joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46c802
Capabilities:
Delete file

Disassembly:
push 0x48
mov eax, 0x4b1fed
call fcn.004803aa
mov ebx, ecx
mov dword [ebp - 0x54], ebx
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x48], esi
cmp dword [esi + 0x14], edi
je 0x46c9aa
xorps xmm0, xmm0
mov dword [ebp - 0x3c], edi
xor eax, eax
mov dword [ebp - 0x40], vtable.Cmm::CStringT_wchar_t_.0
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], 7
mov word [ebp - 0x3c], ax
movlpd qword [ebp - 0x20], xmm0
movlpd qword [ebp - 0x18], xmm0
lea eax, [ebx + 4]
mov dword [ebp - 4], edi
push eax
lea ecx, [ebp - 0x3c]
call fcn.0040813b
lea eax, [esi + 4]
push eax
lea ecx, [ebp - 0x3c]
call fcn.0040811e
cmp dword [ebp - 0x28], 8
lea ecx, [ebp - 0x3c]
cmovae ecx, dword [ebp - 0x3c]
call fcn.0046b86e
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
call fcn.0046caf6
mov dword [ebp - 0x20], eax
or eax, edx
mov dword [ebp - 0x1c], edx
jne 0x46c95e
or dword [ebp - 0x20], 0xffffffff
or dword [ebp - 0x1c], 0xffffffff
mov esi, dword [ebx + 0x1c]
mov dword [ebp - 0x44], edi
mov edi, dword [ebx + 0x20]
cmp esi, edi
je 0x46c98e
mov ecx, dword [ebp - 0x44]
xor ebx, ebx
cmp dword [esi + 0x14], ebx
je 0x46c930
lea eax, [esi + 4]
cmp dword [eax + 0x14], 8
jb 0x46c8c0
mov eax, dword [eax]
mov ecx, dword [ebp - 0x48]
cmp dword [ecx + 0x18], 8
lea edx, [ecx + 4]
jb 0x46c8cf
mov edx, dword [ecx + 4]
push dword [esi + 0x14]
push eax
push edx
call fcn.0049403c
add esp, 0xc
test eax, eax
jne 0x46c92d
mov ecx, dword [esi + 0x30]
push 2
pop ebx
test ecx, ecx
je 0x46c92d
mov eax, dword [ebp - 0x48]
mov edx, dword [eax + 0x14]
cmp edx, ecx
jbe 0x46c92d
lea eax, [esi + 0x20]
sub edx, ecx
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x4c], eax
jb 0x46c907
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
add eax, 4
cmp dword [eax + 0x14], 8
jb 0x46c915
mov eax, dword [eax]
push ecx
push dword [ebp - 0x4c]
lea eax, [eax + edx*2]
push eax
call fcn.0049403c
add esp, 0xc
test eax, eax
push 3
pop ecx
cmove ebx, ecx
mov ecx, dword [ebp - 0x44]
cmp ebx, ecx
mov eax, esi
cmovbe eax, edi
add esi, 0x68
cmp ebx, ecx
mov edi, eax
cmovbe ebx, ecx
mov ecx, ebx
mov ebx, dword [ebp - 0x54]
mov dword [ebp - 0x44], ecx
cmp esi, dword [ebx + 0x20]
jne 0x46c8ae
cmp edi, dword [ebx + 0x20]
je 0x46c98e
lea eax, [ebp - 0x40]
push eax
push edi
jmp 0x46c996
mov eax, dword [ebp - 0x18]
or eax, dword [ebp - 0x14]
jne 0x46c89a
cmp dword [ebp - 0x28], 8
lea esi, [ebp - 0x3c]
jb 0x46c97a
mov esi, dword [ebp - 0x3c]
test esi, esi
je 0x46c99b
push esi
call sym.ZoomOutlookMAPI.exe_int___cdecl_cmm_safe_path_wchar_t_const__
pop ecx
test eax, eax
je 0x46c99b
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x46c99b
lea eax, [ebp - 0x40]
push eax
lea eax, [ebx + 0x28]
push eax
call fcn.0046c9b2
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x40], vtable.Cmm::CStringT_wchar_t_.0
call fcn.0040784f
call fcn.00480359
ret 4
Function at 0x46ca44
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x5c]
cmp eax, dword [edi + 0x44]
ja 0x46ca73
jb 0x46ca5d
mov eax, dword [edi + 0x58]
cmp eax, dword [edi + 0x40]
ja 0x46ca73
mov eax, dword [edi + 0x64]
cmp eax, dword [edi + 0x3c]
jb 0x46caf1
ja 0x46ca73
mov eax, dword [edi + 0x60]
cmp eax, dword [edi + 0x38]
jbe 0x46caf1
push esi
push dword [edi + 0x4c]
push dword [edi + 0x48]
call fcn.0046ce8f
mov esi, dword [edi + 0x48]
pop ecx
pop ecx
cmp esi, dword [edi + 0x4c]
je 0x46caf0
push ebx
mov edx, dword [edi + 0x5c]
mov ecx, dword [edi + 0x58]
cmp edx, dword [edi + 0x44]
ja 0x46caae
jb 0x46ca9c
cmp ecx, dword [edi + 0x40]
ja 0x46caae
mov eax, dword [edi + 0x64]
cmp eax, dword [edi + 0x3c]
jb 0x46caef
ja 0x46caae
mov eax, dword [edi + 0x60]
cmp eax, dword [edi + 0x38]
jbe 0x46caef
add ecx, 0xffffffff
lea ebx, [esi + 4]
mov dword [edi + 0x58], ecx
adc edx, 0xffffffff
mov dword [edi + 0x5c], edx
mov eax, dword [esi + 0x28]
sub dword [edi + 0x60], eax
mov eax, dword [esi + 0x2c]
sbb dword [edi + 0x64], eax
cmp dword [esi + 0x18], 8
jb 0x46cad1
mov ebx, dword [ebx]
test ebx, ebx
je 0x46cae7
push ebx
call sym.ZoomOutlookMAPI.exe_int___cdecl_cmm_safe_path_wchar_t_const__
pop ecx
test eax, eax
je 0x46cae7
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esi, 0x30
cmp esi, dword [edi + 0x4c]
jne 0x46ca8a
pop ebx
pop esi
pop edi
pop ebp
ret 4
Function at 0x46cb70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x308
mov eax, 0x4b2043
call fcn.004803aa
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
test esi, esi
je 0x46cccf
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x46cba7
test eax, 0x400
jne 0x46cccf
push ebx
push edi
push esi
lea ecx, [ebp - 0xbc]
call fcn.0046c674
and dword [ebp - 4], 0
lea eax, [ebp - 0x310]
push esi
push eax
call sym.ZoomOutlookMAPI.exe_cmm_fs_find_first
pop ecx
pop ecx
push 0x2e
mov byte [ebp - 4], 1
pop esi
mov cx, word [ebp - 0x2e0]
test cx, cx
je 0x46cc83
mov eax, dword [ebp - 0x30c]
and eax, 0x10
jne 0x46cc5a
mov ax, word [ebp - 0x2de]
cmp cx, si
jne 0x46cbfe
test ax, ax
je 0x46cc5a
cmp cx, si
mov dx, word [ebp - 0x2dc]
jne 0x46cc11
cmp ax, si
jne 0x46cc11
test dx, dx
je 0x46cc5a
cmp cx, si
jne 0x46cc25
test ax, ax
je 0x46cc5a
cmp ax, si
jne 0x46cc25
test dx, dx
je 0x46cc5a
lea eax, [ebp - 0x2e0]
push eax
lea ecx, [ebp - 0x2c]
call sym.ZoomOutlookMAPI.exe_public:_void___thiscall_Cmm::CStringT_wchar_t_::constructor_wchar_t_const__
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0xbc]
call fcn.0046c802
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x2c], vtable.Cmm::CStringT_wchar_t_.0
call fcn.0040784f
lea eax, [ebp - 0x30c]
push eax
push dword [ebp - 0x310]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x46cbcf
xor ecx, ecx
mov word [ebp - 0x2e0], cx
jmp 0x46cbd6
lea eax, [ebp - 0x94]
push eax
call fcn.0046ca44
mov esi, dword [ebp - 0xa0]
jmp 0x46cca0
push esi
call fcn.0046ca44
add esi, 0x68
cmp esi, dword [ebp - 0x9c]
jne 0x46cc97
push dword [ebp - 0x310]
call dword [sym.imp.KERNEL32.dll_FindClose]
or dword [ebp - 0x310], 0xffffffff
lea ecx, [ebp - 0xbc]
xor eax, eax
mov word [ebp - 0x2e0], ax
call fcn.0046c7b2
call fcn.00480359
ret
Function at 0x470320
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2ef4
call fcn.00480b30
mov eax, dword [0x58005c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x1f40
lea eax, [ebp - 0x2ee8]
push 0
push eax
call fcn.004821f0
add esp, 0xc
mov dword [ebp - 0x2eec], 0
lea eax, [ebp - 0x2eec]
push eax
push 0x1f40
lea eax, [ebp - 0x2ee8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x47044c
lea eax, [ebp - 0xfa8]
xor esi, esi
test dword [ebp - 0x2eec], 0xfffffffc
mov dword [ebp - 0x2ef0], eax
mov eax, 0xfa0
mov word [ebp - 0x2ef2], ax
jbe 0x470438
nop word [eax + eax]
push 0xfa0
lea eax, [ebp - 0xfa8]
push 0
push eax
call fcn.004821f0
add esp, 0xc
lea eax, [ebp - 0xfa8]
push 0x7cf
push eax
push dword [ebp + esi*4 - 0x2ee8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0xfa8]
lea edx, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4703f0
sub eax, edx
mov ecx, 0x581098
sar eax, 1
add eax, eax
push 0
push dword [ebp + esi*4 - 0x2ee8]
mov word [ebp - 0x2ef4], ax
lea eax, [ebp - 0x2ef4]
push eax
call fcn.00470460
test eax, eax
je 0x47044c
mov eax, dword [ebp - 0x2eec]
inc esi
shr eax, 2
cmp esi, eax
jb 0x4703b0
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047f860
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.0047f860
mov esp, ebp
pop ebp
ret
Function at 0x4773f5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x47744b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x47744b
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x47743d
cmp esi, ecx
jae 0x47744b
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x47742b
cmp esi, ecx
jae 0x47744b
cmp word [esi], 0
je 0x47744b
mov eax, esi
jmp 0x47744d
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x477d0f
Capabilities:
Accept command line arguments

Disassembly:
push 0x34
mov eax, 0x4b297d
call fcn.004803aa
xor ebx, ebx
push ebx
push 2
pop edx
call fcn.004755e0
pop ecx
test al, al
je 0x477e05
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor ecx, ecx
mov dword [ebp - 0x3c], ebx
mov word [ebp - 0x3c], cx
lea ecx, [ebp - 0x3c]
push eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], 7
call fcn.00407f4b
push ebx
push str.runaszvideo
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], ebx
call fcn.00407a74
cmp eax, 0xffffffff
je 0x477dfb
push str.mmdevapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 2
push ebx
mov dword [ebp - 0x40], ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x477dfb
lea eax, [ebp - 0x40]
mov dword [ebp - 0x24], 0xa95664d2
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], 0x4f359614
push eax
push 0x17
push ebx
push 0x4d79bc
mov dword [ebp - 0x1c], 0x8dde46a7
mov dword [ebp - 0x18], 0xe61736b6
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x477dfb
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x477dfb
mov eax, dword [eax]
test eax, eax
je 0x477dfb
push dword [eax + 0x18]
call fcn.0047cf4f
test al, al
je 0x477de8
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
push dword [eax + 0x1c]
call fcn.0047cf4f
test al, al
je 0x477de8
mov bl, 1
mov eax, dword [ebp - 0x40]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x4b4460]
call esi
lea ecx, [ebp - 0x3c]
call fcn.0040784f
mov al, bl
call fcn.00480359
ret
Function at 0x478f48
Capabilities:
Get system information on windows

Disassembly:
push 0x2c
mov eax, 0x4b2aa3
call fcn.00480377
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.004775c8
push eax
mov ecx, edi
call fcn.0047845e
xor ebx, ebx
lea esi, [edi + 0x18]
mov dword [ebp - 4], ebx
push 0x18
mov dword [ebp - 0x14], esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.0040b5d6
pop ecx
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov byte [ebp - 4], 1
call fcn.004775c8
push eax
lea ecx, [edi + 0x20]
call fcn.0047845e
mov byte [ebp - 4], 2
lea eax, [ebp - 0x38]
push eax
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 4], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x1c]
lea ecx, [edi + 0x20]
push str.uploadExeName
mov dword [edi + 8], eax
call fcn.0047836b
mov eax, edi
call fcn.00480345
ret

Function at 0x479063
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
mov eax, esi
xor edx, edx
push edi
div dword [ebx + 8]
mov eax, dword [ebp + 0xc]
mov edi, edx
add eax, edi
sub esi, edi
push eax
push esi
push 0
push 6
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
lea ecx, [ebx + 0x18]
lea eax, [ebp - 4]
add edi, esi
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 4], edi
push eax
call fcn.00479105
mov ecx, dword [eax]
mov eax, edi
pop edi
mov dword [ecx + 0x14], esi
pop esi
pop ebx
leave
ret 8

Function at 0x479230
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x479250
cmp dword [esi], 0
je 0x479249
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret
Function at 0x47aa39
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push 0x34
push 0x4f2590
call fcn.00480980
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x1c], esi
push 0x1c
lea eax, [ebp - 0x44]
push eax
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x47ab01
mov ebx, dword [ebp - 0x40]
mov dword [ebp - 0x20], ebx
push 0x40
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x47aaa5
mov eax, 0x5a4d
cmp word [ebx], ax
jne 0x47aaa5
mov ebx, dword [ebx + 0x3c]
add ebx, dword [ebp - 0x20]
push 0xf8
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x47ab01
xor ecx, ecx
cmp dword [ebx], 0x4550
cmove ecx, ebx
jmp 0x47aaa7
mov ecx, esi
test ecx, ecx
je 0x47ab01
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x1c], eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
mov ebx, dword [ebp - 0x1c]
sub edi, ebx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], edx
movzx eax, word [ecx + 6]
cmp esi, eax
jae 0x47ab04
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [edx + 0x10]
cmp eax, dword [edx + 8]
cmovbe eax, dword [edx + 8]
add eax, dword [ebp - 0x20]
cmp edi, dword [ebp - 0x20]
jb 0x47aafb
cmp edi, eax
ja 0x47aafb
lea ecx, [esi + 1]
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
sub edi, dword [ebp - 0x20]
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
jmp 0x47ab04
inc esi
add edx, 0x28
jmp 0x47aabf
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 4], 0xfffffffe
mov eax, ebx
jmp 0x47ab2a
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x47ab3c
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push 0x9dc
mov eax, 0x4b2e87
call fcn.004803aa
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ecx, esi
mov dword [ebp - 0x9e8], esi
push str.unkonwn
mov dword [ebp - 0x9e4], ebx
call fcn.004781ee
push 0x7d0
lea eax, [ebp - 0x9e0]
mov dword [ebp - 4], ebx
push ebx
push eax
mov dword [ebp - 0x9e4], 1
call fcn.004821f0
add esp, 0xc
lea eax, [ebp - 0x9e0]
push 0x3e7
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
test eax, eax
je 0x47abc5
lea ecx, [ebp - 0x9e0]
call fcn.0047884e
push eax
lea eax, [ebp - 0x9e0]
mov ecx, esi
push eax
call fcn.00478655
push str.Zoom.exe
push dword [esi]
call fcn.00489665
pop ecx
pop ecx
test eax, eax
je 0x47acd8
push str.ZoomRooms.exe
push dword [esi]
call fcn.00489665
pop ecx
pop ecx
test eax, eax
je 0x47acd8
push str.zrusplayer.exe
push dword [esi]
call fcn.00489665
pop ecx
pop ecx
test eax, eax
jne 0x47ac0d
mov edi, str.zrusplayer
jmp 0x47ad4e
push str.zJob.exe
push dword [esi]
call fcn.00489665
pop ecx
pop ecx
test eax, eax
jne 0x47ac29
mov edi, str.zJob
jmp 0x47ad4e
push str.DigitalSignage.exe
push dword [esi]
call fcn.00489665
pop ecx
pop ecx
test eax, eax
jne 0x47ac45
mov edi, str.DigitalSignage
jmp 0x47ad4e
push str.ZRWebClient.exe
push dword [esi]
call fcn.00489665
pop ecx
pop ecx
test eax, eax
jne 0x47ad5e
mov edi, str.ZRWebClient
mov ecx, edi
call fcn.0047884e
push eax
push edi
mov ecx, esi
call fcn.00478655
push 0x200
lea eax, [ebp - 0x210]
push ebx
push eax
call fcn.004821f0
add esp, 0xc
lea eax, [ebp - 0x210]
push 0xff
push eax
push str.zr_role_type
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x47ad5e
mov edi, 0x4d3658
mov ecx, edi
call fcn.0047884e
push eax
push edi
mov ecx, esi
call fcn.0047c3de
lea ecx, [ebp - 0x210]
call fcn.0047884e
push eax
lea eax, [ebp - 0x210]
mov ecx, esi
push eax
call fcn.0047c3de
jmp 0x47ad5e
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebx, eax
test ebx, ebx
je 0x47ad5e
push str.runaszvideoTRUE
push ebx
call fcn.00481092
pop ecx
pop ecx
test eax, eax
je 0x47acfc
mov edi, str.VideoConf
jmp 0x47ad4e
push str.actionZoomRoomsAssistant
push ebx
call fcn.00481092
pop ecx
pop ecx
test eax, eax
je 0x47ad14
mov edi, 0x4d84c0
jmp 0x47ad4e
mov edi, 0x5842a0
push dword [edi]
push ebx
call fcn.00481092
pop ecx
pop ecx
test eax, eax
jne 0x47ad34
add edi, 4
cmp edi, 0x5842a8
jne 0x47ad19
jmp 0x47ad49
mov edi, 0x4d8504
mov ecx, edi
call fcn.0047884e
push eax
push edi
mov ecx, esi
call fcn.00478655
mov edi, 0x4d84fc
mov ecx, edi
call fcn.0047884e
push eax
push edi
mov ecx, esi
call fcn.00478655
mov eax, esi
call fcn.00480359
ret 4
Function at 0x47ad68
Capabilities:
Get common file path
Read .ini file

Disassembly:
push 0x220
mov eax, 0x4b2f0f
call fcn.004803aa
mov edi, ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
test esi, esi
je 0x47ad8e
cmp esi, 1
jne 0x47af56
push ecx
lea ecx, [ebp + 0xc]
call fcn.0047c27c
cmp eax, 0xffffffff
je 0x47addc
lea ecx, [eax + 1]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax - 0xc]
sub eax, ecx
push eax
push ecx
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp + 0xc]
call fcn.0047c2fd
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp + 0xc]
call fcn.0047814e
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.004775a2
lea eax, [ebp - 0x220]
push eax
call fcn.0047ab3c
push 0x208
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 2
push ebx
push eax
call fcn.004821f0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x47af48
push dword [edi + 0x78]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.dataZoom.us.ini
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov eax, str.freeze
cmp esi, 1
mov ebx, str.crash
cmove ebx, eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0x4d864c
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
call fcn.004775c8
push eax
lea ecx, [ebp - 0x21c]
call fcn.0047845e
lea ecx, [esi + 1]
mov byte [ebp - 4], 3
push ecx
lea eax, [ebp - 0x21c]
push 0x4d799c
push eax
call fcn.00478c7a
mov edi, dword [ebp - 0x21c]
lea eax, [ebp - 0x218]
add esp, 0xc
push eax
push edi
push 0x4d864c
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
call fcn.004775c8
push eax
lea ecx, [ebp - 0x224]
call fcn.0047845e
push esi
push ebx
lea eax, [ebp - 0x224]
mov byte [ebp - 4], 4
push str._s_d
push eax
call fcn.00478c7a
push 0x4d86b0
lea edx, [ebp - 0x220]
lea ecx, [ebp - 0x22c]
call fcn.0047c186
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 5
push ecx
mov edx, eax
lea ecx, [ebp - 0x228]
call fcn.0047c1e0
add esp, 0x18
lea ecx, [ebp - 0x218]
mov byte [ebp - 4], 6
mov esi, dword [ebp - 0x224]
push ecx
push dword [eax]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov ecx, dword [ebp - 0x228]
lea ecx, [ecx - 0x10]
call fcn.004775a2
mov ecx, dword [ebp - 0x22c]
lea ecx, [ecx - 0x10]
call fcn.004775a2
lea ecx, [esi - 0x10]
call fcn.004775a2
lea ecx, [edi - 0x10]
call fcn.004775a2
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0x10]
call fcn.004775a2
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.004775a2
call fcn.00480359
ret 8
Function at 0x47b56a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x26c
mov eax, dword [0x58005c]
xor eax, esp
mov dword [esp + 0x268], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push str.Unspecified_error___launch_crash_sender.
mov esi, ecx
mov dword [esp + 0x10], eax
call fcn.00478084
pop ecx
push 0x44
pop edi
push edi
lea eax, [esp + 0x24]
push 0
push eax
call fcn.004821f0
mov dword [esp + 0x2c], edi
xor eax, eax
lea edi, [esp + 0x1c]
add esp, 0xc
stosd dword es:[edi], eax
push 0x208
stosd dword es:[edi], eax
push 0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [esp + 0x70]
push eax
call fcn.004821f0
add esp, 0xc
lea eax, [esp + 0x68]
mov edi, 0x104
push 0x4c9d80
push edi
push eax
call fcn.00492cf8
add esp, 0xc
lea ecx, [esi + 0x68]
push 0
call fcn.00478246
push eax
lea eax, [esp + 0x6c]
push edi
push eax
call fcn.00492cf8
add esp, 0xc
lea eax, [esp + 0x68]
push 0x4d8800
push edi
push eax
call fcn.00492cf8
add esp, 0xc
lea eax, [esp + 0x68]
push ebx
push edi
push eax
call fcn.00492cf8
add esp, 0xc
lea eax, [esp + 0x68]
push 0x4c9d80
push edi
push eax
call fcn.00492cf8
mov ecx, dword [esi + 0x68]
add esp, 0xc
xor ebx, ebx
xor edx, edx
push 1
push ebx
call fcn.00475ae0
pop ecx
pop ecx
test eax, eax
jne 0x47b659
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x47b6f6
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x24]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x88]
push eax
push dword [esi + 0x68]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp dword [esp + 0x14], ebx
je 0x47b698
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x14], ebx
test edi, edi
jne 0x47b6b5
push str.Error_creating_CrashSender_process.
call fcn.00478084
mov eax, dword [esp + 0x10]
pop ecx
test eax, eax
je 0x47b6b1
mov dword [eax], ebx
mov eax, esi
jmp 0x47b6f6
mov eax, dword [esp + 0x10]
test eax, eax
je 0x47b6df
cmp dword [ebp + 0xc], ebx
je 0x47b6d2
push 0x15f90
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x47b6e9
mov dword [ecx], eax
push str.Success.
call fcn.00478084
pop ecx
xor eax, eax
mov ecx, dword [esp + 0x274]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0047f860
mov esp, ebp
pop ebp
ret 0x10
Function at 0x47b92f
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
xor ecx, ecx
push ebx
mov ebx, dword [0x5913b4]
push esi
mov esi, edx
push edi
test esi, esi
je 0x47b9a4
mov eax, dword [esi]
test eax, eax
je 0x47b9a4
cmp dword [eax], 0x40010006
je 0x47ba15
cmp dword [eax], 0x406d1388
je 0x47ba15
cmp dword [eax], 0xc00000fd
jne 0x47b9a4
push ecx
push ecx
push esi
push 0x47ba20
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
je 0x47b995
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test ebx, ebx
je 0x47ba0b
lea edi, [ebx + 0x98]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
and dword [ebx + 0x130], 0
push 0x38
pop eax
push eax
lea eax, [esp + 0x14]
push 0
push eax
call fcn.004821f0
and dword [esp + 0x24], 0
mov ecx, ebx
push 0x38
pop eax
add esp, 8
mov word [esp + 0x14], ax
lea eax, [esp + 0x14]
mov dword [esp + 0x18], esi
push eax
call fcn.0047af69
cmp dword [ebx + 0x130], 0
jne 0x47ba04
push 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
jmp 0x47ba0e

Function at 0x47cc7c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov edx, dword [esi]
test edx, edx
jne 0x47cc9c
push 0x40
push 0x3000
push 0xd
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
mov dword [esi], edx
pop esi
test edx, edx
jne 0x47cca5
xor al, al
jmp 0x47ccd4
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], eax
mov eax, 0x47cfe0
sub eax, edx
mov dword [edx], 0x68ec8b55
push 0xd
sub eax, 0xd
mov byte [edx + 8], 0xe9
push edx
mov dword [edx + 9], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov al, 1
pop ebp
ret 8