joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a26d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53a676
mov eax, dword fs:[0]
push eax
sub esp, 0x64c
mov eax, dword [0x588088]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x654]
mov ebx, dword [ebp + 0xc]
call fcn.00402ac0
mov dword [ebp - 4], 0
mov eax, dword [0x58c9dc]
mov dword [ebp - 0x63c], 0
mov dword [ebp - 0x63c], 0x58c9dc
test eax, eax
je 0x4a273c
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 1
mov ecx, 0x58c9e0
call fcn.00404470
test al, al
jne 0x4a2786
push 0x58c9e0
call fcn.00402db0
lea ecx, [ebp - 0x654]
add esp, 4
cmp ecx, eax
je 0x4a284a
mov ecx, 0x58c9e0
call fcn.00402ae0
mov ecx, eax
cmp dword [eax + 0x14], 8
jb 0x4a277d
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
jmp 0x4a283f
push 0x20c
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.004e42f0
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x4a28ef
xor eax, eax
push 0x412
push eax
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x638]
push eax
call fcn.004e42f0
add esp, 0xc
lea eax, [ebp - 0x638]
push 0x208
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x4a2828
test eax, eax
je 0x4a2828
add eax, eax
cmp eax, 0x412
jae 0x4a2941
xor ecx, ecx
mov word [ebp + eax - 0x638], cx
lea eax, [ebp - 0x638]
push eax
call fcn.00402d60
add esp, 4
push eax
lea eax, [ebp - 0x638]
jmp 0x4a283e
lea eax, [ebp - 0x220]
push eax
call fcn.00402d60
add esp, 4
push eax
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x654]
call fcn.00402b50
mov byte [ebp - 4], 0
mov eax, dword [0x58c9dc]
test eax, eax
je 0x4a285e
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push ebx
push edi
lea eax, [ebp - 0x654]
mov dword [ebp - 0x63c], 0
push eax
mov ecx, esi
call fcn.004a2660
test al, al
je 0x4a2883
mov bl, 1
jmp 0x4a290f
push 0x20c
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.004e42f0
add esp, 0xc
lea eax, [ebp - 0x220]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec eax
cmp eax, 0x103
ja 0x4a290d
xor eax, eax
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x220]
push eax
call fcn.00402d60
add esp, 4
lea ecx, [ebp - 0x654]
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.00402b50
push ebx
push edi
lea eax, [ebp - 0x654]
mov ecx, esi
push eax
call fcn.004a2660
mov bl, al
jmp 0x4a290f
mov byte [ebp - 4], 0
mov eax, dword [0x58c9dc]
test eax, eax
je 0x4a2903
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x63c], 0
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x654]
call fcn.00402a60
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e1a24
mov esp, ebp
pop ebp
ret 8
call fcn.004e20a1
int3
Function at 0x4a4500
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53ab9f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x588088]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov edx, dword [edi + 4]
push eax
lea ecx, [eax + 0x94]
call fcn.004a4b60
mov esi, dword [edi + 4]
add esp, 4
sub esi, 0x94
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.00402a60
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.00402a60
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.00402a60
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.00402a60
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.00402a60
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00402a60
mov eax, dword [ebp + 8]
add dword [edi + 4], 0xffffff6c
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x4a50c0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53ad8f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x588088]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.00402a60
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.00402a60
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.00402a60
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.00402a60
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.00402a60
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00402a60
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4a63c0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53af2f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x588088]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.00404cf0
mov dword [ebp - 4], 0
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.00404cf0
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.00404cf0
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.00404cf0
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.00404cf0
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.00404cf0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4a9050
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x588088]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
cmp dword [ebp + 0x10], 0xffffffff
mov edi, dword [esp + 0x20]
je 0x4a90d2
mov ecx, 0x100000
nop dword [eax]
nop word [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x4a90d2
test ecx, ecx
je 0x4a90ce
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x4a9090
xor eax, eax
jmp 0x4a90d7
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4a90e1
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004e1a24
add esp, 0xc
ret 0xc

Function at 0x4aa4f0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52c868
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x588088]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esi + 8]
test edi, edi
jne 0x4aa52b
xor al, al
jmp 0x4aa5ce
add edi, 0x20
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x14], edi
je 0x4aa547
mov eax, dword [edi]
test eax, eax
je 0x4aa547
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
mov eax, dword [esi + 8]
cmp dword [eax + 4], 0
je 0x4aa5ab
push 1
lea ebx, [esi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
mov eax, dword [esi + 8]
add eax, 0xc
push eax
push 4
push esi
push 0x4aa0a0
push 0
push 0
call fcn.004f2d8a
mov ecx, dword [esi + 8]
add esp, 0x18
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 8]
cmp dword [eax + 0x10], 0
jne 0x4aa5ea
mov eax, dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push 0xffffffffffffffff
push ebx
call eax
sub eax, 1
jne 0x4aa5a3
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [esi + 8]
call fcn.004aa260
xor bl, bl
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x4aa5cc
mov eax, dword [edi]
test eax, eax
je 0x4aa5c5
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x14], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e1a24
mov esp, ebp
pop ebp
ret
mov byte [eax + 8], 1
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x4aa602
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x4aa58d
mov bl, 1
jmp 0x4aa5ad
Function at 0x4ab380
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52aef8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x588088]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov ebx, ecx
cmp esi, 0xffffffff
jne 0x4ab3b7
xor al, al
jmp 0x4ab41a
and esi, 0xffffb1af
push esi
call fcn.00403390
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4ab3d2
mov al, 1
jmp 0x4ab41a
lea ecx, [ebp - 0x28]
call fcn.00402ac0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
mov ecx, ebx
call fcn.004aba40
test al, al
je 0x4ab407
push esi
lea ecx, [ebp - 0x28]
call fcn.00403390
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4ab407
mov bl, 1
jmp 0x4ab409
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402a60
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e1a24
mov esp, ebp
pop ebp
ret

Function at 0x4ab440
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52aef8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x588088]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.00403390
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4ab4be
lea ecx, [ebp - 0x28]
call fcn.00402ac0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
mov ecx, ebx
call fcn.004aba40
test al, al
je 0x4ab4ad
lea ecx, [ebp - 0x28]
call fcn.00403390
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402a60
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e1a24
mov esp, ebp
pop ebp
ret
Function at 0x4ab5f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53bae0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x588088]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00403390
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call edi
test eax, eax
je 0x4ab636
mov al, 1
jmp 0x4ab72b
mov ecx, esi
call fcn.00403390
push eax
lea ecx, [ebp - 0x28]
call fcn.00402a70
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.004ab440
mov ebx, eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402a60
cmp ebx, 0xffffffff
jne 0x4ab675
xor al, al
jmp 0x4ab72b
mov ecx, esi
call fcn.00403390
push eax
lea ecx, [ebp - 0x28]
call fcn.00402a70
mov dword [ebp - 4], 1
xor edx, edx
lea ecx, [ebp - 0x28]
call fcn.004ab380
mov bl, al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402a60
test bl, bl
je 0x4ab66e
mov ecx, esi
call fcn.00403390
push eax
call edi
test eax, eax
jne 0x4ab62f
lea ecx, [ebp - 0x28]
call fcn.00402ac0
mov dword [ebp - 4], 2
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.004aba40
test al, al
je 0x4ab6ed
lea ecx, [ebp - 0x28]
call fcn.00403390
push eax
call edi
test eax, eax
je 0x4ab6ed
mov bl, 1
jmp 0x4ab71a
mov ecx, esi
call fcn.00403390
push eax
lea ecx, [ebp - 0x44]
call fcn.00402a70
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x44]
mov edx, dword [ebp - 0x2c]
call fcn.004ab380
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x44]
call fcn.00402a60
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402a60
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e1a24
mov esp, ebp
pop ebp
ret

Function at 0x4ab750
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x588088]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
mov ebx, dword [esp + 0x218]
lea eax, [esp + 4]
push esi
push edi
push 0x20c
push 0
push eax
mov esi, edx
mov edi, ecx
call fcn.004e42f0
add esp, 0xc
lea eax, [esp + 0xc]
mov ecx, esi
push eax
push 0
call fcn.00403390
push eax
mov ecx, edi
call fcn.00403390
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x4ab7e5
xor eax, eax
mov word [esp + 0x216], ax
lea eax, [esp + 0xc]
push eax
call fcn.00402d60
add esp, 4
mov ecx, ebx
push eax
lea eax, [esp + 0x10]
push eax
call fcn.00402b50
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004e1a24
add esp, 0x210
ret
mov ecx, dword [esp + 0x218]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004e1a24
add esp, 0x210
ret
Function at 0x4aeeb0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x588088]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
mov esi, ecx
mov dword [esp + 4], 0x114
push 0x110
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [esi], 0
call fcn.004e42f0
add esp, 0xc
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x4aef47
cmp dword [esp + 8], 6
jb 0x4aef47
mov byte [esi], 1
mov ecx, dword [esp + 0x118]
pop esi
xor ecx, esp
call fcn.004e1a24
add esp, 0x118
ret

Function at 0x4aef60
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53c010
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x588088]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.wintrust.dll
lea ecx, [ebp - 0x28]
call fcn.00402a70
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.004a1560
mov ecx, eax
call fcn.004a1620
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402a60
push str.crypt32.dll
lea ecx, [ebp - 0x40]
call fcn.00402a70
mov dword [ebp - 4], 1
lea eax, [ebp - 0x40]
push eax
call fcn.004a1560
mov ecx, eax
call fcn.004a1620
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00402a60
test ebx, ebx
je 0x4af075
test esi, esi
je 0x4af075
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptCATAdminCalcHashFromFileHandle
push ebx
call esi
push str.CryptCATAdminAcquireContext
push ebx
mov dword [edi + 4], eax
call esi
push str.CryptCATAdminEnumCatalogFromHash
push ebx
mov dword [edi + 8], eax
call esi
push str.CryptCATCatalogInfoFromContext
push ebx
mov dword [edi + 0xc], eax
call esi
push str.CryptCATAdminReleaseCatalogContext
push ebx
mov dword [edi + 0x10], eax
call esi
push str.CryptCATAdminReleaseContext
push ebx
mov dword [edi + 0x14], eax
call esi
push str.WTHelperProvDataFromStateData
push ebx
mov dword [edi + 0x18], eax
call esi
push str.WTHelperGetProvSignerFromChain
push ebx
mov dword [edi + 0x1c], eax
call esi
push str.WinVerifyTrust
push ebx
mov dword [edi + 0x20], eax
call esi
push str.CertNameToStrW
push dword [ebp - 0x10]
mov dword [edi + 0x24], eax
call esi
mov dword [edi + 0x28], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b0160
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53c0a8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x588088]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edi]
test eax, eax
je 0x4b01a6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
lea ecx, [ebp - 0x14]
mov word [edi + 4], 0
mov dword [ebp - 0x14], 0
call fcn.004b4460
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x14]
cmp dword [esi], 0
je 0x4b01cf
lea ebx, [esi + 8]
jmp 0x4b01d1
xor ebx, ebx
mov ecx, dword [ebp - 0x18]
call fcn.00404470
test al, al
jne 0x4b01e7
mov ecx, dword [ebp - 0x18]
call fcn.00403390
jmp 0x4b01e9
xor eax, eax
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
test eax, eax
je 0x4b020a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4b020a
mov byte [edi + 5], 1
cmp dword [edi], 0
setne bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x4b0233
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x4b0248
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 4], 0
push 0x2c
push esi
call fcn.004e1a65
add esp, 8
mov dword [ebp - 0x14], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e1a24
mov esp, ebp
pop ebp
ret 4
Function at 0x4b0280
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53c0a8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x588088]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov ebx, dword [ebp + 8]
test eax, eax
je 0x4b02c3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
push ecx
lea ecx, [ebp - 0x14]
mov word [edi + 4], 0
mov dword [ebp - 0x14], 0
call fcn.004b4520
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x14]
cmp dword [esi], 0
je 0x4b02f0
lea eax, [esi + 8]
mov dword [ebp - 0x18], eax
jmp 0x4b02f7
mov dword [ebp - 0x18], 0
mov ecx, ebx
call fcn.00404470
test al, al
jne 0x4b030b
mov ecx, ebx
call fcn.00403390
jmp 0x4b030d
xor eax, eax
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
test eax, eax
jne 0x4b035e
call ecx
cmp eax, 5
jne 0x4b0358
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, ebx
call fcn.00404470
test al, al
jne 0x4b0348
mov ecx, ebx
call fcn.00403390
jmp 0x4b034a
xor eax, eax
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [edi]
test eax, eax
je 0x4b037c
call ecx
cmp eax, 0xb7
jne 0x4b0371
mov byte [edi + 5], 1
mov ecx, dword [edi]
call fcn.0049fa90
mov eax, dword [edi]
test eax, eax
setne bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x4b03a2
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x4b03b7
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 4], 0
push 0x2c
push esi
call fcn.004e1a65
add esp, 8
mov dword [ebp - 0x14], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e1a24
mov esp, ebp
pop ebp
ret 4
Function at 0x4b0d30
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53c3a1
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x588088]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
mov dword [edi], vtable.DL::RCSimpleDownloadHandler.0
mov dword [edi + 4], vtable.DL::RCSimpleDownloadHandler.1.0
mov dword [ebp - 4], 7
mov dword [edi + 0x98], 0
mov byte [ebp - 4], 6
or ebx, 0xffffffff
mov esi, dword [edi + 0xf8]
test esi, esi
je 0x4b0dae
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x4b0dae
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, ebx
lock xadd dword [esi + 8], eax
jne 0x4b0dae
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov byte [ebp - 4], 5
mov ecx, dword [edi + 0xec]
test ecx, ecx
je 0x4b0dc9
lock xadd dword [ecx + 8], ebx
dec ebx
jne 0x4b0dc9
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 4
mov eax, dword [edi + 0xe4]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
test eax, eax
je 0x4b0dfa
push eax
call ebx
push 0x18
push dword [edi + 0xe4]
call fcn.004e1a65
add esp, 8
mov dword [edi + 0xe4], 0
mov byte [ebp - 4], 3
lea esi, [edi + 0xc0]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 8
mov eax, dword [esi]
test eax, eax
je 0x4b0e1e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
mov byte [ebp - 4], 3
lea ecx, [esi + 8]
call fcn.00402a60
mov byte [ebp - 4], 2
mov eax, dword [edi + 0xac]
test eax, eax
je 0x4b0e55
push eax
call ebx
push 0x18
push dword [edi + 0xac]
call fcn.004e1a65
add esp, 8
mov dword [edi + 0xac], 0
mov byte [ebp - 4], 1
mov ecx, dword [edi + 0xa0]
test ecx, ecx
je 0x4b0ed0
mov edx, dword [edi + 0xa4]
push ecx
call fcn.004b3ff0
mov eax, dword [edi + 0xa8]
add esp, 4
mov ecx, dword [edi + 0xa0]
sub eax, ecx
sar eax, 3
lea edx, [eax*8]
cmp edx, 0x1000
jb 0x4b0ea8
mov esi, dword [ecx - 4]
add edx, 0x23
sub ecx, esi
lea eax, [ecx - 4]
cmp eax, 0x1f
ja 0x4b0f4f
mov ecx, esi
push edx
push ecx
call fcn.004e1a65
add esp, 8
mov dword [edi + 0xa0], 0
mov dword [edi + 0xa4], 0
mov dword [edi + 0xa8], 0
mov byte [ebp - 4], 0
lea esi, [edi + 0x10]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 0xc
lea ecx, [esi + 0x70]
call fcn.00402a60
mov byte [ebp - 4], 0xb
lea ecx, [esi + 0x48]
call fcn.00402a60
mov byte [ebp - 4], 0xa
lea ecx, [esi + 0x30]
call fcn.00402a60
mov byte [ebp - 4], 9
lea ecx, [esi + 0x18]
call fcn.00402a60
mov byte [ebp - 4], 0
mov ecx, esi
call fcn.00402a60
mov dword [ebp - 4], 0xe
mov dword [edi + 4], vtable.RC::RCRefCounted.0
mov dword [ebp - 4], 0xffffffff
mov dword [edi], vtable.DL::ISimpleDownloadHandler.0
mov dword [ebp - 4], 0xffffffff
mov dword [edi], vtable.RC::IRefCount.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.004ecb59
int3