joyce8/EMBER2024-capa huggingface dataset:
Function at 0x484430
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ff468
mov eax, dword fs:[0]
push eax
sub esp, 0xdc
mov eax, dword [0x53e200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], 0
push 0x288
call fcn.004d851b
add esp, 4
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x288
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x4844a7
mov edx, dword [ebp - 0x2c]
push edx
call fcn.004d2ec6
add esp, 4
mov eax, dword [ebp - 0x3c]
push eax
call fcn.004d851b
add esp, 4
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x3c]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jne 0x4845ef
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x190]
push ecx
mov edx, dword [ebp - 0x2c]
add edx, 0x194
push edx
lea ecx, [ebp - 0x28]
call fcn.00437770
mov dword [ebp - 4], 0
push 1
lea ecx, [ebp - 0xe8]
call fcn.0047e350
mov byte [ebp - 4], 1
push 0x30
lea eax, [ebp - 0x35]
push eax
call fcn.004831c0
add esp, 8
push eax
push 0x4866c0
push 0x4862e0
lea ecx, [ebp - 0xe8]
call fcn.00483d90
mov ecx, eax
call fcn.00483d90
push eax
call fcn.00481c20
add esp, 8
mov dword [ebp - 0x30], 0
jmp 0x48453c
mov ecx, dword [ebp - 0x30]
add ecx, 1
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x28]
call fcn.004061f0
cmp dword [ebp - 0x30], eax
jae 0x4845a6
mov edx, dword [ebp - 0x30]
push edx
lea ecx, [ebp - 0x28]
call fcn.00406c00
movsx eax, byte [eax]
push eax
push 0
push 2
lea ecx, [ebp - 0x50]
push ecx
call fcn.004c58d7
add esp, 0xc
push eax
lea edx, [ebp - 0xe8]
push edx
call fcn.00481c40
add esp, 8
mov ecx, eax
call fcn.00483a70
lea ecx, [ebp - 0x28]
call fcn.004061f0
sub eax, 1
cmp dword [ebp - 0x30], eax
jae 0x4845a4
push 0x506f64
lea eax, [ebp - 0xe8]
push eax
call fcn.00481ca0
add esp, 8
jmp 0x484533
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.004d2ec6
add esp, 4
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0xe8]
call fcn.00480100
mov eax, dword [ebp - 0x34]
or eax, 1
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xe8]
call fcn.0047ea10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00405590
mov eax, dword [ebp + 8]
jmp 0x484614
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.004d2ec6
add esp, 4
push 0x506d86
mov ecx, dword [ebp + 8]
call fcn.004055e0
mov edx, dword [ebp - 0x34]
or edx, 1
mov dword [ebp - 0x34], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c626c
mov esp, ebp
pop ebp
ret
Function at 0x48ea50
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fff6d
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x53e200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x150], 0
push str.unknow
lea ecx, [ebp - 0x28]
call fcn.004055e0
mov dword [ebp - 4], 0
push 0x11c
push 0
lea eax, [ebp - 0x144]
push eax
call fcn.004c8420
add esp, 0xc
mov dword [ebp - 0x144], 0x11c
lea ecx, [ebp - 0x144]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x48ec04
mov edx, dword [ebp - 0x140]
mov dword [ebp - 0x148], edx
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x148], 5
jne 0x48eb0a
cmp dword [ebp - 0x14c], 1
jne 0x48eb0a
push str.winxp
lea ecx, [ebp - 0x28]
call fcn.0040ab20
jmp 0x48ec04
cmp dword [ebp - 0x148], 6
jne 0x48eb2e
cmp dword [ebp - 0x14c], 0
jne 0x48eb2e
push str.winvista
lea ecx, [ebp - 0x28]
call fcn.0040ab20
jmp 0x48ec04
cmp dword [ebp - 0x148], 6
jne 0x48eb52
cmp dword [ebp - 0x14c], 1
jne 0x48eb52
push str.win7
lea ecx, [ebp - 0x28]
call fcn.0040ab20
jmp 0x48ec04
cmp dword [ebp - 0x148], 6
jne 0x48eb76
cmp dword [ebp - 0x14c], 2
jne 0x48eb76
push str.win8
lea ecx, [ebp - 0x28]
call fcn.0040ab20
jmp 0x48ec04
cmp dword [ebp - 0x148], 6
jne 0x48eb97
cmp dword [ebp - 0x14c], 3
jne 0x48eb97
push str.win8.1
lea ecx, [ebp - 0x28]
call fcn.0040ab20
jmp 0x48ec04
cmp dword [ebp - 0x140], 0xa
jne 0x48ebc4
cmp dword [ebp - 0x13c], 0
jne 0x48ebc4
cmp dword [ebp - 0x138], 0x55f0
jb 0x48ebc4
push 0x5089b0
lea ecx, [ebp - 0x28]
call fcn.0040ab20
jmp 0x48ec04
cmp dword [ebp - 0x148], 0xa
jne 0x48ebe5
cmp dword [ebp - 0x14c], 0
jne 0x48ebe5
push str.win10
lea ecx, [ebp - 0x28]
call fcn.0040ab20
jmp 0x48ec04
cmp dword [ebp - 0x148], 0xa
jne 0x48ec04
cmp dword [ebp - 0x14c], 0
jle 0x48ec04
push str.win11
lea ecx, [ebp - 0x28]
call fcn.0040ab20
lea ecx, [ebp - 0x28]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00407370
mov edx, dword [ebp - 0x150]
or edx, 1
mov dword [ebp - 0x150], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00405590
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c626c
mov esp, ebp
pop ebp
ret

Function at 0x48ec50
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov byte [ebp - 1], 0
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx ecx, word [ebp - 0x28]
cmp ecx, 9
je 0x48ec76
movzx edx, word [ebp - 0x28]
cmp edx, 0xc
jne 0x48ec7a
mov byte [ebp - 1], 1
movzx eax, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x48f8e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x500050
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x53e200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x248], ecx
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x23c], 4
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x238]
push ecx
lea edx, [ebp - 0x240]
push edx
push 0
push str.SystemComponent
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x238], 1
jne 0x48f95b
mov al, 1
jmp 0x48fa79
push 0x208
push 0
lea ecx, [ebp - 0x218]
push ecx
call fcn.004c8420
add esp, 0xc
mov dword [ebp - 0x23c], 0x208
lea edx, [ebp - 0x23c]
push edx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x240]
push ecx
push 0
push str.DisplayName
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x48f9b9
mov al, 1
jmp 0x48fa79
mov dword [ebp - 0x244], 0
lea ecx, [ebp - 0x244]
push ecx
push 0
push 0
push 0
push str.ParentKeyName
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x48f9ea
mov al, 1
jmp 0x48fa79
mov dword [ebp - 0x238], 0
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x238]
push ecx
lea edx, [ebp - 0x240]
push edx
push 0
push str.ClickToRunComponent
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x238], 1
jne 0x48fa27
mov al, 1
jmp 0x48fa79
mov ecx, dword [ebp + 0x14]
call fcn.004064a0
push eax
lea ecx, [ebp - 0x230]
push ecx
call fcn.00497080
add esp, 8
mov dword [ebp - 4], 0
lea edx, [ebp - 0x230]
push edx
mov eax, dword [ebp - 0x248]
mov ecx, dword [eax]
call fcn.00491220
mov byte [ebp - 0x231], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.00405590
mov al, byte [ebp - 0x231]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c626c
mov esp, ebp
pop ebp
ret 0x10
Function at 0x496740
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x496783
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x496783
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x496785
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x496790
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
cmp dword [ebp + 8], 0
jne 0x4967a3
xor eax, eax
jmp 0x49683f
push 0x44
push 0
lea eax, [ebp - 0x54]
push eax
call fcn.004c8420
add esp, 0xc
mov dword [ebp - 0x54], 0x44
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ecx
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4967fd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
xor eax, eax
jmp 0x49683f
mov ecx, dword [ebp + 0x18]
call fcn.00403b60
movzx edx, al
test edx, edx
je 0x496814
mov ecx, dword [ebp + 0x18]
call fcn.00401b40
cmp dword [ebp + 0x10], 0
je 0x496826
push 0xffffffffffffffff
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x496850
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
cmp dword [ebp + 8], 0
jne 0x496860
xor eax, eax
jmp 0x4968d8
push 0x44
push 0
lea eax, [ebp - 0x54]
push eax
call fcn.004c8420
add esp, 0xc
mov dword [ebp - 0x54], 0x44
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ecx
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4968ad
xor eax, eax
jmp 0x4968d8
cmp dword [ebp + 0xc], 0
je 0x4968bf
push 0xffffffffffffffff
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x49e5d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], ecx
cmp dword [ebp + 0x10], 0
jg 0x49e5f0
jl 0x49e5e7
cmp dword [ebp + 0xc], 0
ja 0x49e5f0
xor eax, eax
xor edx, edx
jmp 0x49e727
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
je 0x49e612
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call fcn.00480430
jmp 0x49e727
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 8]
call fcn.0047b1c0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x49e681
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.00476840
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 8]
call fcn.0047bd60
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00479b50
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 8]
call fcn.0047f4c0
mov eax, dword [ebp - 8]
cmp dword [eax + 0x4c], 0
je 0x49e718
mov ecx, dword [ebp - 8]
call fcn.0047b5d0
mov dword [ebp - 0x18], 0xfff
cmp dword [ebp - 4], 0xfff
jbe 0x49e6f1
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.004dfc62
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
cmp dword [ebp - 0x10], 0xfff
je 0x49e6ef
xor eax, eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
sbb edx, eax
mov eax, ecx
jmp 0x49e727
jmp 0x49e69d
cmp dword [ebp - 4], 0
jbe 0x49e718
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.004dfc62
add esp, 0x10
mov ecx, dword [ebp - 4]
sub ecx, eax
mov dword [ebp - 4], ecx
xor edx, edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
sbb ecx, edx
mov edx, ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4a4c50
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x501998
mov eax, dword fs:[0]
push eax
sub esp, 0x120
mov eax, dword [0x53e200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x28]
push eax
call fcn.0048ef50
add esp, 4
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
push ecx
push 0x50b0c0
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x70]
push eax
call fcn.0049d3a0
add esp, 0xc
mov dword [ebp - 0x74], eax
mov ecx, dword [ebp - 0x74]
mov dword [ebp - 0x78], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x78]
push edx
lea eax, [ebp - 0x58]
push eax
call fcn.0049d2d0
add esp, 0xc
mov dword [ebp - 0x7c], eax
mov ecx, dword [ebp - 0x7c]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00483990
lea ecx, [ebp - 0x58]
call fcn.00405590
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x70]
call fcn.00405590
push 0xffffffffffffffff
push 0x50b0c4
mov ecx, dword [ebp + 0xc]
call fcn.004a95e0
cmp eax, 0xffffffff
jne 0x4a4d08
push str..url
lea ecx, [ebp - 0x28]
call fcn.004870a0
push 1
push 0x40
push 2
lea edx, [ebp - 0x28]
push edx
lea ecx, [ebp - 0x12c]
call fcn.004a1ff0
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x40]
call fcn.004073d0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x12c]
call fcn.004a9400
movzx ecx, al
test ecx, ecx
je 0x4a4e1f
push 0x483110
push str._InternetShortcut_
lea edx, [ebp - 0x12c]
push edx
call fcn.00481ca0
add esp, 8
mov ecx, eax
call fcn.00483d70
push 0x483110
mov eax, dword [ebp + 8]
push eax
push str.URL
lea ecx, [ebp - 0x12c]
push ecx
call fcn.00481ca0
add esp, 8
push eax
call fcn.00481c70
add esp, 8
mov ecx, eax
call fcn.00483d70
push 0x483110
push str.IconIndex0
lea edx, [ebp - 0x12c]
push edx
call fcn.00481ca0
add esp, 8
mov ecx, eax
call fcn.00483d70
push 0x483110
push str.IDList
lea eax, [ebp - 0x12c]
push eax
call fcn.00481ca0
add esp, 8
mov ecx, eax
call fcn.00483d70
lea ecx, [ebp - 0x40]
call fcn.00405650
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4a4e14
push 0x483110
lea ecx, [ebp - 0x40]
push ecx
push str.IconFile
lea edx, [ebp - 0x12c]
push edx
call fcn.00481ca0
add esp, 8
push eax
call fcn.00481c70
add esp, 8
mov ecx, eax
call fcn.00483d70
lea ecx, [ebp - 0x12c]
call fcn.004a9280
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
call fcn.00405590
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x12c]
call fcn.004a4980
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00405590
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c626c
mov esp, ebp
pop ebp
ret
Function at 0x4ab5a0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x502420
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x53e200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x238], ecx
mov dword [ebp - 0x234], 0
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp - 0x238]
call fcn.004aa800
mov dword [ebp - 4], 0
push 0x208
push 0
lea ecx, [ebp - 0x218]
push ecx
call fcn.004c8420
add esp, 0xc
lea ecx, [ebp - 0x230]
call fcn.004064a0
push eax
push 0x104
lea edx, [ebp - 0x218]
push edx
push 0x50c430
push 0x50c434
push 0x50c448
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp + 8]
call fcn.00406420
mov ecx, dword [ebp - 0x234]
or ecx, 1
mov dword [ebp - 0x234], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.00406380
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c626c
mov esp, ebp
pop ebp
ret 4
Function at 0x4ad910
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x53e200]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], ecx
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x2c]
call fcn.004aa800
mov dword [ebp - 0x24], 1
lea ecx, [ebp - 0x1c]
call fcn.004064a0
push eax
push 1
push str.is_loaded
push 0x50c468
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x4ad963
mov dword [ebp - 0x28], 1
jmp 0x4ad96a
mov dword [ebp - 0x28], 0
mov cl, byte [ebp - 0x28]
mov byte [ebp - 0x1d], cl
lea ecx, [ebp - 0x1c]
call fcn.00406380
movzx eax, byte [ebp - 0x1d]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c626c
mov esp, ebp
pop ebp
ret

Function at 0x4ae1d0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0x3bc
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp + 0x1c]
mov dword [edx + 8], 0
mov eax, dword [ebp + 0x1c]
mov dword [eax + 0xc], 7
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
mov dword [ecx + 0x10], eax
movzx ecx, word [ebp + 0xc]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov edx, dword [ebp + 0x1c]
mov dword [edx + 0x14], eax
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x1c]
add ecx, 0x18
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [ebp + 0x1c]
push edx
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
test eax, eax
je 0x4ae255
mov byte [ebp - 1], 1
jmp 0x4ae259
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x4ae270
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov ecx, dword [ebp + 0x20]
mov dword [ecx], eax
mov edx, dword [ebp + 0x24]
mov dword [edx], 0x3bc
mov eax, dword [ebp + 0x24]
mov ecx, dword [ebp + 8]
mov dword [eax + 4], ecx
mov edx, dword [ebp + 0x24]
mov dword [edx + 8], 1
mov eax, dword [ebp + 0x24]
mov dword [eax + 0xc], 0x13
mov ecx, dword [ebp + 0x24]
mov dword [ecx + 0x3a4], 1
mov edx, dword [ebp + 0x24]
mov eax, dword [ebp + 0x20]
mov ecx, dword [eax]
mov dword [edx + 0x10], ecx
mov edx, dword [ebp + 0x24]
mov dword [edx + 0x320], 0xbb8
mov eax, dword [ebp + 0x24]
mov dword [eax + 0x320], 4
movzx ecx, word [ebp + 0xc]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov edx, dword [ebp + 0x24]
mov dword [edx + 0x14], eax
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x24]
add ecx, 0x18
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x24]
add eax, 0x120
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x24]
add edx, 0x324
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp + 0x24]
push eax
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
test eax, eax
je 0x4ae343
mov byte [ebp - 1], 1
jmp 0x4ae347
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x4c7267
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4c72a6
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4c72a6
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4c72a6
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4c72a6
cmp dword [ecx + 0x74], 0xe
jbe 0x4c72a6
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4e8653
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x517204
push 0x5171fc
push str.FlsAlloc
push 0x1f
call fcn.004e847e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4e8687
push dword [ebp + 8]
mov ecx, esi
call dword [0x505724]
call esi
jmp 0x4e868d
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4e86d1
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x517214
push 0x51720c
push str.FlsGetValue
push 0x21
call fcn.004e847e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4e8708
push dword [ebp + 8]
mov ecx, esi
call dword [0x505724]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4e8710
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x51721c
push 0x517214
push str.FlsSetValue
push 0x22
call fcn.004e847e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4e874a
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x505724]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x4eda5f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.004c6710
mov eax, dword [0x53e200]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.004e8d8b
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4edaa1
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x4edbfd
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.004c62b0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x546248]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.004ee804
mov ecx, dword [esi*4 + 0x546248]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x4edbf6
cmp eax, dword [ecx + edi + 0x24]
jne 0x4edbf6
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4edbf6
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004ee804
add esp, 0x14
test edx, edx
jl 0x4edbf6
jg 0x4edb6c
test eax, eax
jb 0x4edbf6
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x4edbf6
jl 0x4edb86
cmp dword [ebp - 0x1008], eax
ja 0x4edbf6
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x4edba4
test ebx, ebx
je 0x4edbdd
cmp ecx, edi
jae 0x4edbdd
mov al, byte [ecx]
cmp al, 0xd
jne 0x4edbbe
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4edbca
cmp byte [ecx + 1], 0xa
jne 0x4edbca
inc ecx
jmp 0x4edbca
movzx eax, al
movsx eax, byte [eax + 0x53e6a0]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4edba4
cmp edx, ebx
jne 0x4edba4
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x4edbfb
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004c626c
leave
ret