
call fcn.004ccbe0
add esp, 0xc
mov dword [ebp - 0x3c], 0
push 0
lea ecx, [ebp - 0x3c]
push ecx
mov edx, dword [ebp - 0x34]
push edx
mov eax, dword [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4c6ebd
mov edx, dword [ebp - 0x3c]
cmp edx, dword [ebp - 0x34]
jne 0x4c6ebd
lea ecx, [ebp - 0x4c]
call fcn.004bab30
lea eax, [ebp - 0x4c]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x38]
push edx
call fcn.004c8c70
add esp, 0xc
test eax, eax
je 0x4c6ebd
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x4c]
call fcn.004bab50
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x60]
mov dword [ebp - 0x64], ecx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x64]
call fcn.0042f8b0
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041bd60
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x54]
call fcn.00419a70
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 0x58]
push eax
call fcn.004ccb12
add esp, 4
mov dword [ebp - 0x38], 0
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x30], 0
lea edx, [ebp - 0x2c]
push edx
mov ecx, dword [ebp + 8]
call fcn.0041bd10
mov eax, dword [ebp - 0x5c]
or eax, 1
mov dword [ebp - 0x5c], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.0041ab00
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004cd040
mov esp, ebp
pop ebp
ret
Function at 0x4c9240
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 0
lea edx, [ebp - 8]
push edx
push 0
lea eax, [ebp - 0x14]
push eax
push 0x4c9200
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4c9298
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x4c94b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
jne 0x4c94be
xor al, al
jmp 0x4c950c
mov byte [ebp - 1], 1
call fcn.00468bf0
test eax, eax
je 0x4c94f0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4c94f0
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.0041df30
add esp, 8
cmp eax, 1
jne 0x4c94f0
mov byte [ebp - 1], 0
movzx edx, byte [ebp - 1]
test edx, edx
je 0x4c9501
mov eax, dword [ebp + 8]
push eax
call fcn.0046b990
movzx eax, byte [ebp - 1]
neg eax
sbb eax, eax
add eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4cc750
Capabilities:
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x4f9438
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x530790]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
push 0x4cc280
push 0x534d14
call fcn.004cc490
mov eax, dword [0x534d1c]
add esp, 8
test eax, eax
je 0x4cc7aa
mov ecx, dword [esp + 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
add esp, 0x1c
ret
lea ecx, [esp + 4]
call fcn.004cd0ca
mov dword [esp + 0x10], 0
mov dword [esp + 4], vtable.boost::thread_resource_error.0
lea edx, [esp + 4]
push edx
mov dword [esp + 0x20], 0
call fcn.0043f5b0
int3
Function at 0x4cc7e0
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x4f9468
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x530790]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [0x534d1c]
test eax, eax
jne 0x4cc812
xor esi, esi
jmp 0x4cc81b
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x20], 0
test esi, esi
je 0x4cc847
cmp dword [esi + 0x14], 0
jne 0x4cc889
cmp dword [esi + 0x10], 0
jne 0x4cc890
push 0
call fcn.004cc750
add esp, 4
mov dword [esp + 0x20], 0xffffffff
test esi, esi
je 0x4cc875
lea eax, [esi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x4cc875
mov edx, dword [esi]
mov eax, dword [edx]
push 0
mov ecx, esi
call eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp dword [esi + 0x10], 0
je 0x4cc8d0
nop
mov ebx, dword [esi + 0x10]
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x4cc8be
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x10], 0
jne 0x4cc890
cmp dword [esi + 0x14], 0
je 0x4cc837
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x4cc8f5
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x4cc926
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x4cc926
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x4cc926
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x14], 0
jne 0x4cc8da
jmp 0x4cc831
Function at 0x4cc9c0
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x4f94b8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x530790]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
lea ecx, [eax + 0x1c]
push ecx
push 4
push eax
push 0x4cc940
push 0
push 0
call fcn.004d1a35
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x4cca2b
lea ecx, [esp + 0x10]
call fcn.004cd0ca
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], vtable.boost::thread_resource_error.0
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x2c], ebx
call fcn.0043f5b0
mov eax, dword [edi]
add eax, 4
mov ecx, 1
lock xadd dword [eax], ecx
mov esi, dword [edi]
mov eax, dword [esi + 8]
add esi, 8
test eax, eax
je 0x4cca51
cmp eax, 0xffffffff
je 0x4cca51
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
mov edx, dword [edi]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret

Function at 0x4cd040
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x530790]
jne 0x4cd04a
repz ret
jmp fcn.004d72bc