joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49ad5c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7fc
push esi
push edi
mov esi, 0x4de31c
lea edi, [ebp - 0x804]
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push dword [ebp + 8]
push 0x800
lea edx, [ebp - 0x804]
push edx
call fcn.004a1658
add esp, 0x10
lea ecx, [ebp - 0x804]
push ecx
call sub.KERNEL32.DLL_OutputDebugStringW
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x49adac
Capabilities:
Create directory
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcf0
push esi
push edi
mov esi, 0x4deb1c
lea edi, [ebp - 0x108]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
mov esi, 0x4dec20
lea edi, [ebp - 0x20c]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
mov esi, 0x4ded24
lea edi, [ebp - 0x310]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x20c]
push edx
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push dword [ebp + 8]
lea ecx, [ebp - 0x108]
push ecx
call fcn.0049dac8
add esp, 8
push 0x4e4f0c
lea eax, [ebp - 0x108]
push eax
call fcn.0049dc09
add esp, 8
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
test edx, edx
je 0x49aeae
mov ecx, dword [ebp - 4]
mov byte [ecx], 0
inc dword [ebp - 4]
lea eax, [ebp - 0x108]
push eax
lea edx, [ebp - 0x310]
push edx
call fcn.0049dac8
add esp, 8
push 0x3a
lea ecx, [ebp - 0x310]
push ecx
call fcn.0049dbf1
add esp, 8
test eax, eax
jne 0x49ae77
push 0
lea eax, [ebp - 0x310]
push eax
call sub.KERNEL32.DLL_CreateDirectoryA
jmp 0x49ae8b
push 0x4e4f0e
lea edx, [ebp - 0x310]
push edx
call fcn.0049d9ec
add esp, 8
lea ecx, [ebp - 0x310]
push ecx
call sub.KERNEL32.DLL_SetCurrentDirectoryA
push dword [ebp - 4]
lea eax, [ebp - 0x108]
push eax
call fcn.0049dac8
add esp, 8
jmp 0x49ae15
lea edx, [ebp - 0x108]
push edx
call fcn.0049daf8
pop ecx
test eax, eax
je 0x49ae15
lea ecx, [ebp - 0x108]
push ecx
lea eax, [ebp - 0x310]
push eax
call fcn.0049dac8
add esp, 8
push 0
lea edx, [ebp - 0x310]
push edx
call sub.KERNEL32.DLL_CreateDirectoryA
lea ecx, [ebp - 0x20c]
push ecx
call sub.KERNEL32.DLL_SetCurrentDirectoryA
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x49ba28
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffba0
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov esi, 0x4e5460
lea edi, [ebp - 0x258]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
mov esi, 0x4e5564
lea edi, [ebp - 0x35c]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
mov esi, 0x4e5668
lea edi, [ebp - 0x460]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 8]
test eax, eax
je 0x49ba90
push dword [ebp - 8]
call fcn.0049daf8
pop ecx
cmp eax, 1
jae 0x49ba97
xor eax, eax
jmp 0x49bbc3
push dword [ebp - 8]
call fcn.0049daf8
pop ecx
mov edx, dword [ebp - 8]
movsx ecx, byte [edx + eax - 1]
cmp ecx, 0x5c
jne 0x49babe
push dword [ebp - 8]
call fcn.0049daf8
pop ecx
mov edx, dword [ebp - 8]
mov byte [edx + eax - 1], 0
push dword [ebp - 8]
push 0x4e6122
lea eax, [ebp - 0x460]
push eax
call fcn.004a16bc
add esp, 0xc
lea ecx, [ebp - 0x154]
push ecx
lea eax, [ebp - 0x460]
push eax
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
cmp edx, 0xffffffff
jne 0x49bafa
xor eax, eax
jmp 0x49bbc3
push 0x4e6127
lea edx, [ebp - 0x128]
push edx
call fcn.0049da7c
add esp, 8
test eax, eax
je 0x49bba1
push 0x4e6129
lea ecx, [ebp - 0x128]
push ecx
call fcn.0049da7c
add esp, 8
test eax, eax
je 0x49bba1
test byte [ebp - 0x154], 0x10
je 0x49bb68
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 8]
push 0x4e612c
lea edx, [ebp - 0x258]
push edx
call fcn.004a16bc
add esp, 0x10
lea edx, [ebp - 0x258]
mov eax, dword [ebp - 4]
call fcn.0049ba28
mov dword [ebp - 0x14], eax
jmp 0x49bba1
mov ecx, dword [0x4ead88]
mov eax, dword [ecx]
call fcn.00438228
lea edx, [ebp - 0x128]
push edx
push dword [ebp - 8]
push 0x4e6132
lea ecx, [ebp - 0x35c]
push ecx
call fcn.004a16bc
add esp, 0x10
lea edx, [ebp - 0x35c]
mov eax, dword [ebp - 4]
call fcn.0049bbcc
lea ecx, [ebp - 0x154]
push ecx
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x49bafa
push dword [ebp - 0x10]
call sub.KERNEL32.DLL_FindClose
mov eax, dword [ebp - 0x14]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x49cc38
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov eax, 0x4e7110
call fcn.0049df88
mov dword [ebp - 8], 1
lea edx, [ebp + 0xc]
lea eax, [ebp + 0xc]
call fcn.004ad78c
inc dword [ebp - 8]
mov word [ebp - 0x14], 8
mov eax, dword [ebp + 0xc]
call fcn.00484140
test al, al
je 0x49ccd7
mov edx, 0x20
mov eax, dword [ebp + 0xc]
call fcn.00484150
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x49cc88
mov ecx, dword [ebp + 0xc]
jmp 0x49cc8d
mov ecx, 0x4e7019
push ecx
call sub.KERNEL32.DLL_DeleteFileA
test eax, eax
je 0x49ccb7
mov al, 1
push eax
dec dword [ebp - 8]
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.004ad880
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x49ccf1
xor eax, eax
push eax
dec dword [ebp - 8]
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.004ad880
pop eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x49ccf1
dec dword [ebp - 8]
lea eax, [ebp + 0xc]
mov edx, 2
call fcn.004ad880
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x49cd44
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
mov dword [ebp - 4], eax
push 0
lea edx, [ebp - 4]
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x49cd7e
call sub.KERNEL32.DLL_GetLastError
push eax
push 0x4e71a7
call fcn.004a0978
add esp, 8
or eax, 0xffffffff
pop ecx
pop ebp
ret
mov eax, dword [ebp - 4]
pop ecx
pop ebp
ret

Function at 0x49cd84
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
mov dword [ebp - 4], eax
push 0
lea edx, [ebp - 4]
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
jne 0x49cdbe
call sub.KERNEL32.DLL_GetLastError
push eax
push 0x4e71cd
call fcn.004a0978
add esp, 8
or eax, 0xffffffff
pop ecx
pop ebp
ret
mov eax, dword [ebp - 4]
pop ecx
pop ebp
ret

Function at 0x49ee90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x49eeac
call fcn.004a0618
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x49eec8
test bl, 1
je 0x49eec8
call fcn.004a7f78
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x49f0ac
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.004a01b4
test byte [ebp + 0xd], 0xc0
jne 0x49f0d0
mov eax, dword [0x4e7fb8]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x49f0dd
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x49f10a
je 0x49f11c
sub ecx, 0x100
je 0x49f12a
sub ecx, 0x100
je 0x49f131
sub ecx, 0x100
je 0x49f123
jmp 0x49f138
sub ecx, 0x600
je 0x49f131
sub ecx, 0x100
je 0x49f11c
jmp 0x49f138
mov edi, 1
jmp 0x49f13d
mov edi, 2
jmp 0x49f13d
mov edi, 4
jmp 0x49f13d
mov edi, 5
jmp 0x49f13d
mov edi, 3
test byte [ebp + 0xd], 1
je 0x49f164
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x4e7a30]
test al, 0x80
je 0x49f15d
mov ebx, 0x80
jmp 0x49f176
mov ebx, 1
jmp 0x49f176
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x49f176
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x49f188
je 0x49f191
dec eax
je 0x49f19a
jmp 0x49f1a3
mov dword [ebp - 4], closesocket
jmp 0x49f1b2
mov dword [ebp - 4], 0x40000000
jmp 0x49f1b2
mov dword [ebp - 4], 0xc0000000
jmp 0x49f1b2
push 1
call fcn.004a05ac
pop ecx
mov ebx, eax
jmp 0x49f2a2
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x49f1ce
sub eax, 0x10
je 0x49f1d5
sub eax, 0x10
je 0x49f1de
sub eax, 0x10
je 0x49f1e7
jmp 0x49f1e7
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x49f1ee
mov dword [ebp - 8], 1
jmp 0x49f1ee
mov dword [ebp - 8], 2
jmp 0x49f1ee
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x49f25b
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x49f250
test byte [ebp + 0xd], 1
je 0x49f24b
mov ebx, 0x50
jmp 0x49f250
mov ebx, 2
push ebx
call fcn.004a05ac
pop ecx
mov ebx, eax
jmp 0x49f2a2
mov edi, esi
push edi
call fcn.0049f010
pop ecx
test eax, eax
je 0x49f26f
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x49f27b
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.004a02d4
add esp, 8
mov ebx, eax
inc eax
jne 0x49f2a2
push 4
call fcn.004a05ac
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.004a01e8
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49f464
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.004a01b4
test byte [ebp + 0xd], 0xc0
jne 0x49f488
mov eax, dword [0x4e7fb8]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x49f495
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x49f4c2
je 0x49f4d4
sub ecx, 0x100
je 0x49f4e2
sub ecx, 0x100
je 0x49f4e9
sub ecx, 0x100
je 0x49f4db
jmp 0x49f4f0
sub ecx, 0x600
je 0x49f4e9
sub ecx, 0x100
je 0x49f4d4
jmp 0x49f4f0
mov edi, 1
jmp 0x49f4f5
mov edi, 2
jmp 0x49f4f5
mov edi, 4
jmp 0x49f4f5
mov edi, 5
jmp 0x49f4f5
mov edi, 3
test byte [ebp + 0xd], 1
je 0x49f51c
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x4e7a30]
test al, 0x80
je 0x49f515
mov ebx, 0x80
jmp 0x49f52e
mov ebx, 1
jmp 0x49f52e
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
mov ebx, eax
cmp eax, 0xffffffff
jne 0x49f52e
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x49f540
je 0x49f549
dec eax
je 0x49f552
jmp 0x49f55b
mov dword [ebp - 4], closesocket
jmp 0x49f56a
mov dword [ebp - 4], 0x40000000
jmp 0x49f56a
mov dword [ebp - 4], 0xc0000000
jmp 0x49f56a
push 1
call fcn.004a05ac
pop ecx
mov ebx, eax
jmp 0x49f65a
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x49f586
sub eax, 0x10
je 0x49f58d
sub eax, 0x10
je 0x49f596
sub eax, 0x10
je 0x49f59f
jmp 0x49f59f
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x49f5a6
mov dword [ebp - 8], 1
jmp 0x49f5a6
mov dword [ebp - 8], 2
jmp 0x49f5a6
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileW
mov esi, eax
cmp eax, 0xffffffff
jne 0x49f613
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x49f608
test byte [ebp + 0xd], 1
je 0x49f603
mov ebx, 0x50
jmp 0x49f608
mov ebx, 2
push ebx
call fcn.004a05ac
pop ecx
mov ebx, eax
jmp 0x49f65a
mov edi, esi
push edi
call fcn.0049f010
pop ecx
test eax, eax
je 0x49f627
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x49f633
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.004a02d4
add esp, 8
mov ebx, eax
inc eax
jne 0x49f65a
push 4
call fcn.004a05ac
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.004a01e8
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a0098
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x104
call fcn.0049d30c
pop ecx
mov ebx, eax
test eax, eax
jne 0x4a00bc
xor eax, eax
jmp 0x4a0165
lea edx, [ebp - 4]
push edx
push ebx
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call sub.KERNEL32.DLL_GetFullPathNameA
mov esi, eax
test esi, esi
je 0x4a00dd
cmp esi, 0x104
jb 0x4a00e8
push ebx
call fcn.0049d31c
pop ecx
xor eax, eax
jmp 0x4a0165
cmp byte [ebx + 1], 0x3a
jne 0x4a0118
mov dl, byte [ebx]
lea ecx, [ebp - 8]
mov byte [ebp - 8], dl
mov byte [ebp - 7], 0x3a
mov byte [ebp - 6], 0x5c
mov byte [ebp - 5], 0
push ecx
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 2
jae 0x4a0118
push ebx
call fcn.0049d31c
pop ecx
xor eax, eax
jmp 0x4a0165
inc esi
test edi, edi
je 0x4a015b
cmp esi, dword [ebp + 0x10]
jbe 0x4a012d
push ebx
call fcn.0049d31c
pop ecx
xor eax, eax
jmp 0x4a0165
push edi
mov esi, edi
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
push ebx
call fcn.0049d31c
pop ecx
mov eax, edi
jmp 0x4a0165
push esi
push ebx
call fcn.0049d32c
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4a495c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.KERNEL32.DLL_GetLocaleInfoA
push 0x4e8d67
lea ecx, [ebp - 0x200]
push ecx
call fcn.0049d9ec
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.0049daf8
pop ecx
mov edx, pe_nt_image_headers32
sub edx, eax
push edx
lea ecx, [ebp - 0x200]
push ecx
call fcn.0049daf8
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
push 0x4e8d69
lea ecx, [ebp - 0x200]
push ecx
call fcn.0049d9ec
add esp, 8
push 0xa
lea eax, [ebp - 0x200]
push eax
call fcn.0049daf8
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov ecx, dword [ebx]
push ecx
call fcn.004a5bc8
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0x4a4a6d
push esi
call fcn.0049daf8
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call fcn.0049daf8
pop ecx
add edi, eax
add edi, 3
push edi
call fcn.0049d30c
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0x4a4a44
xor eax, eax
jmp 0x4a4af4
push esi
call fcn.0049daf8
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call fcn.0049daf8
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call fcn.0049d948
add esp, 0xc
jmp 0x4a4aad
mov edi, dword [ebx + 0x24]
push edi
call fcn.0049daf8
pop ecx
push eax
push esi
call fcn.0049daf8
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.0049daf8
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call fcn.0049d32c
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x4a4aad
xor eax, eax
jmp 0x4a4af4
push esi
mov edx, dword [ebx + 0x24]
push edx
call fcn.0049d9ec
add esp, 8
push 0x4e8d6b
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.0049d9ec
add esp, 8
lea eax, [ebp - 0x200]
push eax
mov edx, dword [ebx + 0x24]
push edx
call fcn.0049d9ec
add esp, 8
push 0x4e8d6d
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.0049d9ec
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a7f10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x4a7f72
call fcn.004a7ec0
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.0049daf8
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.0049daf8
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4a7ff0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x4e9378], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x4a80ca
cmp dword [0x4e9374], 0
jne 0x4a80ca
cmp dword [0x4e9558], 0
je 0x4a8084
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.004a7da0
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4a806a
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.004a7da0
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4a806a
lea ebx, [ebp - 0x84]
jmp 0x4a806b
inc ebx
call fcn.004a7fac
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x4a8105
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x4e937c
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.0049daf8
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x4e937f
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x4a8105
cmp dword [0x4e9374], 0
je 0x4a80e4
cmp dword [0x4e9374], 0xffffffff
je 0x4a8105
push esi
call dword [0x4e9374]
pop ecx
mov eax, dword [0x4e9378]
test eax, eax
je 0x4a8105
cmp dword [0x4e9378], 0xffffffff
je 0x4a8105
cmp byte [eax], 0
je 0x4a8105
push esi
push eax
call fcn.004a7f10
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a8900
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x4ec7a8], 0
jne 0x4a8981
cmp dword [0x4ec7c8], 0
jne 0x4a8930
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x4ec7c8], eax
test eax, eax
jne 0x4a8930
push 0x4e9490
call fcn.004a811c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x4ec7c8]
jmp 0x4a8944
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.0049daf8
pop ecx
mov edi, eax
test eax, eax
jne 0x4a893c
lea edi, [ebp + 1]
push edi
call fcn.0049d30c
pop ecx
mov ebx, eax
mov dword [0x4ec7ac], ebx
test ebx, ebx
jne 0x4a896e
xor eax, eax
jmp 0x4a8a44
push edi
mov edx, dword [0x4ec7c8]
push edx
push ebx
call fcn.0049d8d8
add esp, 0xc
jmp 0x4a89a1
xor esi, esi
mov ebx, dword [0x4ec7a8]
jmp 0x4a899b
push eax
call fcn.0049daf8
pop ecx
test eax, eax
jne 0x4a8997
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4a898b
lea ebx, [esi + 4]
push 4
mov dword [0x4ec7b0], ebx
inc ebx
push ebx
call fcn.0049cde4
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x4a89c4
xor eax, eax
jmp 0x4a8a44
cmp dword [0x4ec7a8], 0
jne 0x4a89f5
xor esi, esi
mov ebx, dword [0x4ec7ac]
mov eax, dword [esp]
mov ebp, eax
jmp 0x4a89e6
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.0049daf8
pop ecx
mov edi, eax
test eax, eax
jne 0x4a89dc
jmp 0x4a8a26
xor esi, esi
mov ebx, dword [0x4ec7a8]
mov eax, dword [esp]
mov edi, eax
jmp 0x4a8a20
push eax
call fcn.0049daf8
pop ecx
test eax, eax
je 0x4a8a15
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x4a8a19
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4a8a04
mov eax, dword [0x4ec7a8]
test eax, eax
je 0x4a8a36
push eax
call fcn.0049d31c
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x4ec7a8], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4070cc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x42afec
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x18], 1
push eax
push 0xb5
call fcn.0042a41c
lea edi, [esi + 0x68]
mov byte [esp + 0x18], 2
mov ecx, edi
call sub.mfc42.dll_CString::CString
lea ebx, [esi + 0x6c]
mov byte [esp + 0x18], 3
mov ecx, ebx
call sub.mfc42.dll_CString::CString
lea ecx, [esi + 0xc8]
mov byte [esp + 0x18], 4
call fcn.00403a40
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
lea eax, [esp + 0x2c]
mov dword [esi + 0x60], ecx
push eax
mov ecx, edi
mov byte [esp + 0x1c], 5
mov dword [esi], 0x42f15c
mov dword [esi + 0x64], edx
call sub.mfc42.dll_CString::operator_1
lea ecx, [esp + 0x30]
push ecx
mov ecx, ebx
call sub.mfc42.dll_CString::operator_1
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x20]
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], ecx
xor eax, eax
lea ecx, [esp + 0x2c]
mov dword [esi + 0x70], edx
mov dword [esi + 0x7c], eax
mov byte [esp + 0x18], al
call fcn.0042a3b0
lea ecx, [esp + 0x30]
mov dword [esp + 0x18], 0xffffffff
call fcn.0042a3b0
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x20
Function at 0x40a540
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b378
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], esi
call sub.mfc42.dll_CFile::CFile
xor ebx, ebx
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], ebx
call sub.mfc42.dll_CException::CException
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call sub.mfc42.dll_CString::CString
push ebx
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 2
mov dword [ebp - 0x40], 0x42f264
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], 0xffffffff
call fcn.0042a470
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call sub.mfc42.dll_CString::CString
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x40]
push eax
push 0x20
push edi
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call sub.mfc42.dll_CFile::Open
test eax, eax
jne 0x40a562
push edi
lea ecx, [ebp - 0x14]
push 0x102
push ecx
call sub.mfc42.dll_AfxFormatString1
mov edx, dword [ebp - 0x14]
push ebx
push 0x40
push edx
call sub.mfc42.dll_AfxMessageBox_1
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.0042a3b0
mov dword [ebp - 0x40], 0x42f264
mov byte [ebp - 4], 5
jmp 0x40a688
lea ecx, [ebp - 0x2c]
call sub.mfc42.dll_CFile::GetLength
mov ecx, esi
mov edi, eax
call fcn.0040a6c0
push edi
push 0x42
call dword [sym.imp.kernel32.dll_GlobalAlloc]
cmp eax, ebx
mov dword [esi + 4], eax
jne 0x40a5ad
push 0xffffffffffffffff
push 0x40
push 0x100
call sub.mfc42.dll_AfxMessageBox
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.0042a3b0
mov dword [ebp - 0x40], 0x42f264
mov byte [ebp - 4], 6
jmp 0x40a688
push eax
call dword [sym.imp.kernel32.dll_GlobalLock]
push edi
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 7
call sub.mfc42.dll_CFile::Read
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 4
call sub.mfc42.dll_CFile::Close
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.kernel32.dll_GlobalUnlock]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.0042a3b0
mov dword [ebp - 0x40], 0x42f264
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0xa
call fcn.0042a3b0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x40], 0x42ecc4
mov dword [ebp - 4], 0xffffffff
call fcn.0042a680
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x30]
call fcn.0042a3b0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x40], 0x42ecc4
mov dword [ebp - 4], 0xffffffff
call fcn.0042a680
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4