joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ad2c0
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x58d168
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push esi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 0x1a0]
call fcn.004128f0
test al, al
je 0x4ad363
push 0x60
lea eax, [esp + 0x10]
push 0
push eax
call fcn.0056cbb0
add esp, 0xc
lea ecx, [esp + 0xc]
push dword [esi + 0x1a0]
call fcn.004aea50
mov dword [esp + 0x78], 0
push ecx
push dword [esi + 4]
lea ecx, [esp + 0x14]
call fcn.004ad690
push 0
call fcn.005690e1
mov ecx, dword [esi + 0x1a0]
add esp, 4
mov dword [ecx + 0x110], eax
mov dword [ecx + 0x114], edx
mov dword [esp + 0x78], 0xffffffff
lea ecx, [esp + 0xc]
call fcn.004aeb70
mov ecx, dword [esi + 0x1a0]
cmp byte [ecx + 0x108], 0
je 0x4ad3ac
mov eax, dword [ecx + 0x110]
or eax, dword [ecx + 0x114]
je 0x4ad3ac
xor eax, eax
mov bl, 1
cmp byte [ecx + 0x109], al
push 0
setne al
push eax
push 0xf1
push 0x43a
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4ad3ae
xor bl, bl
xor eax, eax
mov ecx, 5
test bl, bl
cmovne eax, ecx
push eax
push 0x43a
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x60]
xor ecx, esp
call fcn.00564de8
add esp, 0x70
ret 0x10

Function at 0x4adb50
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x58b76e
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [esp + 4], edx
lea eax, [edx + 8]
mov dword [edx + 4], 0
mov dword [esp + 8], eax
mov dword [eax + 0xc], 0
mov dword [esp + 0x14], 1
mov dword [edx + 0x18], 0
mov dword [edx + 0x1c], 0
mov dword [esp + 0x14], 4
mov eax, dword [esp + 0x1c]
mov ecx, eax
mov dword [edx], vtable.RC::RCPCSafeQQConfigDlg.0
mov dword [edx + 0x24], eax
mov dword [edx + 0x30], 0
mov eax, dword [ecx + 0xe8]
mov dword [edx + 0x28], eax
mov eax, dword [ecx + 0xec]
mov dword [edx + 0x2c], eax
mov dword [esp + 0x14], 0xffffffff
mov eax, edx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
add esp, 0x14
ret 4
Function at 0x4ae2f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x58d2a8
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0x4c], eax
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
push 0x21
xor eax, eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
lea ecx, [esp + 0xc]
push str._systemroot__system32control.exe
mov dword [esp + 0x24], 7
mov dword [esp + 0x20], 0
mov word [esp + 0x10], ax
call fcn.00404a80
mov dword [esp + 0x60], 0
lea edx, [esp + 8]
lea ecx, [esp + 0x20]
call fcn.004cced0
mov byte [esp + 0x60], 2
cmp dword [esp + 0x1c], 8
jb 0x4ae388
push dword [esp + 8]
call fcn.00564de3
add esp, 4
push 0x24
xor eax, eax
mov dword [esp + 0x20], 7
push str.__name_Microsoft.ProgramsAndFeatures
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], 0
mov word [esp + 0x10], ax
call fcn.00404880
cmp dword [esp + 0x34], 8
lea edx, [esp + 0x20]
lea ecx, [esp + 0x38]
cmovae edx, dword [esp + 0x20]
call fcn.004b1900
mov byte [esp + 0x60], 3
lea eax, [esp + 0x38]
cmp dword [esp + 0x4c], 0x10
push 1
cmovae eax, dword [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov byte [esp + 0x60], 2
cmp dword [esp + 0x4c], 0x10
jb 0x4ae3fa
push dword [esp + 0x38]
call fcn.00564de3
add esp, 4
mov dword [esp + 0x4c], 0xf
mov dword [esp + 0x48], 0
mov byte [esp + 0x38], 0
mov dword [esp + 0x60], 0xffffffff
cmp dword [esp + 0x34], 8
jb 0x4ae42a
push dword [esp + 0x20]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], 0
mov word [esp + 0x20], ax
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.00564de8
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4ae860
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, ecx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov eax, dword [ebx + 0x24]
lea edx, [eax + eax*4]
mov eax, dword [ebx + 0x2c]
add edx, edx
mov eax, dword [eax]
cmp byte [eax + edx*8 + 0x48], 0
jne 0x4ae8c1
push 0x5b9ff4
push 0
push 0xc
push 0x43f
push dword [ebx + 4]
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0x43e
push dword [ebx + 4]
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
push 5
push 0x43f
push dword [ebx + 4]
call edi
push eax
call esi
pop edi
pop esi
pop ebx
ret
cmp byte [eax + edx*8 + 0x49], 0
je 0x4ae8cf
push 0x5b9fec
jmp 0x4ae884
push 0
push 0x43f
push dword [ebx + 4]
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
push 5
push 0x43e
push dword [ebx + 4]
call edi
push eax
call esi
pop edi
pop esi
pop ebx
ret
Function at 0x4aecc0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x58d406
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0xa0], eax
push esi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0xb0]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea esi, [eax + eax*4]
mov eax, dword [ecx + 0x38]
shl esi, 4
mov eax, dword [eax + 0xfc]
cmp byte [eax + esi + 0x48], 0
je 0x4aede8
cmp byte [eax + esi + 0x49], 0
jne 0x4aede8
mov byte [eax + esi + 0x49], 1
mov eax, dword [ecx + 0x38]
lea ecx, [esp + 0xc]
push 0
mov edx, dword [eax + 0xfc]
add edx, 0x30
add edx, esi
call fcn.004b1890
add esp, 4
mov dword [esp + 0xb8], 0
lea eax, [esp + 0xc]
cmp dword [esp + 0x20], 0x10
push 1
cmovae eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
ja 0x4aedb5
push 0x80
lea eax, [esp + 0x28]
push 0
push eax
call fcn.0056cbb0
add esp, 0xc
lea ecx, [esp + 0x24]
call fcn.004ae160
mov byte [esp + 0xb8], 1
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [esp + 0x2c]
call fcn.004af760
mov byte [esp + 0xb8], 0
lea ecx, [esp + 0x24]
call fcn.004ae230
mov dword [esp + 0xb8], 0xffffffff
cmp dword [esp + 0x20], 0x10
jb 0x4aedd3
push dword [esp + 0xc]
call fcn.00564de3
add esp, 4
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], 0
mov byte [esp + 0xc], 0
mov ecx, dword [esp + 0xb0]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0xa0]
xor ecx, esp
call fcn.00564de8
mov esp, ebp
pop ebp
ret 4
Function at 0x4b4910
Capabilities:
Read file on windows

Disassembly:
mov edx, ecx
mov eax, dword [edx]
test eax, eax
jne 0x4b491d
xor al, al
ret 0xc
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x4b4918
cmp dword [eax], 0xffffffff
je 0x4b4918
mov eax, dword [esp + 0xc]
push 0
push eax
push dword [esp + 0x10]
mov dword [eax], 0
mov eax, dword [edx]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
setne al
ret 0xc

Function at 0x4b4980
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push edi
mov edi, dword [esp + 0x10]
test eax, eax
jne 0x4b49ad
xor al, al
pop edi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00564de8
add esp, 8
ret 4
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x4b4999
push esi
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4b49e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4b49e7
pop esi
xor al, al
pop edi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00564de8
add esp, 8
ret 4
mov ecx, dword [esp + 8]
xor eax, eax
add eax, esi
mov dword [edi], eax
mov al, 1
adc ecx, 0
mov dword [edi + 4], ecx
mov ecx, dword [esp + 0xc]
pop esi
pop edi
xor ecx, esp
call fcn.00564de8
add esp, 8
ret 4

Function at 0x4b4a30
Capabilities:
Check mutex on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
test eax, eax
je 0x4b4a46
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0
mov eax, dword [esp + 8]
mov word [esi + 4], 0
cmp dword [eax + 0x10], 0
je 0x4b4a60
cmp dword [eax + 0x14], 8
jb 0x4b4a62
mov eax, dword [eax]
jmp 0x4b4a62
xor eax, eax
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
test eax, eax
je 0x4b4a84
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4b4a84
mov byte [esi + 5], 1
cmp dword [esi], 0
pop esi
setne al
ret 4
Function at 0x4b4a90
Capabilities:
Check mutex on windows

Disassembly:
push 0xffffffffffffffff
push 0x58de18
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 8], eax
push ebx
push esi
push edi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov ebx, dword [esp + 0x2c]
test eax, eax
je 0x4b4ada
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
lea ecx, [esp + 0x14]
mov word [edi + 4], 0
mov dword [esp + 0x14], 0
call fcn.004c17e0
mov dword [esp + 0x24], 0
mov esi, dword [esp + 0x14]
cmp dword [esi], 0
je 0x4b4b07
lea eax, [esi + 8]
jmp 0x4b4b09
xor eax, eax
cmp dword [ebx + 0x10], 0
je 0x4b4b19
cmp dword [ebx + 0x14], 8
jb 0x4b4b1b
mov ebx, dword [ebx]
jmp 0x4b4b1b
xor ebx, ebx
push ebx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
test eax, eax
je 0x4b4b3c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4b4b3c
mov byte [edi + 5], 1
cmp dword [edi], 0
setne bl
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x4b4b66
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], 0
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4b4b7b
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 4], 0
push esi
call fcn.00564de3
add esp, 4
mov dword [esp + 0x14], 0
mov al, bl
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00564de8
add esp, 0x18
ret 4
Function at 0x4b4bf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x58de69
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x10], edi
push 0x18
call fcn.0056590a
add esp, 4
mov dword [edi + 0x20], eax
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esp + 0x38], 0
lea esi, [edi + 0x24]
mov dword [esi], 0
xor eax, eax
mov byte [esi + 4], 0
mov dword [esi + 0x1c], 7
mov dword [esi + 0x18], 0
mov dword [esp + 0x14], esi
mov word [esi + 8], ax
mov byte [esp + 0x38], 2
lea ecx, [esp + 0x18]
push eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 0x10], 0xffffffff
mov dword [edi + 0x14], 0xffffffff
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
push 0x5a87c4
mov byte [edi + 8], al
mov dword [edi + 0x18], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x1c], eax
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], eax
mov word [esp + 0x20], ax
call fcn.00404a80
mov byte [esp + 0x38], 3
mov eax, dword [esi]
test eax, eax
je 0x4b4cba
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x28], 0
mov dword [esi], 0
jne 0x4b4ccb
xor eax, eax
jmp 0x4b4cd9
cmp dword [esp + 0x2c], 8
lea eax, [esp + 0x18]
cmovae eax, dword [esp + 0x18]
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
lea ecx, [esi + 8]
sete al
mov byte [esi + 4], al
lea eax, [esp + 0x18]
cmp ecx, eax
je 0x4b4d0e
push 0xffffffffffffffff
push 0
push eax
call fcn.00404960
mov byte [esp + 0x38], 2
cmp dword [esp + 0x2c], 8
jb 0x4b4d26
push dword [esp + 0x18]
call fcn.00564de3
add esp, 4
xor eax, eax
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
mov word [esp + 0x18], ax
mov dword [esp + 0x38], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret
Function at 0x4b51a0
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x58df78
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esi + 8]
test edi, edi
jne 0x4b51e2
xor al, al
jmp 0x4b52a7
add edi, 0x20
mov dword [esp + 0x14], edi
je 0x4b51f8
mov eax, dword [edi]
test eax, eax
je 0x4b51f8
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x24], 0
mov eax, dword [esi + 8]
cmp dword [eax + 4], 0
je 0x4b5282
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
lea ebx, [esi + 4]
push 1
push ebx
call ebp
mov eax, dword [esi + 8]
add eax, 0xc
push eax
push 4
push esi
push 0x4b4d60
push 0
push 0
call fcn.005691c2
mov ecx, dword [esi + 8]
add esp, 0x18
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 8]
cmp dword [eax + 0x10], 0
je 0x4b526b
mov byte [eax + 8], 1
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x24]
test eax, eax
je 0x4b5256
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x4b526b
mov bl, 1
jmp 0x4b5284
push 0xffffffffffffffff
push ebx
call ebp
dec eax
jne 0x4b527a
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [esi + 8]
call fcn.004b4f10
xor bl, bl
mov dword [esp + 0x24], 0xffffffff
test edi, edi
je 0x4b52a5
mov eax, dword [edi]
test eax, eax
je 0x4b529d
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [esp + 0x14], 0
mov al, bl
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00564de8
add esp, 0x14
ret

Function at 0x4b5620
Capabilities:
Suspend thread
Terminate thread

Disassembly:
sub esp, 8
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 4], eax
push esi
push ecx
push 0
push 0x43
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
jne 0x4b5652
xor al, al
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00564de8
add esp, 8
ret
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x4b56ad
cmp dword [esp + 4], 0x103
jne 0x4b56ad
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0x5ba188
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.RtlFreeUserThreadStack
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x4b56a3
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
pop edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 8]
mov al, 1
pop esi
xor ecx, esp
call fcn.00564de8
add esp, 8
ret
Function at 0x4b7220
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5cd9f0
push 0x56f180
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x5e173c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x438], edi
mov dword [ebp - 0x43c], esi
mov dword [ebp - 4], 0
mov ecx, esi
call fcn.00403bf0
mov edx, esi
mov ecx, edi
call fcn.004b7380
mov bl, al
mov byte [ebp - 0x431], bl
mov dword [ebp - 4], 0xfffffffe
jmp 0x4b72b5
test bl, bl
jne 0x4b735d
cmp edi, 0x1a
jne 0x4b735d
mov dword [esi + 0x10], 0
cmp dword [esi + 0x14], 8
jb 0x4b72d7
mov eax, dword [esi]
jmp 0x4b72d9
mov eax, esi
xor ecx, ecx
mov word [eax], cx
xor eax, eax
mov word [ebp - 0x430], ax
push 0x40e
push eax
lea eax, [ebp - 0x42e]
push eax
call fcn.0056cbb0
add esp, 0xc
push 0x207
lea eax, [ebp - 0x430]
push eax
push 0x5ba2cc
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp word [ebp - 0x430], 0
jne 0x4b7321
xor ecx, ecx
jmp 0x4b733f
lea ecx, [ebp - 0x430]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4b7330
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x430]
push eax
mov ecx, esi
call fcn.00404a80
movzx ebx, bl
mov eax, 1
cmp dword [esi + 0x10], 0
cmovne ebx, eax
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00564de8
mov esp, ebp
pop ebp
ret

Function at 0x4b8050
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push edi
mov edi, dword [esp + 0x10]
cmp eax, 0xffffffff
jne 0x4b807e
xor al, al
pop edi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00564de8
add esp, 8
ret 4
push esi
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4b80b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4b80b9
pop esi
xor al, al
pop edi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00564de8
add esp, 8
ret 4
mov ecx, dword [esp + 8]
xor eax, eax
add eax, esi
mov dword [edi], eax
mov al, 1
adc ecx, 0
mov dword [edi + 4], ecx
mov ecx, dword [esp + 0xc]
pop esi
pop edi
xor ecx, esp
call fcn.00564de8
add esp, 8
ret 4
Function at 0x4b8170
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x58e456
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov byte [esi], 0
xor eax, eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], 0
mov word [esi + 4], ax
mov dword [esp + 0x18], eax
lea ecx, [esi + 0x1c]
push 0xffffffffffffffff
push eax
push dword [esp + 0x28]
mov dword [esi + 0x30], 7
mov dword [esi + 0x2c], eax
mov word [esi + 0x1c], ax
call fcn.00404960
mov byte [esp + 0x18], 1
cmp dword [esi + 0x2c], 0
jne 0x4b81eb
push 3
push 0x5ba338
lea ecx, [esi + 0x1c]
call fcn.00404a80
mov dword [esp + 0x18], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x4b8520
Capabilities:
Get file size
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x58e4e8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x5e173c]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [esp + 0x5c]
mov esi, dword [esp + 0x50]
mov eax, dword [esp + 0x58]
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
test ecx, ecx
je 0x4b8576
mov dword [ecx], 0
mov dword [eax], 0
cmp dword [edi], 0xffffffff
je 0x4b86fb
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x100000
mov eax, dword [esp + 0x54]
push 0
mov ebx, eax
mov dword [esp + 0x34], 0
cmp eax, 0x100000
lea eax, [esp + 0x34]
push eax
cmova ebx, ecx
push ebx
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
cmp dword [edi + 0x1c], 0
je 0x4b86c0
test eax, eax
je 0x4b86c0
mov ecx, dword [esp + 0x30]
jmp 0x4b85e0
cmp ecx, ebx
jae 0x4b86c4
call ebp
mov ecx, dword [edi]
mov dword [esp + 0x18], eax
cmp ecx, 0xffffffff
je 0x4b8623
lea eax, [esp + 0x38]
mov dword [esp + 0x38], 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4b8616
call ebp
test eax, eax
jne 0x4b8623
mov eax, dword [esp + 0x38]
xor ecx, ecx
add ecx, esi
adc eax, 0
jmp 0x4b8634
xorps xmm0, xmm0
movlpd qword [esp + 0x24], xmm0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push 0
push dword [esp + 0x1c]
push eax
push ecx
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [esp + 0x40], esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [edi + 4]
push eax
call fcn.00404960
mov dword [esp + 0x70], 0
mov ecx, dword [edi + 0x1c]
mov eax, dword [ecx]
mov dword [esp + 0x70], 0xffffffff
call dword [eax + 0x18]
mov esi, dword [esp + 0x14]
test eax, eax
jne 0x4b86c0
push eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push ebx
add eax, esi
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x30]
neg eax
sbb eax, eax
add ecx, dword [esp + 0x34]
and eax, 0x7fffbffb
mov dword [esp + 0x30], ecx
add eax, 0x80004005
jne 0x4b85e0
jmp 0x4b86c4
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x20]
add dword [edx], ecx
test eax, eax
jne 0x4b86f1
test ecx, ecx
je 0x4b86ed
mov eax, dword [esp + 0x54]
add esi, ecx
sub eax, ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x54], eax
mov ecx, 0x100000
jne 0x4b8594
mov al, 1
jmp 0x4b86fd
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x4b86fb
mov dword [ecx], eax
xor al, al
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00564de8
add esp, 0x38
ret 0x10
Function at 0x4b8720
Capabilities:
Clear file content

Disassembly:
push 0xffffffffffffffff
push 0x58e518
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5e173c]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [esp + 0x1c]
xorps xmm0, xmm0
push eax
push 1
push 0
push 0
movlpd qword [esp + 0x2c], xmm0
xor bl, bl
call fcn.004b80e0
mov ebp, dword [esp + 0x44]
test al, al
lea eax, [esp + 0x24]
movzx ecx, bl
mov ebx, dword [esp + 0x48]
mov edx, 1
push eax
push 0
cmovne ecx, edx
xorps xmm0, xmm0
push ebx
mov dword [esp + 0x24], ecx
mov ecx, edi
push ebp
movlpd qword [esp + 0x34], xmm0
call fcn.004b80e0
test al, al
je 0x4b88bc
cmp dword [esp + 0x24], ebp
jne 0x4b88bc
cmp dword [esp + 0x28], ebx
jne 0x4b88bc
mov ebp, dword [esp + 0x4c]
mov eax, dword [edi]
test ebp, ebp
jne 0x4b87f1
cmp eax, 0xffffffff
jne 0x4b87d4
xor al, al
xor ecx, ecx
test al, al
mov esi, 0x80004005
cmovne esi, ecx
jmp 0x4b8892
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
mov esi, 0x80004005
setne al
xor ecx, ecx
test al, al
cmovne esi, ecx
jmp 0x4b8892
mov ebx, dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp eax, 0xffffffff
jne 0x4b8800
xor al, al
jmp 0x4b8808
push eax
call ebx
test eax, eax
setne al
xor ecx, ecx
mov esi, 0x80004005
test al, al
cmovne esi, ecx
test esi, esi
je 0x4b8892
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push eax
push dword [esp + 0x50]
xor eax, eax
push dword [esp + 0x50]
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x74], esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [edi + 4]
push eax
call fcn.00404960
mov dword [esp + 0x64], 0
mov eax, dword [ebp]
mov dword [esp + 0x64], 0xffffffff
mov ecx, ebp
call dword [eax + 0x1c]
mov esi, eax
test esi, esi
jne 0x4b8892
mov eax, dword [edi]
cmp eax, 0xffffffff
jne 0x4b887a
xor al, al
jmp 0x4b8882
push eax
call ebx
test eax, eax
setne al
xor ecx, ecx
mov esi, 0x80004005
test al, al
cmovne esi, ecx
test esi, esi
jne 0x4b8818
cmp byte [esp + 0x18], 0
je 0x4b88b8
lea eax, [esp + 0x44]
xorps xmm0, xmm0
push eax
push 0
push dword [esp + 0x28]
mov ecx, edi
movlpd qword [esp + 0x50], xmm0
push dword [esp + 0x28]
call fcn.004b80e0
mov eax, esi
jmp 0x4b88e7
cmp byte [esp + 0x18], 0
je 0x4b88e2
lea eax, [esp + 0x44]
xorps xmm0, xmm0
push eax
push 0
push dword [esp + 0x28]
mov ecx, edi
movlpd qword [esp + 0x50], xmm0
push dword [esp + 0x28]
call fcn.004b80e0
mov eax, 0x80004005
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0xc