joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4863e0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f2026
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x70
mov eax, dword [0x571180]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov eax, dword [ebx + 8]
push eax
mov dword [ebp - 0x20], edi
call fcn.00440e30
mov dword [ebp - 4], 0
lea eax, [edi + 0x20]
mov dword [edi + 0x18], 0
xor esi, esi
mov dword [edi + 0x1c], 0xa
mov dword [ebp - 0x18], eax
push 0x40
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.004c2e67
mov edi, eax
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword [edi], edi
mov dword [edi + 4], edi
mov dword [edi + 8], edi
mov word [edi + 0xc], 0x101
mov dword [eax], edi
mov byte [ebp - 4], 1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x80]
push 0xc
xorps xmm0, xmm0
mov dword [ebp - 0x70], esi
push str.Content_Type
movups xmmword [ebp - 0x80], xmm0
mov dword [ebp - 0x6c], esi
call fcn.00441090
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x68]
push 0x18
xorps xmm0, xmm0
mov dword [ebp - 0x58], esi
push str.text_html__charsetutf_8
movups xmmword [ebp - 0x68], xmm0
mov dword [ebp - 0x54], esi
call fcn.00441090
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x50]
push 6
xorps xmm0, xmm0
mov dword [ebp - 0x40], esi
push str.Accept
movups xmmword [ebp - 0x50], xmm0
mov dword [ebp - 0x3c], esi
call fcn.00441090
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x38]
push 3
xorps xmm0, xmm0
mov dword [ebp - 0x28], esi
push 0x54dda8
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x24], esi
call fcn.00441090
mov byte [ebp - 4], 6
lea eax, [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x80]
push eax
push ecx
lea ecx, [esi + 0x28]
call fcn.00487500
push fcn.00479da0
push 2
mov byte [ebp - 4], 8
lea eax, [ebp - 0x80]
push 0x30
push eax
call fcn.004c302c
lea ecx, [esi + 0x30]
xorps xmm0, xmm0
push 0
movups xmmword [ecx], xmm0
push 0x534829
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00441090
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004c2e59
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x486920
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f20fb
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x571180]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
sub esp, 0x18
mov dword [ebp - 4], 0
lea eax, [ebp + 0xc]
mov ecx, esp
push eax
call fcn.00440e30
push dword [ebp + 8]
mov ecx, edi
call fcn.004867f0
xorps xmm0, xmm0
movups xmmword [edi + 0x1c], xmm0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0xf
mov byte [edi + 0x1c], 0
movups xmmword [edi + 0x34], xmm0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0xf
mov byte [edi + 0x34], 0
lea esi, [edi + 0x4c]
mov byte [ebp - 4], 3
push 0x38
mov dword [ebp - 0x10], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004c2e67
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov ecx, dword [ebp + 0x20]
mov dword [esi], eax
cmp ecx, 0xf
jbe 0x4869fe
mov edx, dword [ebp + 0xc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4869f4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x486a13
push ecx
push edx
call fcn.004c2e97
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x1c
call fcn.004c89de
int3
Function at 0x48cad0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f2fdc
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x571180]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [edi], eax
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
lea esi, [edi + 0x38]
mov dword [edi + 0x30], 0
mov byte [edi + 0x34], 0
mov dword [ebp - 0x14], esi
mov dword [esi + 0x24], 0
mov byte [ebp - 4], 4
mov ecx, dword [ebp + 0x30]
test ecx, ecx
je 0x48cb84
mov eax, dword [ecx]
push esi
call dword [eax]
mov dword [esi + 0x24], eax
mov al, byte [ebp + 0x34]
lea ecx, [edi + 0x70]
mov byte [ebp - 4], 5
mov byte [edi + 0x60], al
push 9
mov byte [edi + 0x68], 9
call fcn.00489860
lea eax, [ebp - 0xd]
mov byte [ebp - 4], 6
push eax
lea ecx, [edi + 0x10]
mov byte [ebp - 0xd], 1
call fcn.0048d900
mov ecx, dword [ebp + 0x30]
test ecx, ecx
je 0x48cbc8
mov esi, dword [ecx]
lea eax, [ebp + 0xc]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x30
Function at 0x48f7d0
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f3237
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x18
mov eax, dword [0x571180]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
mov esi, dword [ebx + 8]
push 0xa0
mov dword [ebp - 0x20], esi
call fcn.004c2e67
mov edi, eax
add esp, 4
mov dword [ebp - 0x24], edi
mov dword [ebp - 4], 0
mov eax, dword [esi]
mov dword [esi], 0
mov dword [edi], eax
mov byte [edi + 4], 0
mov al, byte [esi + 8]
mov dword [ebp - 0x18], edi
mov byte [edi + 8], al
lea eax, [esi + 0xc]
mov byte [ebp - 4], 1
push eax
lea ecx, [edi + 0xc]
call fcn.0048a010
add esi, 0x58
mov dword [edi + 0x7c], 0
lea edx, [edi + 0x58]
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x48f89b
cmp ecx, esi
jne 0x48f891
mov eax, dword [ecx]
push edx
mov eax, dword [eax + 4]
call eax
mov dword [edi + 0x7c], eax
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x48f89b
mov edx, dword [ecx]
cmp ecx, esi
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
jmp 0x48f894
mov dword [edx + 0x24], ecx
mov dword [esi + 0x24], 0
mov ecx, dword [ebp - 0x20]
xorps xmm0, xmm0
mov dword [ebp - 0x18], edi
mov eax, dword [ecx + 0x80]
mov dword [edi + 0x80], eax
movups xmmword [edi + 0x84], xmm0
mov dword [edi + 0x94], 0
mov dword [edi + 0x98], 0
movups xmm0, xmmword [ecx + 0x84]
movups xmmword [edi + 0x84], xmm0
movq xmm0, qword [ecx + 0x94]
movq qword [edi + 0x94], xmm0
mov dword [ecx + 0x94], 0
mov dword [ecx + 0x98], 0xf
mov byte [ecx + 0x84], 0
mov eax, dword [ecx + 0x9c]
mov dword [edi + 0x9c], eax
mov esi, dword [ebp - 0x1c]
add esi, 4
mov dword [ebp - 4], 2
push esi
push 0
push edi
push 0x4946e0
push 0
push 0
call fcn.004d1393
mov ecx, dword [ebp - 0x1c]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
je 0x48f95d
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004c2e59
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
push 6
mov dword [esi], 0
call fcn.004c0f09
int3
Function at 0x498a80
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x571180]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x5814b4], 0
push ebx
push esi
push edi
jne 0x498aaa
cmp dword [0x5814bc], 0
je 0x498aaa
call fcn.00462090
mov ebx, dword [0x57bab8]
lea eax, [ebp - 0x30]
push eax
push dword [0x5814c4]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x30]
movd xmm1, eax
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x2c]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [ebp - 0x18]
cvtdq2ps xmm0, xmm0
push eax
movss dword [ebx + 0x10], xmm1
movss dword [ebx + 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [ebp - 0x18]
mov ecx, edi
sub ecx, dword [0x5814c8]
mov esi, dword [ebp - 0x14]
mov edx, esi
sbb edx, dword [0x5814cc]
call fcn.004c3b00
mov edx, dword [0x5814d4]
mov ecx, dword [0x5814d0]
cvtsd2ss xmm0, xmm0
movss dword [ebp - 8], xmm0
call fcn.004c3b00
movss xmm1, dword [ebp - 8]
cvtsd2ss xmm0, xmm0
push 0x11
divss xmm1, xmm0
movss dword [ebx + 0x18], xmm1
mov dword [0x5814cc], esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [0x5814c8], edi
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [ebx + 0x100], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [ebx + 0x101], al
call esi
mov ecx, dword [0x57bab8]
shr eax, 0xf
and al, 1
mov byte [ebx + 0x103], 0
mov byte [ebx + 0x102], al
cmp byte [ecx + 0x35b], 0
lea esi, [ecx + 0xe8]
je 0x498bbe
cvttss2si eax, dword [esi]
mov dword [ebp - 0xc], eax
cvttss2si eax, dword [ecx + 0xec]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push dword [0x5814c4]
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [esi], 0xff7fffff
mov dword [esi + 4], 0xff7fffff
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x498c26
mov ecx, dword [0x5814c4]
cmp eax, ecx
je 0x498beb
push ecx
push eax
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x498c26
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x498c26
lea eax, [ebp - 0x20]
push eax
push dword [0x5814c4]
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x498c26
movd xmm0, dword [ebp - 0x20]
movd xmm1, dword [ebp - 0x1c]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [esi], xmm0
movss dword [esi + 4], xmm1
cmp byte [ebx + 0xb0], 0
je 0x498c34
or eax, 0xffffffff
jmp 0x498c3f
mov eax, dword [0x57bab8]
mov eax, dword [eax + 0x1d94]
cmp dword [0x571ca0], eax
je 0x498c51
mov dword [0x571ca0], eax
call fcn.00462350
call fcn.00446100
mov ecx, dword [0x57e28c]
test ecx, ecx
je 0x498c98
mov eax, dword [ecx]
call dword [eax + 8]
call fcn.00447820
call fcn.00447ad0
mov ecx, dword [0x57bab8]
xor eax, eax
add ecx, 0x1c5c
cmp byte [ecx], al
cmove ecx, eax
call fcn.00461ba0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c2e59
mov esp, ebp
pop ebp
ret
call fcn.004c0323
int3
Function at 0x4b0280
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
mov bl, cl
mov esi, edx
push 0
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
cmp bl, 0xa5
je 0x4b02e1
cmp bl, 0xa3
je 0x4b02e1
cmp bl, 0x25
je 0x4b02e1
cmp bl, 0x27
je 0x4b02e1
cmp bl, 0x26
je 0x4b02e1
cmp bl, 0x28
je 0x4b02e1
cmp bl, 0x2d
je 0x4b02e1
cmp bl, 0x2e
je 0x4b02e1
cmp bl, 0x24
je 0x4b02e1
cmp bl, 0x23
je 0x4b02e1
cmp bl, 0x21
je 0x4b02e1
cmp bl, 0x22
je 0x4b02e1
cmp bl, 0x90
je 0x4b02e1
cmp bl, 0x2a
je 0x4b02e1
cmp bl, 0x6f
je 0x4b02e1
xor cl, cl
jmp 0x4b02e3
mov cl, 1
movzx eax, al
mov word [esi + 6], ax
movzx eax, bl
mov dword [esi], 1
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov word [esi + 4], ax
mov dword [esi + 8], 8
test cl, cl
je 0x4b0317
mov dword [esi + 8], 9
pop esi
pop ebx
ret
Function at 0x4b5e70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ffd75
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
mov eax, dword [0x571180]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov bl, byte [ecx]
movzx eax, bl
cmp eax, 9
ja case.0x4b5ea4.0
jmp dword [eax*4 + 0x4b5f88]
lea eax, [ecx + 8]
xor ecx, ecx
cmp bl, 6
cmovne eax, ecx
mov al, byte [eax]
mov byte [edx], al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
cmp bl, 5
je 0x4b5ef4
cmp bl, 6
je 0x4b5ef4
lea eax, [ecx + 8]
xor bl, bl
xor ecx, ecx
test bl, bl
cmove eax, ecx
mov al, byte [eax]
mov byte [edx], al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ecx + 8]
mov bl, 1
xor ecx, ecx
test bl, bl
cmove eax, ecx
mov al, byte [eax]
mov byte [edx], al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ecx + 8]
xor ecx, ecx
cmp bl, 7
cmovne eax, ecx
cvttsd2si eax, qword [eax]
mov byte [edx], al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ecx + 8]
xor ecx, ecx
cmp bl, 4
jmp 0x4b5eb3
call fcn.00489220
push eax
lea ecx, [ebp - 0x38]
call fcn.00440df0
push eax
mov edx, str.type_must_be_number__but_is
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x50]
call fcn.00489b60
push eax
mov edx, 0x12e
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.0048af40
add esp, 8
lea eax, [ebp - 0x20]
push 0x56f724
push eax
call fcn.004c5b22
inc edx
pop edi
dec ebx
add byte [edx + 0x5f], al
dec ebx
add byte [edx + 0x5f], al
dec ebx
add byte [edx + 0x5f], al
dec ebx
add byte [0xca004b5f], dh
pop esi
dec ebx
add byte [ebx + 0x14004b5e], ch
pop edi
dec ebx
add byte [edx + 0x5f], al
dec ebx
add byte [edx + 0x5f], al
dec ebx
invalid
Function at 0x4b9860
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x438
mov eax, dword [0x571180]
xor eax, esp
mov dword [esp + 0x434], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edx
mov dword [esp + 8], eax
lea eax, [esp + 0x30]
push edi
push eax
mov dword [esp + 0x38], 0
call fcn.004b9110
add esp, 8
test al, al
je 0x4b9984
cmp dword [esi + 0x14], 0xf
mov dword [esp + 0x34], 0x400
jbe 0x4b98b6
mov esi, dword [esi]
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push esi
push dword [esp + 0x44]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4b994d
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], eax
xorps xmm0, xmm0
mov eax, dword [esp + 0x34]
dec eax
movaps xmmword [esp + 0x10], xmm0
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.00441090
mov ecx, dword [esp + 8]
lea eax, [esp + 0x10]
push eax
call fcn.00476960
mov ecx, dword [esp + 0x24]
cmp ecx, 0xf
jbe 0x4b9937
mov edx, dword [esp + 0x10]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4b992d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4b999a
push ecx
push edx
call fcn.004c2e97
add esp, 8
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x434]
xor ecx, esp
call fcn.004c2e59
mov esp, ebp
pop ebp
ret
cmp eax, 0xea
jne 0x4b9984
push SysReAllocString
push str.The_allocated_buffer_is_not_enough_to_retrieve_the_value.
call fcn.004bb5c0
add esp, 8
mov dword [esp + 0xc], eax
lea eax, [esp + 8]
mov dword [esp + 8], str.The_allocated_buffer_is_not_enough_to_retrieve_the_value.
mov ecx, edi
push eax
push dword [0x54c388]
call fcn.004797f0
mov ecx, dword [esp + 0x43c]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.004c2e59
mov esp, ebp
pop ebp
ret
call fcn.004c89de
int3
Function at 0x4bb2c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x74
push ebx
push ebp
push esi
mov esi, dword [esp + 0x8c]
push edi
mov edi, dword [esp + 0x8c]
cmp edi, 1
jle 0x4bb3e3
mov ebx, dword [esp + 0x88]
xorps xmm0, xmm0
mov dword [esp + 0x58], 0
lea eax, [esp + 0x74]
mov dword [esp + 0x54], eax
movlpd qword [esp + 0x5c], xmm0
movlpd qword [esp + 0x64], xmm0
movlpd qword [esp + 0x6c], xmm0
mov dword [esp + 0x4c], 0x550434
mov dword [esp + 0x50], 0x55042c
mov dword [esp + 0x74], 0x550420
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], edi
mov dword [esp + 0x1c], 0x534829
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x14], 0x534829
mov dword [esp + 0x18], 0
test esi, esi
je 0x4bb375
mov ecx, SysReAllocString
mov eax, esi
nop dword [eax]
cmp byte [eax], 0
je 0x4bb36b
dec ecx
inc eax
test ecx, ecx
jg 0x4bb360
sub eax, esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x98]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x58]
push eax
call fcn.004bbbb0
add esp, 0x10
mov ebp, eax
cmp dword [esp + 0x24], 0
jne 0x4bb3de
mov ecx, dword [esp + 0x4c]
lea eax, [esp + 0x1c]
push eax
push 1
lea eax, [esp + 0x1b]
mov byte [esp + 0x1b], 0
mov edx, dword [ecx + 4]
lea ecx, [esp + 0x54]
push eax
cmp edx, fcn.004af400
jne 0x4bb3d1
call fcn.004af400
pop edi
dec eax
pop esi
add eax, ebp
pop ebp
pop ebx
add esp, 0x74
ret
call edx
pop edi
dec eax
pop esi
add eax, ebp
pop ebp
pop ebx
add esp, 0x74
ret
mov byte [ebx + edi - 1], 0
mov dword [esp + 0x28], 0x534829
xorps xmm0, xmm0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0x52c340
mov dword [esp + 0x38], 0x52c348
movlpd qword [esp + 0x3c], xmm0
movlpd qword [esp + 0x44], xmm0
mov dword [esp + 0x14], 0x534829
mov dword [esp + 0x18], 0
test esi, esi
je 0x4bb44a
mov ecx, SysReAllocString
mov eax, esi
cmp byte [eax], 0
je 0x4bb440
dec ecx
inc eax
test ecx, ecx
jg 0x4bb435
sub eax, esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x98]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.004bbbb0
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x74
ret
Function at 0x4bd010
Capabilities:
Get common file path

Disassembly:
sub esp, 0x414
mov eax, dword [esp + 0x418]
push esi
mov esi, 0x400
mov dword [esp + 4], esi
push edi
mov edi, ecx
sub eax, 0
je 0x4bd0c8
sub eax, 1
je 0x4bd0b6
sub eax, 1
je 0x4bd044
xor esi, esi
jmp 0x4bd0f2
push SysReAllocString
push str.USERPROFILE
call fcn.004bb5c0
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
push 1
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], str.USERPROFILE
push eax
lea eax, [esp + 0x30]
push eax
call fcn.004bd1c0
add esp, 0x18
test al, al
jne 0x4bd0b0
push SysReAllocString
push str.HOME
call fcn.004bb5c0
mov dword [esp + 0x20], eax
lea eax, [esp + 0x1c]
push 1
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x24], str.HOME
push eax
lea eax, [esp + 0x30]
push eax
call fcn.004bd1c0
add esp, 0x18
mov esi, dword [esp + 8]
jmp 0x4bd0f2
lea eax, [esp + 0x1c]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x4bd0f0
lea eax, [esp + 0x1c]
push 0x400
push eax
call fcn.004d39cc
add esp, 8
test eax, eax
je 0x4bd0f2
lea eax, [esp + 0x1c]
push SysReAllocString
push eax
call fcn.004bb5c0
add esp, 8
mov esi, eax
cmp esi, 0x7fffffff
jne 0x4bd10a
lea eax, [esp + 0x1c]
push esi
push eax
call fcn.004bb5c0
add esp, 8
mov esi, eax
push esi
lea eax, [esp + 0x20]
push eax
push 0x400
push edi
call fcn.004bd3e0
add esp, 0x10
mov eax, edi
pop edi
pop esi
add esp, 0x414
ret 4

Function at 0x4bdac0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [esi + 4]
inc edi
mov eax, edi
call fcn.004c3960
mov ebx, esp
push SysReAllocString
push esi
push edi
push ebx
call fcn.004bb540
mov esi, dword [ebp + 0xc]
add esp, 0x10
push dword [esi]
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x4bdb0b
cmp eax, dword [esi]
jae 0x4bdb0b
mov cl, 1
mov dword [esi], eax
mov al, cl
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
xor cl, cl
mov dword [esi], eax
mov al, cl
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4bdb90
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov eax, dword [0x57ab00]
sub esp, 0x10
or eax, dword [0x57ab04]
jne 0x4bdbbc
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov dword [0x57ab00], eax
mov dword [0x57ab04], ecx
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov ecx, dword [esp]
sub ecx, dword [0x57ab00]
mov edx, dword [esp + 4]
sbb edx, dword [0x57ab04]
call fcn.004c3b00
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
movsd qword [esp], xmm0
call fcn.004c3b00
movsd xmm1, qword [esp]
divsd xmm1, xmm0
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
movsd qword [ecx], xmm1
subsd xmm1, qword [0x57aaf8]
cvtpd2ps xmm0, xmm1
movss dword [eax], xmm0
movsd xmm0, qword [ecx]
movsd qword [0x57aaf8], xmm0
add esp, 0x10
ret
Function at 0x4bee20
Capabilities:
Initialize winsock library

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x190
test eax, eax
je 0x4bee33
mov dword [0x571004], eax
push ebx
push esi
push edi
lea eax, [esp + 0xc]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ax, word [esp + 0x1a0]
mov edx, 1
movzx ecx, ax
test ax, ax
push 0
cmovne edx, ecx
mov dword [0x57ab18], 0x57ab24
mov ecx, dword [0x571004]
push 0
push 0
mov dword [0x57ab1c], 0x57ab24
mov eax, dword [ecx]
push 8
push 0
movzx ebx, dx
call dword [eax + 4]
mov edi, eax
test edi, edi
je 0x4beec6
mov ecx, dword [0x571004]
mov edx, ebx
push 0
push 0
push 0
mov esi, dword [ecx]
lea eax, [edx + edx*8]
shl eax, 3
push eax
push 0
call dword [esi + 4]
mov dword [edi], eax
push ebx
push dword [0x571004]
call fcn.004beb50
mov dword [edi + 4], eax
add esp, 8
mov dword [0x57ab08], edi
jmp 0x4beed0
mov dword [0x57ab08], 0
mov edi, dword [esp + 0x1a4]
xor eax, eax
cmp ax, di
je 0x4bef41
mov ecx, dword [0x571004]
push 0
push 0
push 0
mov eax, dword [ecx]
push 8
push 0
call dword [eax + 4]
mov ebx, eax
test ebx, ebx
je 0x4bef37
mov ecx, dword [0x571004]
push 0
push 0
push 0
mov esi, dword [ecx]
movzx edx, di
shl edx, 5
push edx
push 0
call dword [esi + 4]
mov dword [ebx], eax
push edi
push dword [0x571004]
call fcn.004beb50
add esp, 8
mov dword [ebx + 4], eax
mov dword [0x57ab0c], ebx
pop edi
pop esi
pop ebx
add esp, 0x190
ret
mov dword [0x57ab0c], 0
pop edi
pop esi
pop ebx
add esp, 0x190
ret