joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49eaf0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40c
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
push eax
mov esi, ecx
mov ecx, dword [0x652e08]
push ebx
call fcn.00434d10
test eax, eax
je 0x49ebf8
mov edx, dword [0x652e10]
mov cl, byte [ebp + 0x10]
cmp cl, byte [edx + 0x13dc]
jne 0x49ebf8
mov dx, word [ebp + 8]
xor eax, eax
cmp dx, 0xff
ja 0x49ebfa
mov byte [esp + 0x18], al
mov ecx, 0xff
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
movzx edi, dx
push edi
lea eax, [esp + 0x1c]
push 0x4bebb0
push eax
call fcn.004aa255
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov al, byte [ebp + 0xc]
movzx edx, al
lea edi, [edx + edi*4]
mov edx, dword [esi + edi*8 + 0x1d0]
xor ecx, ecx
test edx, edx
je 0x49ebda
mov eax, dword [0x652e10]
mov ecx, dword [eax + 0x13d4]
mov eax, dword [eax + 0x13d8]
sub ebx, ecx
mov dword [esp + 0x14], eax
mov eax, edx
mov ecx, dword [eax]
sub ebx, 0x140
lea edx, [ebx*4]
push edx
push eax
mov dword [esp + 0x18], ebx
call dword [ecx + 0x40]
mov eax, dword [esi + edi*8 + 0x1d4]
mov ecx, dword [esi + edi*8 + 0x1d0]
push 0
push eax
push ecx
mov ecx, esi
call fcn.0049cd60
mov al, byte [ebp + 0xc]
mov ecx, ebx
test al, al
je 0x49ebe2
cmp al, 1
jne 0x49ebea
push ecx
mov ecx, esi
call fcn.0049d040
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x49ecb0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40c
mov eax, dword [ebp + 0x14]
push ebx
push esi
push edi
mov ebx, ecx
mov ecx, dword [ebp + 0x10]
push eax
push ecx
mov ecx, dword [0x652e08]
call fcn.00434d10
test eax, eax
je 0x49ed9f
mov eax, dword [ebp + 8]
cmp ax, 0xc9
mov esi, 1
jb 0x49ecf2
lea esi, [eax - 0xc8]
jmp 0x49ecfb
cmp ax, 0x65
jb 0x49ecfb
lea esi, [eax - 0x64]
mov byte [esp + 0x18], 0
xor eax, eax
mov ecx, 0xff
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
movzx edi, si
push edi
lea edx, [esp + 0x1c]
push 0x4bebc0
push edx
call fcn.004aa255
add esp, 0xc
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp si, 0x3d
ja 0x49ed9f
movzx ecx, byte [ebp + 0xc]
lea esi, [ecx + edi*2]
mov eax, dword [ebx + esi*8 + 0x23b8]
test eax, eax
je 0x49ed91
mov eax, dword [0x652e10]
mov edx, dword [eax + 0x13d4]
mov ecx, dword [ebp + 0x10]
mov eax, dword [eax + 0x13d8]
sub ecx, edx
lea ecx, [ecx*4 - 0x500]
mov dword [esp + 0x14], eax
mov eax, dword [ebx + esi*8 + 0x23b8]
mov edi, dword [eax]
push ecx
push eax
call dword [edi + 0x40]
mov edx, dword [ebx + esi*8 + 0x23bc]
mov eax, dword [ebx + esi*8 + 0x23b8]
push 0
push edx
push eax
mov ecx, ebx
call fcn.0049cd60
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x49f2c0
Capabilities:
Check http status code

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov ebp, ecx
push edi
lea ecx, [ebp + 0x65c]
call fcn.0049c740
xor esi, esi
lea edi, [ebp + 0x68]
lea ebx, [ebp + 0x5d5]
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
add ebp, 0x183
jmp 0x49f2f7
mov edi, dword [esp + 0x14]
mov ecx, edi
call fcn.0041b660
test ax, ax
je 0x49f317
lea eax, [esp + 0x1c]
push eax
mov ecx, edi
call fcn.0041b730
cmp dword [eax], esi
je 0x49f3d3
mov ax, word [ebp]
test ax, ax
je 0x49f3d3
movzx ecx, ax
mov edx, dword [ecx*4 + 0xe5a580]
cmp word [edx + 0x100], 0
mov esi, ebp
mov ecx, 0x13
push 0
je 0x49f3a6
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push eax
sub esp, 0x50
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebx + 4]
movsw word es:[edi], word [esi]
add ecx, edx
mov edx, dword [ebx]
movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x80]
push ecx
add edx, edi
push edx
mov ecx, 0xe5a570
call fcn.00455360
movzx eax, word [ebp]
mov ecx, dword [eax*4 + 0xe5a580]
mov al, byte [ecx + 0xe4]
cmp al, 0x1d
je 0x49f3d3
cmp al, 0x27
je 0x49f3d3
cmp al, 0x28
je 0x49f3d3
cmp word [ebp + 0xb], 0xc8
jae 0x49f3d3
mov eax, dword [esp + 0x18]
test eax, eax
je 0x49f3d3
push 7
mov ecx, 0x13
mov esi, ebp
mov edx, dword [esp + 0x34]
mov eax, dword [ebx + 4]
push edx
mov edx, dword [esp + 0x30]
sub esp, 0x50
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebx]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
add eax, dword [esp + 0x84]
add ecx, edx
push eax
push ecx
mov ecx, 0xe5a570
call fcn.00455360
mov esi, dword [esp + 0x10]
inc esi
add ebp, 0x4f
add ebx, 8
cmp esi, 0xe
mov dword [esp + 0x10], esi
jl 0x49f2f3
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x14
ret 0xc
Function at 0x4a02f0
Capabilities:
Check http status code

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov ebx, ecx
push edi
lea ecx, [ebx + 0x65c]
call fcn.0049c740
mov esi, eax
mov eax, dword [0x652e04]
mov ecx, dword [eax + 0x3880]
test ecx, ecx
mov dword [esp + 0x14], esi
je 0x4a031e
add dword [esp + 0x20], 0x16
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x10], 0
add ebx, 0x183
mov dword [esp + 0x20], 0xe
jmp 0x4a0340
mov ax, word [ebx]
test ax, ax
je 0x4a03ce
movzx ecx, ax
mov eax, dword [ecx*4 + 0xe5a580]
cmp word [eax + 0x100], 0
je 0x4a03ce
mov al, byte [eax + 0xe4]
cmp al, 0x1d
je 0x4a03ce
cmp al, 0x27
je 0x4a03ce
cmp al, 0x28
je 0x4a03ce
cmp al, 0x1e
je 0x4a03ce
cmp word [ebx + 0xb], 0xc8
jae 0x4a03ce
test esi, esi
mov esi, ebx
je 0x4a0398
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
push 7
push edx
sub esp, 0x50
mov edi, esp
push ebp
push eax
jmp 0x4a03aa
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
push 0
push ecx
sub esp, 0x50
mov edi, esp
push ebp
push edx
mov ecx, 0x13
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 0xe5a570
movsb byte es:[edi], byte [esi]
call fcn.00455360
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
inc ecx
mov dword [esp + 0x10], ecx
add ebp, 0x20
mov eax, dword [esp + 0x20]
add ebx, 0x4f
dec eax
mov dword [esp + 0x20], eax
jne 0x4a0340
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4a040c
mov eax, dword [0xec0e18]
inc eax
mov dword [0xec0e18], eax
cdq
mov ecx, 0x140
idiv ecx
test edx, edx
jne 0x4a040c
mov ecx, dword [0x65324c]
push 0x37
call fcn.0049d110
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x4a20d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x128
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov dword [esi + 0x10], eax
mov byte [esp + 0x28], 0
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x29]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x28]
push 0x104
push ecx
stosb byte es:[edi], al
call fcn.004ab591
lea edi, [esp + 0x30]
add esp, 8
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4a2112
mov edx, dword [str._ini.ini]
mov eax, dword [0x4bbc80]
mov cl, byte [0x4bbc84]
mov dword [edi], edx
xor edx, edx
mov dword [esp + 9], edx
mov dword [esp + 0xd], edx
mov dword [esp + 0x11], edx
mov dword [esp + 0x15], edx
mov dword [esp + 0x19], edx
mov dword [esp + 0x1d], edx
mov dword [esp + 0x21], edx
mov dword [edi + 4], eax
mov word [esp + 0x25], dx
mov byte [esp + 0x27], dl
mov edx, dword [0xec0e0c]
lea eax, [esp + 0x28]
push eax
push 0x20
mov byte [edi + 8], cl
mov byte [esp + 0x10], 0
mov eax, dword [edx]
lea ecx, [esp + 0x10]
push ecx
add eax, 0x45970
push eax
push str.font
push str.FONT
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edi, dword [sym.imp.GDI32.dll_CreateFontA]
lea ecx, [esp + 8]
push ecx
push 2
push 3
push 0
push 0
push 1
push 0
push 0
push 0
push 0x190
push 0
push 0
push 0
push 0xc
call edi
test eax, eax
mov dword [esi + 8], eax
jne 0x4a21d5
push eax
push 2
push 3
push eax
push eax
push 1
push eax
push eax
push eax
push 0x190
push eax
push eax
push eax
push 0xc
call edi
mov dword [esi + 8], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4a7c60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
push edi
lea eax, [esp + 0x120]
push str.softwareDMIletsgameAppie.config
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0xc]
push edx
push 0
push 0x2001f
push 0
push 0
push 0
lea eax, [esp + 0x13c]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push str.ICONURL
push ecx
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp + 8]
lea eax, [esp + 0x18]
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4a7cf6
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4a9107
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4ba4a1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x44]
mov ecx, edi
mov dword [esp + 0xc], esi
mov dword [esi], 0x4beff4
call fcn.0045df30
lea ebp, [esi + 0x5c]
mov ecx, ebp
mov dword [esp + 0x18], 0
call fcn.0045df30
lea ecx, [esi + 0x74]
mov byte [esp + 0x18], 1
call fcn.00453190
push 0x18
push 0x78
push 0xa0
mov ecx, edi
mov byte [esp + 0x24], 2
mov dword [esi + 0xc], 0
mov dword [esi + 0x30], 1
mov dword [esi + 0x34], 0xa0
mov dword [esi + 0x38], 0x78
mov dword [esi + 0x3c], 0x14
mov dword [esi + 0x40], 0xa
call fcn.0045df90
push 0x18
push 0x78
push 0xa0
mov ecx, ebp
call fcn.0045df90
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4a9740
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x58
push esi
mov esi, ecx
mov ecx, dword [esi + 0x30]
push edi
xor edi, edi
cmp ecx, edi
mov dword [esi + 4], eax
je 0x4a990a
push edi
push eax
push 1
push 1
push edi
push edi
push 0x56000000
push str.Webcam_Window
call sub.AVICAP32.dll_capCreateCaptureWindowA
cmp eax, edi
mov dword [esi + 8], eax
je 0x4a9900
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push ebp
mov ebp, dword [sym.imp.USER32.dll_IsWindow]
jmp 0x4a9790
mov eax, dword [esi + 8]
push eax
call ebp
test eax, eax
je 0x4a97aa
mov ecx, dword [esi + 8]
push 0
push edi
push 0x40a
push ecx
call ebx
jmp 0x4a97ac
xor eax, eax
test eax, eax
mov dword [esi + 0xc], eax
jne 0x4a97d6
inc edi
cmp edi, 9
jl 0x4a9790
mov ecx, dword [esi + 8]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esi + 8], 0
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x58
ret 8
mov edx, dword [esi + 8]
push edx
call ebp
test eax, eax
je 0x4a97f2
mov ecx, dword [esi + 8]
lea eax, [esp + 0x3c]
push eax
push 0x2c
push 0x40e
push ecx
call ebx
mov edx, dword [esi + 8]
push edx
call ebp
test eax, eax
je 0x4a980e
mov eax, dword [esi + 8]
push 0x4a96d0
push 0
push 0x405
push eax
call ebx
mov ecx, dword [esi + 8]
push ecx
call ebp
test eax, eax
je 0x4a9829
mov edx, dword [esi + 0x3c]
mov eax, dword [esi + 8]
push 0
push edx
push 0x434
push eax
call ebx
mov ecx, dword [esi + 8]
push ecx
call ebp
test eax, eax
je 0x4a9842
mov edx, dword [esi + 8]
push 0
push 0
push 0x432
push edx
call ebx
xor eax, eax
mov ecx, 0xb
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 0x34]
mov eax, dword [esi + 0x38]
mov dword [esp + 0x18], eax
imul eax, ecx
lea eax, [eax + eax*2]
mov dword [esp + 0x14], ecx
mov ecx, dword [esi + 8]
mov dword [esp + 0x24], eax
mov eax, 0x64
xor edi, edi
push ecx
mov dword [esp + 0x14], 0x28
mov word [esp + 0x20], 1
mov word [esp + 0x22], 0x18
mov dword [esp + 0x24], edi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
call ebp
test eax, eax
je 0x4a98b0
mov eax, dword [esi + 8]
lea edx, [esp + 0x10]
push edx
push 0x2c
push 0x42d
push eax
call ebx
cmp eax, edi
jne 0x4a98ea
cmp dword [esp + 0x70], edi
je 0x4a97ca
mov ecx, dword [esi + 8]
push ecx
call ebp
test eax, eax
je 0x4a98d1
mov edx, dword [esi + 8]
push edi
push edi
push 0x405
push edx
call ebx
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
pop ebp
pop ebx
mov dword [esi + 8], edi
pop edi
xor eax, eax
pop esi
add esp, 0x58
ret 8
mov ecx, esi
call fcn.004a92b0
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x58
ret 8
push edi
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esi + 8], edi
pop edi
xor eax, eax
pop esi
add esp, 0x58
ret 8
Function at 0x4aab28
Capabilities:
Terminate process

Disassembly:
push 8
push 0x4bf1c0
call fcn.004ad9f0
push 8
call fcn.004ae73b
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0xec25b0], esi
jne 0x4aab5c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0xec25ac], esi
mov al, byte [ebp + 0x10]
mov byte [0xec25a8], al
cmp dword [ebp + 0xc], edi
jne 0x4aaba6
cmp dword [0xec3e34], edi
je 0x4aab96
mov eax, dword [0xec3e30]
sub eax, 4
mov dword [0xec3e30], eax
cmp eax, dword [0xec3e34]
jb 0x4aab96
mov eax, dword [eax]
cmp eax, edi
je 0x4aab77
call eax
jmp 0x4aab77
push 0x4c80ec
mov eax, 0x4c80e4
call fcn.004aaaa6
pop ecx
push 0x4c80f8
mov eax, 0x4c80f0
call fcn.004aaaa6
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x4aabd7
cmp dword [ebp + 0x10], edi
jne 0x4aabe5
mov dword [0xec25b0], esi
push dword [ebp + 8]
call fcn.004aaa64
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x4aabe4
push 8
call fcn.004ae686
pop ecx
ret
call fcn.004ada2b
ret

Function at 0x4ab46f
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x4ab49d
add al, 0x40
mov byte [ebp + 8], al
lea eax, [ebp + 8]
push eax
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x5c
mov byte [ebp + 0xb], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
test eax, eax
je 0x4ab4a2
cmp eax, 1
je 0x4ab4a2
xor eax, eax
inc eax
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4ab4a6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x651c64]
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
mov dword [ebp - 4], eax
je 0x4ab51e
push ebx
call fcn.004ab46f
test eax, eax
pop ecx
jne 0x4ab4ed
call fcn.004af74d
mov dword [eax], 0xf
call fcn.004af744
mov dword [eax], 0xd
xor eax, eax
mov ecx, dword [ebp - 4]
pop ebx
call fcn.004b0ab3
leave
ret
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x108]
push eax
push 0x104
lea eax, [ebp + 8]
add bl, 0x40
push eax
mov byte [ebp + 8], bl
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x2e
mov byte [ebp + 0xb], 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
jmp 0x4ab530
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x4ab4e0
inc eax
cmp eax, 0x104
ja 0x4ab4e0
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x4ab568
cmp eax, dword [ebp + 0x10]
jg 0x4ab54b
mov eax, dword [ebp + 0x10]
push eax
call fcn.004ab45d
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x4ab57d
call fcn.004af744
mov dword [eax], 0xc
jmp 0x4ab4e0
cmp eax, dword [ebp + 0x10]
jle 0x4ab57d
call fcn.004af744
mov dword [eax], 0x22
jmp 0x4ab4e0
lea eax, [ebp - 0x108]
push eax
push ecx
call fcn.004ae4f0
pop ecx
pop ecx
jmp 0x4ab4e2
Function at 0x4ab6a7
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push edi
mov edi, dword [esp + 0xc]
xor ebx, ebx
test edi, edi
jne 0x4ab6c3
call fcn.004af744
mov dword [eax], 0x16
or eax, 0xffffffff
jmp 0x4ab735
push esi
push 0x8c
push 1
call fcn.004aa938
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4ab71b
push esi
call fcn.004ad42f
mov eax, dword [esp + 0x1c]
pop ecx
push esi
push 4
push esi
push 0x4ab615
push dword [esp + 0x24]
mov dword [esi + 0x4c], edi
push 0
mov dword [esi + 0x50], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
mov dword [esi + 4], edi
je 0x4ab713
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x4ab732
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.004aa9f3
test ebx, ebx
pop ecx
je 0x4ab72d
push ebx
call fcn.004af756
pop ecx
or eax, 0xffffffff
jmp 0x4ab734
mov eax, edi
pop esi
pop edi
pop ebx
ret

Function at 0x4ac0c6
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push 0x128
push 0x4bf298
call fcn.004ad9f0
mov eax, dword [0x651c64]
mov dword [ebp - 0x1c], eax
lea edi, [ebp - 0x124]
xor ebx, ebx
mov dword [ebp - 0x130], ebx
or dword [ebp - 0x12c], 0xffffffff
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x4ac1d3
mov eax, edi
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, eax
mov dword [ebp - 0x134], esi
cmp esi, 0x104
jle 0x4ac184
mov dword [ebp - 4], ebx
lea eax, [esi + 1]
add eax, 3
and eax, 0xfffffffc
call fcn.004aa3e0
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x138], edi
jmp 0x4ac171
or dword [ebp - 4], 0xffffffff
cmp esi, ebx
je 0x4ac1d3
push edi
inc esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, eax
cmp esi, ebx
je 0x4ac1d3
mov al, byte [edi]
cmp al, 0x5c
je 0x4ac192
cmp al, 0x2f
jne 0x4ac197
cmp al, byte [edi + 1]
je 0x4ac1cd
mov byte [ebp - 0x128], 0x3d
movzx eax, byte [edi]
push eax
call fcn.004b2adc
pop ecx
mov byte [ebp - 0x127], al
mov byte [ebp - 0x126], 0x3a
mov byte [ebp - 0x125], bl
push edi
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x4ac1d3
mov dword [ebp - 0x12c], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004af756
pop ecx
cmp dword [ebp - 0x130], ebx
je 0x4ac1ef
push edi
call fcn.004aa9f3
pop ecx
mov eax, dword [ebp - 0x12c]
lea esp, [ebp - 0x144]
mov ecx, dword [ebp - 0x1c]
call fcn.004b0ab3
call fcn.004ada2b
ret
Function at 0x4ac377
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x4ac394
call fcn.004af744
mov dword [eax], 0x16
xor eax, eax
jmp 0x4ac3fe
push esi
push 0x8c
push 1
call fcn.004aa938
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4ac3e9
push esi
call fcn.004ad42f
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x4ac3c7
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x4ac2e2
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x4ac3fd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.004aa9f3
test ebx, ebx
pop ecx
je 0x4ac3fb
push ebx
call fcn.004af756
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4ac580
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x4bf2e8
call fcn.004ad9f0
mov edi, 0x94
mov eax, edi
call fcn.004aa3e0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0xec2570], ecx
mov eax, dword [esi + 4]
mov dword [0xec257c], eax
mov edx, dword [esi + 8]
mov dword [0xec2580], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0xec2574], esi
cmp ecx, 2
je 0x4ac5e0
or esi, 0x8000
mov dword [0xec2574], esi
shl eax, 8
add eax, edx
mov dword [0xec2578], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x4ac61b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4ac61b
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x4ac633
cmp eax, 0x20b
je 0x4ac620
mov dword [ebp - 0x1c], esi
jmp 0x4ac647
cmp dword [ecx + 0x84], 0xe
jbe 0x4ac61b
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x4ac641
cmp dword [ecx + 0x74], 0xe
jbe 0x4ac61b
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.004ae812
pop ecx
test eax, eax
jne 0x4ac65b
push 0x1c
call fcn.004ac55c
pop ecx
call fcn.004ad629
test eax, eax
jne 0x4ac66c
push 0x10
call fcn.004ac55c
pop ecx
call fcn.004af3f3
mov dword [ebp - 4], esi
call fcn.004b3425
test eax, eax
jge 0x4ac685
push 0x1b
call fcn.004ac537
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0xec3e28], eax
call fcn.004b3303
mov dword [0xec25dc], eax
call fcn.004b3261
test eax, eax
jge 0x4ac6ab
push 8
call fcn.004ac537
pop ecx
call fcn.004b302e
test eax, eax
jge 0x4ac6bc
push 9
call fcn.004ac537
pop ecx
push 1
call fcn.004aaabe
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x4ac6d2
push eax
call fcn.004ac537
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.004b2fd1
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x4ac6f3
movzx eax, word [ebp - 0x40]
jmp 0x4ac6f6
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.0041a710
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x4ac714
push edi
call fcn.004aabeb
call fcn.004aac0d
jmp 0x4ac746
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.004ada2b
ret