joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48dae0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x28
mov eax, dword [0x541f38]
xor eax, esp
mov dword [esp + 0x24], eax
mov edx, dword [0x54ffc8]
xor eax, eax
push esi
mov esi, ecx
mov word [esp + 0x10], ax
mov eax, dword [edx + 0xc]
mov ecx, 0x54ffc8
mov dword [esp + 0x24], 7
mov dword [esp + 0x20], 0
call eax
lea ecx, [esp + 8]
add eax, 0x10
push ecx
mov dword [esp + 8], eax
call fcn.0043c950
add esp, 4
push eax
lea ecx, [esp + 8]
call fcn.0043a540
mov eax, dword [esp + 8]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x48db56
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 4]
cmp dword [eax - 0xc], 0
jg 0x48dba2
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48db7c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esp + 0x24], 8
jb 0x48db90
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004d72b6
add esp, 4
xor eax, eax
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004d7eb0
add esp, 0x28
ret
push edi
push 0x17
push str.SoftMgrNotifyDown.dll
lea ecx, [esp + 0x10]
call fcn.0043c7c0
mov edi, dword [esp + 8]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x48dc05
lea eax, [edi - 0x10]
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x48dbde
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esp + 0x28], 8
jb 0x48dbf2
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004d72b6
add esp, 4
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004d7eb0
add esp, 0x28
ret
push edi
call fcn.0043caa0
add esp, 4
test eax, eax
je 0x48dc8a
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
test eax, eax
je 0x48dc65
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Load360NotifyExe
push eax
call edi
mov edx, dword [esi]
push str.Get360NotifyExeWnd
push edx
mov dword [esi + 4], eax
call edi
lea ecx, [esp + 8]
mov dword [esi + 8], eax
call fcn.00439d40
lea ecx, [esp + 0x10]
call fcn.00456e50
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004d7eb0
add esp, 0x28
ret
lea ecx, [esp + 8]
call fcn.00439d40
lea ecx, [esp + 0x10]
call fcn.00456e50
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.004d7eb0
add esp, 0x28
ret
lea eax, [edi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48dca6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x10]
call fcn.00456e50
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
xor ecx, esp
call fcn.004d7eb0
add esp, 0x28
ret
Function at 0x490c50
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x80c
mov eax, dword [0x541f38]
xor eax, esp
mov dword [esp + 0x808], eax
push esi
mov esi, dword [esp + 0x814]
test esi, esi
jne 0x490c88
xor eax, eax
pop esi
mov ecx, dword [esp + 0x808]
xor ecx, esp
call fcn.004d7eb0
add esp, 0x80c
ret
push 0x808
lea eax, [esp + 8]
push 0
push eax
call fcn.004d86e0
push esi
lea ecx, [esp + 0x14]
push 0x404
push ecx
call fcn.004db80a
lea edx, [esp + 0x1c]
push 0x404
push edx
call fcn.004dba3e
lea eax, [esp + 0x24]
push 0x51af94
push eax
call fcn.004d7608
add esp, 0x28
test eax, eax
je 0x490ce9
mov eax, 1
pop esi
mov ecx, dword [esp + 0x808]
xor ecx, esp
call fcn.004d7eb0
add esp, 0x80c
ret
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [esp + 0x80c]
pop esi
xor ecx, esp
call fcn.004d7eb0
add esp, 0x80c
ret

Function at 0x4939b0
Capabilities:
Check if file exists

Disassembly:
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 4], 0
jne 0x4939c7
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 8
ret
mov eax, dword [edi + 4]
test eax, eax
jne 0x4939d8
push 0x80004003
call fcn.004d6740
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push eax
mov eax, dword [ecx + 0x18]
mov dword [esp + 0x18], 0
call eax
mov esi, dword [esp + 0x10]
push ecx
mov eax, esp
mov dword [esp + 0x10], 0
mov dword [eax], esi
test esi, esi
je 0x493a0a
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
push esi
call edx
lea ecx, [esp + 0x10]
call fcn.00493360
test eax, eax
jge 0x493a24
cmp eax, 0x80004002
je 0x493a24
push eax
call fcn.004d6740
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x493a83
lea eax, [esp + 0xc]
push eax
mov ecx, edi
call fcn.00493910
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x493a5b
mov edx, dword [esp + 0xc]
push ecx
mov ecx, esp
push edx
call fcn.00490b50
mov ecx, ebx
call fcn.004935d0
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x493a7b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebx]
mov edx, dword [ecx + 8]
push ebx
call edx
test esi, esi
je 0x493a8f
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x493d10
Capabilities:
Set current directory

Disassembly:
push ecx
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x493d1e
xor eax, eax
pop esi
pop ecx
ret
mov dword [0x543f60], 0x5445fc
cmp dword [esi + 4], 0
jne 0x493d77
call fcn.00493750
test eax, eax
je 0x493d19
lea eax, [esp + 4]
push eax
mov ecx, esi
call fcn.004934e0
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov eax, dword [esp + 4]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x493d6c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, esi
call fcn.00493640
test eax, eax
je 0x493d19
mov ecx, esi
call fcn.004939b0
test eax, eax
je 0x493d19
mov ecx, esi
call fcn.00493aa0
test eax, eax
je 0x493d19
mov dword [esi], 1
mov eax, 1
pop esi
pop ecx
ret
Function at 0x49b080
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x543fa4]
push esi
mov esi, ecx
test eax, eax
jne 0x49affd
push 0x590
call fcn.004d7e4b
add esp, 4
test eax, eax
je 0x49aff6
mov ecx, eax
call fcn.004a1840
jmp 0x49aff8
xor eax, eax
mov dword [0x543fa4], eax
mov ecx, eax
call fcn.004a1210
cmp eax, 0xffffffff
je 0x49b02a
push 0
push 0
push esi
push 0x49af70
push 0
push 0
call fcn.004d7fc0
add esp, 0x18
test eax, eax
je 0x49b02a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret
mov eax, dword [0x543fa4]
push esi
mov esi, ecx
test eax, eax
jne 0x49b0ad
push 0x590
call fcn.004d7e4b
add esp, 4
test eax, eax
je 0x49b0a6
mov ecx, eax
call fcn.004a1840
jmp 0x49b0a8
xor eax, eax
mov dword [0x543fa4], eax
push esi
mov ecx, eax
call fcn.004a1270
mov eax, dword [0x543fa4]
test eax, eax
jne 0x49b0f1
push 0x590
call fcn.004d7e4b
add esp, 4
test eax, eax
je 0x49b0ea
mov ecx, eax
call fcn.004a1840
mov ecx, eax
mov dword [0x543fa4], eax
call fcn.004a15c0
mov ecx, esi
pop esi
jmp 0x49afd0
xor eax, eax
mov dword [0x543fa4], eax
mov ecx, eax
call fcn.004a15c0
mov ecx, esi
pop esi
jmp 0x49afd0
Function at 0x49d3b0
Capabilities:
Suspend thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 8], 0
je 0x49d3e8
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esi]
push 0xbb8
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x49d3e1
mov edx, dword [esi]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov dword [esi + 8], 0
mov eax, 1
pop esi
ret

Function at 0x49e920
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
cmp dword [esi + 8], 0
je 0x49e932
mov eax, 1
pop esi
pop ecx
ret
call fcn.0049dd20
mov ecx, esi
mov dword [esi + 0xc], eax
call fcn.0049d980
test eax, eax
je 0x49e9a2
mov eax, dword [esi + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push str.360safe
push eax
call edx
test eax, eax
jl 0x49e9a2
mov eax, dword [esi + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
push str.safeiddata
push eax
call edx
test eax, eax
jl 0x49e9a2
push 0
push 0
push 1
push 0
mov dword [esi + 8], 1
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 4], eax
lea eax, [esp + 4]
push eax
push 0
push esi
push 0x49e910
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
test eax, eax
jne 0x49e92a
xor eax, eax
mov dword [esi + 8], eax
pop esi
pop ecx
ret
Function at 0x49eca0
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
sub esp, 0x160
mov eax, dword [0x541f38]
xor eax, esp
mov dword [esp + 0x15c], eax
push esi
push edi
mov edi, dword [esp + 0x16c]
push edi
mov dword [edi], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov esi, 2
test eax, eax
jne 0x49ed76
push 0x3f
push eax
mov byte [esp + 0x12c], al
lea eax, [esp + 0x12d]
push eax
call fcn.004d86e0
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x128]
push edx
lea eax, [esp + 0x10]
push eax
push str.CurrentVersion
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], 0x40
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x49ed52
movsx ecx, byte [esp + 0x124]
lea edx, [esp + 0x126]
sub ecx, 0x30
push edx
mov dword [edi + 0x10], esi
mov dword [edi + 4], ecx
call fcn.004db58d
add esp, 4
mov dword [edi + 8], eax
jmp 0x49ed76
call dword [sym.imp.KERNEL32.dll_GetVersion]
movzx ecx, al
shr eax, 8
movzx eax, al
mov edx, 4
mov dword [edi + 8], eax
cmp edx, ecx
sbb eax, eax
neg eax
inc eax
mov dword [edi + 4], ecx
mov dword [edi + 0x10], eax
mov eax, dword [edi + 4]
cmp eax, 6
ja 0x49ed85
jne 0x49edee
cmp dword [edi + 8], esi
jb 0x49edee
push 0x110
lea ecx, [esp + 0x18]
push 0
push ecx
call fcn.004d86e0
add esp, 0xc
push str.RtlGetVersion
push str.ntdll.dll
mov dword [esp + 0x18], 0x114
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x49edee
lea edx, [esp + 0x10]
push edx
call eax
test eax, eax
mov eax, 1
jne 0x49edf3
mov ecx, 0x45
lea esi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov ecx, dword [esp + 0x15c]
xor ecx, esp
call fcn.004d7eb0
add esp, 0x160
ret
mov eax, 1
mov ecx, dword [esp + 0x164]
pop edi
pop esi
xor ecx, esp
call fcn.004d7eb0
add esp, 0x160
ret

Function at 0x49eec0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [0x5448b4]
sub esp, 0xc
test eax, eax
jne 0x49ef0d
mov eax, 4
mov dword [esp + 8], eax
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x10]
push edx
push str.UserID
push 0x51ba74
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], 0xffffffff
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [esp]
mov dword [0x5448b4], eax
add esp, 0xc
ret
Function at 0x49fa40
Capabilities:
Check if file exists
Link many functions at runtime

Disassembly:
sub esp, 0x804
mov eax, dword [0x541f38]
xor eax, esp
mov dword [esp + 0x800], eax
mov eax, dword [0x544668]
push esi
test eax, eax
jne 0x49fb17
mov ecx, dword [0x544664]
push edi
push 0x400
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea edx, [esp + 8]
push edx
call edi
xor esi, esi
cmp dword [0x544660], esi
jle 0x49faa1
lea eax, [esp + 8]
push eax
call edi
inc esi
cmp esi, dword [0x544660]
jl 0x49fa91
push 0x51bc84
lea ecx, [esp + 0xc]
push ecx
mov edx, ecx
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp + 8]
push eax
call fcn.00476860
add esp, 4
pop edi
test eax, eax
jne 0x49faed
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x49fae9
push 1
lea edx, [esp + 8]
push 0x53f9d8
push edx
call fcn.00476d50
add esp, 0xc
xor eax, eax
jmp 0x49faf8
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x544668], eax
test eax, eax
jne 0x49fb17
pop esi
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.004d7eb0
add esp, 0x804
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Get360CommonInstance
push eax
call esi
mov ecx, dword [0x544668]
push str.Get360ProductHistoryManager
push ecx
mov dword [0x54466c], eax
call esi
mov edx, dword [0x544668]
push str.Create360FireWareStateFunction
push edx
mov dword [0x544674], eax
call esi
mov dword [0x544678], eax
mov eax, dword [0x544668]
push str.GetFireWallState
push eax
call esi
mov ecx, dword [0x544668]
push str.Create360FireWareStateFunction2
push ecx
mov dword [0x54467c], eax
call esi
mov edx, dword [0x544668]
push str.GetIAdMgr
push edx
mov dword [0x544680], eax
call esi
mov ecx, dword [esp + 0x804]
pop esi
mov dword [0x544670], eax
xor ecx, esp
mov eax, 1
call fcn.004d7eb0
add esp, 0x804
ret

Function at 0x49fbb0
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x49fc01
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x49fc01
push esi
call fcn.00476ee0
add esp, 4
mov dword [0x544668], eax
test eax, eax
je 0x49fc01
push str.Get360CommonInstance
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x54466c], eax
test eax, eax
jne 0x49fc05
mov eax, dword [0x544668]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x54466c], 0
xor eax, eax
pop esi
ret
pop esi
jmp eax
Function at 0x4a0420
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
push edi
test ebx, ebx
je 0x4a04ff
mov ebp, dword [esp + 0x24]
test ebp, ebp
je 0x4a04ff
mov edi, dword [esp + 0x28]
test edi, edi
je 0x4a04ff
push 0x527f5c
lea ecx, [esp + 0x14]
call fcn.0043a930
xor ecx, ecx
mov eax, 0x800
mov dword [esp + 0x20], eax
mov edx, 2
mul edx
seto cl
mov dword [esp + 0x14], 1
neg ecx
or ecx, eax
push ecx
call fcn.004d45ee
mov esi, eax
add esp, 4
test esi, esi
je 0x4a04c3
mov eax, dword [esp + 0x20]
lea ecx, [eax + eax]
push ecx
push 0
push esi
call fcn.004d86e0
add esp, 0xc
lea edx, [esp + 0x20]
push edx
push esi
lea eax, [esp + 0x1c]
push eax
push edi
push ebp
push ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push esi
lea ecx, [esp + 0x14]
call fcn.0043a860
push esi
call fcn.004d7e25
add esp, 4
mov esi, dword [esp + 0x10]
add esi, 0xfffffff0
push esi
call fcn.00439080
mov edi, dword [esp + 0x20]
add eax, 0x10
add esp, 4
mov dword [edi], eax
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4a04f5
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov esi, dword [esp + 0x1c]
push 0x527f5c
mov ecx, esi
call fcn.0043a930
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x4a0930
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x408
mov eax, dword [0x541f38]
xor eax, esp
mov dword [esp + 0x404], eax
test byte [0x5449a4], 1
jne 0x4a0978
mov eax, dword [0x54ffc8]
mov edx, dword [eax + 0xc]
or dword [0x5449a4], 1
mov ecx, 0x54ffc8
call edx
add eax, 0x10
push 0x514730
mov dword [0x5449a0], eax
call fcn.004d869c
add esp, 4
mov eax, dword [0x5449a0]
cmp dword [eax - 0xc], 0
jne 0x4a0a3b
push edi
push str.360ver.dll
call fcn.004a0780
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.00477210
mov edi, dword [esp + 0x10]
push edi
call fcn.00476860
add esp, 0x10
push edi
test eax, eax
jne 0x4a09cb
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4a0a1e
push 1
push 0x53f9d8
push edi
call fcn.00476d50
add esp, 0xc
jmp 0x4a0a1e
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x4a0a1e
push esi
push str.Get360SafeVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4a0a1d
xor edx, edx
push 0x3fe
push edx
lea eax, [esp + 0x16]
push eax
mov word [esp + 0x18], dx
call fcn.004d86e0
lea ecx, [esp + 0x18]
push 0x200
push ecx
call esi
add esp, 0x14
lea edx, [esp + 0xc]
push edx
mov ecx, 0x5449a0
call fcn.0043a860
pop esi
lea eax, [edi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
pop edi
test edx, edx
jg 0x4a0a3b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x404]
xor ecx, esp
mov eax, 0x5449a0
call fcn.004d7eb0
add esp, 0x408
ret
Function at 0x4a0ba0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x6c
mov eax, dword [0x541f38]
xor eax, esp
mov dword [esp + 0x68], eax
test byte [0x5449b4], 1
jne 0x4a0be2
mov eax, dword [0x54ffc8]
mov edx, dword [eax + 0xc]
or dword [0x5449b4], 1
mov ecx, 0x54ffc8
call edx
add eax, 0x10
push 0x514790
mov dword [0x5449b0], eax
call fcn.004d869c
add esp, 4
mov eax, dword [0x5449b0]
cmp dword [eax - 0xc], 0
jne 0x4a0cc9
push esi
xor ecx, ecx
push 0x62
push ecx
lea edx, [esp + 0x12]
push edx
mov word [esp + 0x14], cx
call fcn.004d86e0
add esp, 0xc
push 0x515d5c
call fcn.004a0780
push eax
lea eax, [esp + 0xc]
push eax
call fcn.00477210
mov esi, dword [esp + 0x10]
push esi
call fcn.00476860
add esp, 0x10
push esi
test eax, eax
jne 0x4a0c4c
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4a0cac
push 1
push 0x53f9d8
push esi
call fcn.00476d50
add esp, 0xc
jmp 0x4a0cac
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x4a0cac
push str.CreateObject
push eax
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [esp + 4]
push ecx
push 0x51bdd4
call eax
test eax, eax
jl 0x4a0c9c
mov eax, dword [esp + 4]
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
push 0x32
lea ecx, [esp + 0xc]
push ecx
push eax
call edx
lea eax, [esp + 8]
push eax
mov ecx, 0x5449b0
call fcn.0043a860
mov eax, dword [esp + 4]
test eax, eax
je 0x4a0cac
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
pop esi
test edx, edx
jg 0x4a0cc9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x68]
xor ecx, esp
mov eax, 0x5449b0
call fcn.004d7eb0
add esp, 0x6c
ret

Function at 0x4a1441
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x570]
test eax, eax
je 0x4a147b
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 4], 0x103
je 0x4a147b
mov edx, dword [esi + 0x570]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x570], 0
cmp dword [esi + 0x570], 0
jne 0x4a14ae
lea eax, [esi + 0x58c]
push eax
mov ecx, esi
call fcn.004aea30
push 0
push 0
push esi
push 0x4a1390
push 0
push 0
call fcn.004d7fc0
add esp, 0x18
mov dword [esi + 0x570], eax
pop esi
pop ecx
ret

Function at 0x4a14c0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x574]
test eax, eax
je 0x4a14fb
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 4], 0x103
je 0x4a14fb
mov edx, dword [esi + 0x574]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x574], 0
cmp dword [esi + 0x574], 0
jne 0x4a152e
lea eax, [esi + 0x58c]
push eax
mov ecx, esi
call fcn.004aea30
push 0
push 0
push esi
push 0x4a13d0
push 0
push 0
call fcn.004d7fc0
add esp, 0x18
mov dword [esi + 0x574], eax
pop esi
pop ecx
ret
Function at 0x4a1540
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x578]
test eax, eax
je 0x4a157b
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 4], 0x103
je 0x4a157b
mov edx, dword [esi + 0x578]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x578], 0
cmp dword [esi + 0x578], 0
jne 0x4a15ae
lea eax, [esi + 0x58c]
push eax
mov ecx, esi
call fcn.004aea30
push 0
push 0
push esi
push 0x4a1350
push 0
push 0
call fcn.004d7fc0
add esp, 0x18
mov dword [esi + 0x578], eax
pop esi
pop ecx
ret

Function at 0x4a15c0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x580]
test eax, eax
je 0x4a15fb
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 4], 0x103
je 0x4a15fb
mov edx, dword [esi + 0x580]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x580], 0
cmp dword [esi + 0x580], 0
jne 0x4a162e
lea eax, [esi + 0x58c]
push eax
mov ecx, esi
call fcn.004aea30
push 0
push 0
push esi
push 0x4a12b0
push 0
push 0
call fcn.004d7fc0
add esp, 0x18
mov dword [esi + 0x580], eax
pop esi
pop ecx
ret

Function at 0x4a1641
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x57c]
test eax, eax
je 0x4a167b
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 4], 0x103
je 0x4a167b
mov edx, dword [esi + 0x57c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x57c], 0
cmp dword [esi + 0x57c], 0
jne 0x4a16ae
lea eax, [esi + 0x58c]
push eax
mov ecx, esi
call fcn.004aea30
push 0
push 0
push esi
push 0x4a1310
push 0
push 0
call fcn.004d7fc0
add esp, 0x18
mov dword [esi + 0x57c], eax
pop esi
pop ecx
ret

Function at 0x4a16c0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x584]
test eax, eax
je 0x4a16fb
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 4], 0x103
je 0x4a16fb
mov edx, dword [esi + 0x584]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x584], 0
cmp dword [esi + 0x584], 0
jne 0x4a1720
push 0
push 0
push esi
push 0x4a1410
push 0
push 0
call fcn.004d7fc0
add esp, 0x18
mov dword [esi + 0x584], eax
pop esi
pop ecx
ret
Function at 0x4a64b0
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 4]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, ecx
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
imul ecx, eax
push edi
mov dword [esi + 8], ecx
test ebp, ebp
jne 0x4a64d0
mov ebp, edx
mov ecx, dword [esi + 4]
xor edi, edi
test cl, cl
jns 0x4a6546
test edx, edx
jne 0x4a6509
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004d45ee
mov edi, eax
mov eax, dword [esi + 0x1c]
add eax, eax
push eax
push ebp
push edi
call fcn.004d8210
add esp, 0x10
mov edx, edi
mov ebp, edi
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x4a6522
movzx ecx, word [edx + eax*2 - 2]
dec eax
rol cx, 8
mov word [edx + eax*2], cx
test eax, eax
jne 0x4a6510
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0
push ecx
mov eax, esp
push ecx
mov dword [eax], 0
mov eax, esp
lea ecx, [esi + 0x20]
push ecx
mov dword [eax], 0x520408
call fcn.004aa580
add esp, 0x18
mov edx, dword [esi]
mov eax, dword [esi + 8]
push edx
push 1
push eax
push ebp
call fcn.004dc2b5
add esp, 0x10
cmp eax, 1
sete bl
test edi, edi
je 0x4a656b
push edi
call fcn.004d7e25
add esp, 4
test bl, bl
je 0x4a65ae
mov edx, dword [esi + 0x1c]
mov ecx, dword [esi + 8]
add dword [esi + 0x14], ecx
cmp dword [esi + 0x54], 8
push 0xffffffffffffffff
push edx
push 0x18
push ecx
mov ecx, esp
jb 0x4a658b
mov eax, dword [esi + 0x40]
jmp 0x4a658e
lea eax, [esi + 0x40]
push ecx
mov dword [ecx], eax
mov eax, esp
add esi, 0x20
push esi
mov dword [eax], str.write
call fcn.004aa580
add esp, 0x18
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
ret 8
mov ecx, esi
call fcn.004a6320
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
ret 8