joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c0cc
Capabilities:
Enumerate files on windows
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
push 0x140
call fcn.004847cc
pop ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x13c], edx
push 0x258
call fcn.004847cc
mov ebx, eax
mov eax, dword [ebp - 4]
pop ecx
mov dword [eax + 0x13c], ebx
cmp dword [ebp + 0xc], 8
jne 0x43c192
mov edx, dword [0x593448]
mov dword [ebp - 0xc], edx
push 3
mov ecx, dword [ebp + 8]
push ecx
lea eax, [ebp - 0xc]
push eax
call fcn.004bd890
add esp, 0xc
mov dword [ebx], 0xffffffff
cmp byte [ebp - 0xa], 0
jne 0x43c139
mov byte [ebp - 0xa], 0x5c
push 0
lea edx, [ebp - 8]
push 0
push edx
push 0
push 0
lea ecx, [ebx + 0x14c]
push 0x104
push ecx
lea eax, [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetVolumeInformationA
test eax, eax
je 0x43c18b
lea edx, [ebp - 0xc]
push edx
lea ecx, [ebx + 0x250]
push ecx
call fcn.0043bae0
add esp, 8
mov esi, 1
mov eax, dword [ebp + 0xc]
push eax
call fcn.0043bc54
pop ecx
mov dword [ebx + 0x144], eax
jmp 0x43c27f
xor esi, esi
jmp 0x43c27f
mov eax, dword [ebp + 8]
push eax
call fcn.004e09d0
pop ecx
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
add edx, 4
push edx
call fcn.004847cc
pop ecx
mov edi, eax
mov dword [ebx], 0xffffffff
xor esi, esi
test edi, edi
je 0x43c27f
push 0
mov eax, dword [ebp + 8]
push eax
push edi
call fcn.004bcaf8
add esp, 0xc
mov edx, dword [ebp - 0x10]
cmp byte [edi + edx - 1], 0x5c
jne 0x43c1e7
push 0
push 0x59344c
push edi
call fcn.004bcab4
add esp, 0xc
lea ecx, [ebx + 4]
push ecx
push edi
call sub.KERNEL32.DLL_FindFirstFileA
mov dword [ebx], eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.0043bc54
pop ecx
mov dword [ebx + 0x144], eax
cmp dword [ebx], 0xffffffff
je 0x43c278
mov eax, dword [ebx + 0x144]
test eax, eax
je 0x43c223
cmp dword [ebx + 4], 0
je 0x43c223
test byte [ebx + 4], 0x80
jne 0x43c223
and eax, dword [ebx + 4]
je 0x43c22a
mov esi, 1
jmp 0x43c278
mov eax, dword [ebx + 4]
test al, 0x10
jne 0x43c23b
mov edx, dword [ebx + 0x144]
and edx, eax
je 0x43c242
mov esi, 1
jmp 0x43c278
xor esi, esi
jmp 0x43c268
mov eax, dword [ebx + 0x144]
test eax, eax
je 0x43c261
cmp dword [ebx + 4], 0
je 0x43c261
test byte [ebx + 4], 0x80
jne 0x43c261
and eax, dword [ebx + 4]
je 0x43c268
mov esi, 1
jmp 0x43c278
lea eax, [ebx + 4]
push eax
mov edx, dword [ebx]
push edx
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x43c246
push edi
call fcn.00484894
pop ecx
push 0
push esi
call fcn.00438748
add esp, 8
test esi, esi
je 0x43c29a
mov ecx, dword [ebp - 4]
push ecx
call fcn.0043bedc
pop ecx
jmp 0x43c2a9
mov eax, dword [ebp - 4]
push eax
call fcn.0043c324
pop ecx
xor edx, edx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44a014
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff60
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0xa0], 0x94
lea eax, [ebp - 0xa0]
push eax
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [ebp - 0x90], 2
jne 0x44a07b
cmp dword [ebp - 0x9c], 5
jb 0x44a07b
push str.winspool.drv
call sub.KERNEL32.DLL_LoadLibraryA
mov edi, eax
test edi, edi
je 0x44a07b
push str.GetDefaultPrinterA
push edi
call sub.KERNEL32.DLL_GetProcAddress
test eax, eax
je 0x44a075
push esi
mov edx, dword [ebp + 8]
push edx
call eax
mov ebx, eax
push edi
call sub.KERNEL32.DLL_FreeLibrary
test ebx, ebx
jne 0x44a0cc
mov eax, dword [esi]
push eax
mov edx, dword [ebp + 8]
push edx
push 0x593bbc
push 0x593c12
push 0x593c0a
call sub.KERNEL32.DLL_GetProfileStringA
mov edx, eax
test edx, edx
je 0x44a0c9
cmp edx, dword [esi]
jae 0x44a0c9
xor edx, edx
mov eax, dword [ebp + 8]
jmp 0x44a0ad
inc edx
inc eax
mov cl, byte [eax]
test cl, cl
je 0x44a0b8
cmp cl, 0x2c
jne 0x44a0ab
mov eax, dword [ebp + 8]
mov ebx, 1
mov byte [eax + edx], 0
inc edx
mov dword [esi], edx
jmp 0x44a0cc
inc edx
mov dword [esi], edx
test ebx, ebx
jne 0x44a16c
cmp dword [ebp - 0x90], 1
jne 0x44a16c
lea eax, [ebp - 8]
lea ecx, [ebp - 4]
push eax
push ecx
push 0
push 0
push 2
push 0
push 1
call sub.WINSPOOL.DRV_EnumPrintersA
test eax, eax
je 0x44a16c
cmp dword [ebp - 4], 0
jbe 0x44a16c
mov eax, dword [ebp - 4]
push eax
call fcn.004847cc
pop ecx
mov edi, eax
test edi, edi
je 0x44a16c
lea eax, [ebp - 8]
lea edx, [ebp - 4]
push eax
push edx
mov ecx, dword [ebp - 4]
push ecx
push edi
push 2
push 0
push 1
call sub.WINSPOOL.DRV_EnumPrintersA
test eax, eax
je 0x44a165
cmp dword [ebp - 8], 0
jbe 0x44a165
mov eax, dword [edi + 4]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x44a165
mov edx, dword [esi]
cmp edx, dword [ebp - 0xc]
jbe 0x44a165
mov ecx, dword [edi + 4]
push ecx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_lstrcpyA
mov edx, dword [ebp - 0xc]
mov ebx, 1
inc edx
mov dword [esi], edx
push edi
call fcn.00484894
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44a71c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x44a725
mov eax, dword [ebp - 4]
add esp, 0xffffffec
push ebx
push esi
push 0
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp + 8]
push edx
call sub.WINSPOOL.DRV_OpenPrinterA
test eax, eax
je 0x44a83f
mov ecx, dword [ebp + 0x10]
xor eax, eax
mov dword [ebp - 0x8018], ecx
mov dword [ebp - 0x8014], eax
mov dword [ebp - 0x8010], 0x593c2e
lea edx, [ebp - 0x8018]
push edx
push 1
mov ecx, dword [ebp - 4]
push ecx
call sub.WINSPOOL.DRV_StartDocPrinterA
test eax, eax
je 0x44a82f
mov eax, dword [ebp - 4]
push eax
call sub.WINSPOOL.DRV_StartPagePrinter
test eax, eax
je 0x44a81f
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
mov edx, dword [ebp + 0xc]
push edx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x44a80f
jmp 0x44a7e0
mov eax, dword [ebp - 8]
cmp byte [ebp + eax - 0x800d], 0x1a
jne 0x44a7c8
dec dword [ebp - 8]
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x800c]
push edx
mov ecx, dword [ebp - 8]
push ecx
push eax
mov edx, dword [ebp - 4]
push edx
call sub.WINSPOOL.DRV_WritePrinter
lea ecx, [ebp - 8]
push 0
push ecx
lea eax, [ebp - 0x800c]
push 0x8000
push eax
push esi
call sub.KERNEL32.DLL_ReadFile
test eax, eax
je 0x44a802
cmp dword [ebp - 8], 0
ja 0x44a7b8
mov ebx, 1
push esi
call sub.KERNEL32.DLL_CloseHandle
jmp 0x44a814
mov ebx, 0xfffffffa
mov eax, dword [ebp - 4]
push eax
call sub.WINSPOOL.DRV_EndPagePrinter
jmp 0x44a824
mov ebx, 0xfffffffc
mov eax, dword [ebp - 4]
push eax
call sub.WINSPOOL.DRV_EndDocPrinter
jmp 0x44a834
mov ebx, 0xfffffffd
mov eax, dword [ebp - 4]
push eax
call sub.WINSPOOL.DRV_ClosePrinter
jmp 0x44a844
mov ebx, 0xfffffffe
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x480a90
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffdc
cmp dword [0x5c8890], 0
jne 0x480b03
push esp
call sub.KERNEL32.DLL_GetSystemInfo
mov ebx, dword [esp + 4]
mov esi, dword [esp + 0x1c]
mov eax, esi
dec eax
test eax, esi
jne 0x480aba
mov edx, ebx
dec edx
test edx, ebx
je 0x480abf
call fcn.004e83dc
mov dword [0x5c8898], esi
mov dword [0x5c8894], ebx
mov dword [0x5c889c], 0x40000
mov eax, 5
mov dword [0x5c88a0], 0x200000
mov dword [0x5c88a4], eax
mov dword [0x5c8a64], eax
call sub.KERNEL32.DLL_GetTickCount
xor eax, 0x55555555
or eax, 8
and eax, 0xfffffff8
mov dword [0x5c8890], eax
mov eax, 1
add esp, 0x24
pop esi
pop ebx
ret

Function at 0x4849ac
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff40
movzx eax, word [ebp + 8]
cmp eax, 0x68
jg 0x484a0d
je 0x484afc
cmp eax, 4
jg 0x4849f1
je 0x484aba
sub eax, 1
jb 0x484a5f
je 0x484a73
dec eax
je 0x484a92
dec eax
je 0x484aa6
jmp 0x484b66
sub eax, 0x65
je 0x484ac1
dec eax
je 0x484adb
dec eax
je 0x484ae5
jmp 0x484b66
cmp eax, 0x3ec
jg 0x484a41
je 0x484b24
sub eax, 0x69
je 0x484b00
sub eax, 0x380
je 0x484b04
dec eax
je 0x484b0c
dec eax
je 0x484b10
jmp 0x484b66
sub eax, 0x3ed
je 0x484b3e
dec eax
je 0x484b62
dec eax
je 0x484b08
jmp 0x484b66
lea edx, [ebp - 0x20]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0x14]
shr eax, 0xa
jmp 0x484b68
lea edx, [ebp - 0x40]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
cmp dword [ebp - 0x34], 0xffffffff
jae 0x484a87
mov eax, dword [ebp - 0x34]
jmp 0x484a8a
or eax, 0xffffffff
shr eax, 0xa
jmp 0x484b68
lea edx, [ebp - 0x60]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0x54]
shr eax, 0xa
jmp 0x484b68
lea edx, [ebp - 0x80]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0x64]
shr eax, 0xa
jmp 0x484b68
xor eax, eax
jmp 0x484b68
lea edx, [ebp - 0xa0]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0x98]
shr eax, 0xa
jmp 0x484b68
mov eax, 1
jmp 0x484b68
lea edx, [ebp - 0xc0]
push edx
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0xac]
shr eax, 0xa
jmp 0x484b68
xor eax, eax
jmp 0x484b68
xor eax, eax
jmp 0x484b68
xor eax, eax
jmp 0x484b68
xor eax, eax
jmp 0x484b68
xor eax, eax
jmp 0x484b68
cmp dword [0x5a8e5c], 0
je 0x484b20
mov eax, dword [0x5c6f78]
jmp 0x484b68
xor eax, eax
jmp 0x484b68
cmp dword [0x5a8e5c], 0
je 0x484b3a
mov eax, dword [0x5c6f78]
shl eax, 3
lea eax, [eax + eax*2]
jmp 0x484b68
xor eax, eax
jmp 0x484b68
cmp dword [0x5a8e5c], 0
je 0x484b5e
mov eax, dword [0x5c6f70]
sub eax, dword [0x5c6f6c]
test eax, eax
jns 0x484b59
add eax, 3
sar eax, 2
jmp 0x484b68
xor eax, eax
jmp 0x484b68
xor eax, eax
jmp 0x484b68
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x48bd04
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff54
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
push 0
call fcn.0048b6b4
add esp, 8
mov esi, eax
push 0
push esi
call fcn.00436f1c
add esp, 8
mov ebx, eax
push esi
call fcn.00484894
pop ecx
cmp ebx, 0xffffffff
jne 0x48be41
push str.I18N
push edi
push 0
call sub.KERNEL32.DLL_FindResourceA
test eax, eax
jne 0x48bd55
xor eax, eax
jmp 0x48bf1c
push eax
push 0
call sub.KERNEL32.DLL_LoadResource
test eax, eax
jne 0x48bd68
xor eax, eax
jmp 0x48bf1c
push eax
call sub.KERNEL32.DLL_LockResource
mov ebx, eax
push 0xac
push ebx
lea eax, [ebp - 0xac]
push eax
call fcn.004bc1ec
add esp, 0xc
lea eax, [ebp - 0xac]
mov edx, 0x5aaac2
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x48bdac
test cl, cl
je 0x48bdde
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x48bdac
add eax, 2
add edx, 2
test cl, cl
jne 0x48bd90
je 0x48bdde
lea eax, [ebp - 0xac]
mov edx, 0x5aaac7
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x48bdd5
test cl, cl
je 0x48bdde
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x48bdd5
add eax, 2
add edx, 2
test cl, cl
jne 0x48bdb9
je 0x48bdde
xor eax, eax
jmp 0x48bf1c
mov edx, dword [ebp - 4]
push edx
add ebx, 0xac
push ebx
call fcn.0048bab8
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x48be3a
push 0xf
push edi
push 0x5c8b98
call fcn.004bd890
add esp, 0xc
lea eax, [ebp - 0x75]
push 0x32
push eax
push 0x5c8ba8
call fcn.004bd890
add esp, 0xc
mov eax, dword [0x5aaa88]
test eax, eax
je 0x48be2a
push eax
call fcn.00465428
pop ecx
mov dword [0x5aaa88], ebx
mov eax, 1
jmp 0x48bf1c
xor eax, eax
jmp 0x48bf1c
push 0xac
lea edx, [ebp - 0xac]
push edx
push ebx
call fcn.00437430
add esp, 0xc
cmp ax, 0xac
je 0x48be6a
push ebx
call fcn.004370c4
pop ecx
xor eax, eax
jmp 0x48bf1c
lea eax, [ebp - 0xac]
mov edx, 0x5aaac2
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x48be91
test cl, cl
je 0x48bec7
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x48be91
add eax, 2
add edx, 2
test cl, cl
jne 0x48be75
je 0x48bec7
lea eax, [ebp - 0xac]
mov edx, 0x5aaac7
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x48beba
test cl, cl
je 0x48bec7
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x48beba
add eax, 2
add edx, 2
test cl, cl
jne 0x48be9e
je 0x48bec7
push ebx
call fcn.004370c4
pop ecx
xor eax, eax
jmp 0x48bf1c
mov edx, dword [ebp - 4]
push edx
push ebx
call fcn.0048b938
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x48bf1a
push 0xf
push edi
push 0x5c8b98
call fcn.004bd890
add esp, 0xc
lea ecx, [ebp - 0x75]
push 0x32
push ecx
push 0x5c8ba8
call fcn.004bd890
add esp, 0xc
mov eax, dword [0x5aaa88]
test eax, eax
je 0x48bf0d
push eax
call fcn.00465428
pop ecx
mov dword [0x5aaa88], ebx
mov eax, 1
jmp 0x48bf1c
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bbff8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
test ebx, ebx
jne 0x4bc00d
xor eax, eax
jmp 0x4bc03f
lea edx, [ebp - 4]
push edx
push ebx
call fcn.004383cc
add esp, 8
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
setne cl
and ecx, 1
mov ebx, ecx
cmp dword [ebp - 4], 0
je 0x4bc03d
mov eax, dword [ebp - 4]
push eax
call fcn.00484894
pop ecx
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret

Function at 0x4bc044
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 4], edx
test eax, eax
jne 0x4bc059
xor eax, eax
jmp 0x4bc090
lea ecx, [ebp - 4]
push ecx
push eax
call fcn.004383cc
add esp, 8
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4bc075
test al, 0x50
je 0x4bc079
xor ebx, ebx
jmp 0x4bc07e
mov ebx, 1
cmp dword [ebp - 4], 0
je 0x4bc08e
mov eax, dword [ebp - 4]
push eax
call fcn.00484894
pop ecx
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret

Function at 0x4bc094
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 4], edx
test eax, eax
jne 0x4bc0a9
xor eax, eax
jmp 0x4bc0e0
lea ecx, [ebp - 4]
push ecx
push eax
call fcn.004383cc
add esp, 8
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4bc0c5
test al, 0x10
jne 0x4bc0c9
xor ebx, ebx
jmp 0x4bc0ce
mov ebx, 1
cmp dword [ebp - 4], 0
je 0x4bc0de
mov eax, dword [ebp - 4]
push eax
call fcn.00484894
pop ecx
mov eax, ebx
pop ebx
pop ecx
pop ebp
ret

Function at 0x4bc128
Capabilities:
Delete registry value
Query or enumerate registry value
Set environment variable
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push ebx
push edi
call sub.KERNEL32.DLL_SetEnvironmentVariableA
mov esi, eax
test esi, esi
je 0x4bc1e3
cmp dword [ebp + 0x10], 0
je 0x4bc1e3
xor esi, esi
test ebx, ebx
je 0x4bc15d
cmp byte [ebx], 0
jne 0x4bc15d
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
push str.SystemCurrentControlSetControlSession_ManagerEnvironment
push CreateStatusWindowA
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4bc1e3
push 0
push 0
push 0
push 0
push edi
mov edx, dword [ebp - 4]
push edx
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x4bc19a
cmp eax, 2
jne 0x4bc1da
test ebx, ebx
je 0x4bc1da
test ebx, ebx
je 0x4bc1b8
push ebx
call fcn.004e09d0
pop ecx
inc eax
push eax
push ebx
push 1
push 0
push edi
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.DLL_RegSetValueExA
jmp 0x4bc1c2
push edi
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegDeleteValueA
push 0x5afe39
push 0
push 0x1a
push 0xffff
call sub.USER32.DLL_SendMessageA
mov esi, 1
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4bfc78
Capabilities:
Check os version

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffe34
push 0x100
call fcn.004847cc
pop ecx
mov esi, eax
mov dword [esp], 0x94
push esp
call sub.KERNEL32.DLL_GetVersionExA
test eax, eax
je 0x4bfefa
push str.ntdll.dll
call sub.KERNEL32.DLL_GetModuleHandleA
mov edi, 0x5b05e3
mov ebx, 0x5b05e3
test eax, eax
je 0x4bfccf
push str.wine_get_version
push eax
call sub.KERNEL32.DLL_GetProcAddress
test eax, eax
je 0x4bfccf
mov edi, str.__Wine_
mov eax, dword [esp + 0x10]
sub eax, 1
jb 0x4bfe56
je 0x4bfced
dec eax
je 0x4bfd27
dec eax
je 0x4bfe5d
jmp 0x4bfe62
cmp dword [esp + 4], 4
jne 0x4bfd05
cmp dword [esp + 8], 0xa
jae 0x4bfd05
mov ebx, 0x5b062e
jmp 0x4bfe62
cmp dword [esp + 4], 4
jne 0x4bfd1d
cmp dword [esp + 8], 0xa
jne 0x4bfd1d
mov ebx, 0x5b0632
jmp 0x4bfe62
mov ebx, 0x5b0636
jmp 0x4bfe62
cmp dword [esp + 4], 6
jne 0x4bfdd1
mov dword [esp + 0x94], 0x9c
lea eax, [esp + 0x94]
push eax
call sub.KERNEL32.DLL_GetVersionExA
test eax, eax
je 0x4bfdc7
cmp dword [esp + 8], 2
jne 0x4bfd73
cmp byte [esp + 0x12e], 1
jne 0x4bfd69
mov ebx, 0x5b063a
jmp 0x4bfe62
mov ebx, str._Server_2012
jmp 0x4bfe62
cmp dword [esp + 8], 1
jne 0x4bfd98
cmp byte [esp + 0x12e], 1
jne 0x4bfd8e
mov ebx, 0x5b064a
jmp 0x4bfe62
mov ebx, str._Server_2008_R2
jmp 0x4bfe62
cmp dword [esp + 8], 0
jne 0x4bfdbd
cmp byte [esp + 0x12e], 1
jne 0x4bfdb3
mov ebx, str._Vista
jmp 0x4bfe62
mov ebx, str._Server_2008
jmp 0x4bfe62
mov ebx, 0x5b05e3
jmp 0x4bfe62
mov ebx, 0x5b05e3
jmp 0x4bfe62
cmp dword [esp + 4], 5
jne 0x4bfe2c
cmp dword [esp + 8], 2
jb 0x4bfe2c
mov dword [esp + 0x130], 0x9c
lea eax, [esp + 0x130]
push eax
call sub.KERNEL32.DLL_GetVersionExA
test eax, eax
je 0x4bfe25
cmp byte [esp + 0x1ca], 1
jne 0x4bfe0c
mov ebx, str._XP_x64
jmp 0x4bfe62
push 0x59
call sub.USER32.DLL_GetSystemMetrics
test eax, eax
je 0x4bfe1e
mov ebx, str._Server_2003_R2
jmp 0x4bfe62
mov ebx, str._Server_2003
jmp 0x4bfe62
mov ebx, 0x5b05e3
jmp 0x4bfe62
mov eax, dword [esp + 4]
cmp eax, 5
jne 0x4bfe43
cmp dword [esp + 8], 1
jne 0x4bfe43
mov ebx, 0x5b0696
jmp 0x4bfe62
cmp eax, 5
jne 0x4bfe4f
mov ebx, str._2000
jmp 0x4bfe62
mov ebx, 0x5b06a0
jmp 0x4bfe62
mov ebx, str._32s
jmp 0x4bfe62
mov ebx, 0x5b06a9
mov ax, word [esp + 0xc]
and ax, 0xffff
movzx edx, ax
push edx
mov ecx, dword [esp + 0xc]
push ecx
mov eax, dword [esp + 0xc]
push eax
push edi
push ebx
push str.Windows_s_s__lu._lu._04u
push 0x100
push esi
call fcn.004bf9a4
add esp, 0x20
lea edx, [esp + 0x14]
test edx, edx
je 0x4bff0d
lea ecx, [esp + 0x14]
push ecx
call fcn.004bc868
pop ecx
mov edi, eax
xor ebx, ebx
mov eax, edi
jmp 0x4bfeab
inc ebx
inc eax
cmp byte [eax], 0
je 0x4bfec7
movsx edx, byte [eax]
cmp edx, 0x20
je 0x4bfea9
cmp edx, 9
je 0x4bfea9
cmp edx, 0xa
je 0x4bfea9
cmp edx, 0xd
je 0x4bfea9
cmp byte [edi + ebx], 0
je 0x4bfef1
push 0xff
push 0x5b06c6
push esi
call fcn.004bd8bc
add esp, 0xc
add ebx, edi
push 0xff
push ebx
push esi
call fcn.004bd8bc
add esp, 0xc
push edi
call fcn.00484894
pop ecx
jmp 0x4bff0d
push str.Windows
push 0x100
push esi
call fcn.004bf9a4
add esp, 0xc
mov eax, esi
add esp, 0x1cc
pop edi
pop esi
pop ebx
ret
Function at 0x4dc4fc
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
push esi
call fcn.004e09d0
pop ecx
inc eax
push eax
call fcn.004847cc
pop ecx
mov dword [ebp - 4], eax
push 0x100
push 0xff
lea eax, [ebp - 0x10c]
push eax
call fcn.004e0898
add esp, 0xc
mov al, 0x41
mov byte [ebp - 0xcb], 0
xor edx, edx
mov dl, al
inc eax
mov cl, byte [ebp + edx - 0x10c]
inc ecx
cmp al, 0x5a
mov byte [ebp + edx - 0x10b], cl
jl 0x4dc53f
mov byte [ebp - 0xab], 0x1a
mov al, 0x61
xor edx, edx
mov dl, al
inc eax
mov cl, byte [ebp + edx - 0x10c]
inc ecx
cmp al, 0x7a
mov byte [ebp + edx - 0x10b], cl
jle 0x4dc560
mov byte [ebp - 0xdc], 0x34
mov al, 0x30
xor edx, edx
mov dl, al
inc eax
mov cl, byte [ebp + edx - 0x10c]
inc ecx
cmp al, 0x39
mov byte [ebp + edx - 0x10b], cl
jle 0x4dc581
mov byte [ebp - 0xe1], 0x3e
mov byte [ebp - 0xdd], 0x3f
xor eax, eax
mov dword [ebp - 8], eax
mov dl, byte [esi]
mov ecx, dword [ebp - 4]
mov eax, ecx
jmp 0x4dc5cf
and edx, 0xff
mov cl, byte [ebp + edx - 0x10c]
mov byte [eax], cl
test cl, cl
jl 0x4dc5cc
inc dword [ebp - 8]
inc eax
inc esi
mov dl, byte [esi]
test dl, dl
je 0x4dc5d8
cmp dl, 0x3d
jne 0x4dc5b5
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov byte [eax + ecx], 0
mov edi, dword [ebp - 8]
shr edi, 2
lea eax, [edi + edi*2]
add eax, 3
push eax
call fcn.004847cc
pop ecx
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
xor esi, esi
cmp edi, esi
jbe 0x4dc63b
mov cl, byte [eax]
shl ecx, 2
movsx ebx, byte [eax + 1]
sar ebx, 4
or cl, bl
mov byte [edx], cl
inc edx
mov cl, byte [eax + 1]
shl ecx, 4
movsx ebx, byte [eax + 2]
sar ebx, 2
or cl, bl
mov byte [edx], cl
inc edx
mov cl, byte [eax + 2]
shl ecx, 6
or cl, byte [eax + 3]
mov byte [edx], cl
inc edx
add eax, 4
inc esi
cmp edi, esi
ja 0x4dc604
lea ecx, [edi + edi*2]
mov ebx, dword [ebp + 0xc]
mov dword [ebx], ecx
mov ecx, dword [ebp - 8]
and ecx, 3
cmp ecx, 2
jne 0x4dc665
mov cl, byte [eax]
shl ecx, 2
movsx eax, byte [eax + 1]
sar eax, 4
or cl, al
mov byte [edx], cl
mov edx, dword [ebp + 0xc]
inc dword [edx]
jmp 0x4dc692
cmp ecx, 3
jne 0x4dc692
mov cl, byte [eax]
shl ecx, 2
movsx ebx, byte [eax + 1]
sar ebx, 4
or cl, bl
mov byte [edx], cl
inc edx
mov cl, byte [eax + 1]
shl ecx, 4
movsx eax, byte [eax + 2]
sar eax, 2
or cl, al
mov byte [edx], cl
mov edx, dword [ebp + 0xc]
add dword [edx], 2
mov eax, dword [ebp - 4]
push eax
call fcn.00484894
pop ecx
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4df404
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor eax, eax
mov dword [ebp - 4], eax
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocStringLen
mov edx, dword [ebp + 8]
push edx
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4df439
xor eax, eax
jmp 0x4df4b6
push 0
push ebx
call sub.KERNEL32.DLL_GetFileSize
mov esi, eax
cmp esi, 0xffffffff
je 0x4df456
push esi
push 0x42
call sub.KERNEL32.DLL_GlobalAlloc
mov dword [edi], eax
test eax, eax
jne 0x4df460
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x4df4b6
mov edx, dword [ebp + 0xc]
mov dword [edx], esi
mov ecx, dword [edi]
push ecx
call sub.KERNEL32.DLL_GlobalLock
test eax, eax
jne 0x4df483
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_GlobalFree
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x4df4b6
push 0
lea edx, [ebp - 4]
push edx
push esi
push eax
push ebx
call sub.KERNEL32.DLL_ReadFile
mov esi, eax
mov ecx, dword [edi]
push ecx
call sub.KERNEL32.DLL_GlobalUnlock
push ebx
call sub.KERNEL32.DLL_CloseHandle
test esi, esi
jne 0x4df4b1
mov eax, dword [edi]
push eax
call sub.KERNEL32.DLL_GlobalFree
xor eax, eax
jmp 0x4df4b6
mov eax, 1
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4e04bc
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x4e1a60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4e1a7c
call fcn.004e32d0
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x4e1a9b
test bl, 1
je 0x4e1a9b
call fcn.004e7e90
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret