joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4aba60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x527308
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebp
push esi
push edi
mov eax, dword [0x597f54]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], 0
mov edi, dword [esp + 0x2c]
mov eax, dword [edi]
push eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
call fcn.004aa8f0
mov edx, dword [edi]
push edx
lea eax, [esp + 0x30]
push eax
mov ecx, esi
mov dword [esp + 0x28], 0
call fcn.004aaa30
mov edx, dword [esi]
mov edx, dword [edx + 0x19c]
lea eax, [esp + 0x14]
push eax
mov ecx, esi
mov byte [esp + 0x24], 1
call edx
mov edi, dword [esp + 0x2c]
mov ecx, dword [esi + 0x68]
mov ebp, dword [esp + 0x10]
mov eax, dword [eax]
push edi
push ebp
push ecx
push eax
mov eax, dword [esp + 0x38]
push eax
mov ecx, esi
mov byte [esp + 0x34], 2
call fcn.004aaff0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x20], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4abb17
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
mov byte [esp + 0x20], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4abb38
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebp - 0x10]
mov dword [esp + 0x20], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4abb5c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x14
ret 8
Function at 0x4ac1e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ecx + 0x220]
pop ebp
jmp 0x4ac1e0
push 0xffffffffffffffff
push 0x5273c8
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x597f54]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [esp + 0x30]
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x30]
push edx
push eax
push ecx
mov ecx, esi
call fcn.004aa590
test al, al
jne 0x4ac24b
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 0x18
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x30]
push eax
mov ecx, esi
call fcn.004aba60
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x34]
xor ebx, ebx
push edx
mov ecx, esi
mov dword [esp + 0x1c], ebx
call fcn.004aba60
mov eax, dword [esp + 0x2c]
push 0x52db7c
push eax
call fcn.004e2f3f
add esp, 8
cmp eax, ebx
setne al
cmp al, bl
je 0x4ac2c1
mov ecx, dword [esp + 0x30]
push 0x52db7c
push ecx
call fcn.004e2f3f
add esp, 8
cmp eax, ebx
setne al
cmp al, bl
je 0x4ac2c1
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
push edx
push eax
call fcn.004e316c
add esp, 8
test eax, eax
je 0x4ac2c1
mov bl, 1
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4ac2e1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
mov dword [esp + 0x14], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4ac309
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, bl
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 0x18

Function at 0x4ac950
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
call fcn.004ac320
test al, al
push 0
jne 0x4ac96e
push 0
push str.WMV_support_is_not_installed__nThe_application_cannot_save_video_clips_from_the_transcript_at_this_time.
call fcn.004c26b2
xor al, al
pop esi
ret
push 4
push 0
push 0
push esi
push 0x4ac930
call fcn.004ba72f
mov dword [esi + 8], eax
mov dword [eax + 0x28], 0
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov al, 1
pop esi
ret
Function at 0x4ad620
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x527739
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x597f54]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 0
call fcn.004b4151
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4ad66f
push 0x80004005
call fcn.004010bd
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
mov esi, dword [esp + 0x20]
add eax, 0x10
mov dword [esi], eax
push 0
push esi
push 8
push 2
push 0x83
push edi
mov dword [esp + 0x30], 0
mov dword [esp + 0x24], 1
call fcn.004d2a13
add esp, 0x18
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x4b8712
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x5282d3
call fcn.004e2876
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x4b8737
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x4b8783
call fcn.004b4151
push eax
lea ecx, [ebp - 0x10]
call fcn.004b2ae1
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004b2333
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00401161
mov eax, esi
call fcn.004e294e
ret 8

Function at 0x4be8d1
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x4be90a
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00415480
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0040567d
pop esi
ret 4
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
pop esi
jmp dword [eax + 0x8c]

Function at 0x4c04b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x4c04f3
call fcn.004b9ccd
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4c04f3
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4c050e
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.004c0067
test ebx, ebx
mov esi, eax
je 0x4c050c
test edi, edi
je 0x4c050c
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x4c18e6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 4], ecx
call fcn.004b9ccd
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x4c1911
xor eax, eax
jmp 0x4c19b5
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 8], eax
je 0x4c190a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4c190a
movzx eax, word [esi + 6]
push ebx
push edi
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004b1a2e
mov edi, eax
xor eax, eax
cmp word [esi + 6], ax
pop ecx
jbe 0x4c1966
lea ecx, [esi + 8]
movzx edx, word [ecx]
mov dword [edi + eax*4], edx
movzx edx, word [esi + 6]
inc eax
inc ecx
inc ecx
cmp eax, edx
jl 0x4c1955
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 4]
push eax
push edi
call fcn.004c0688
push edi
mov ebx, eax
call fcn.004b1a59
test ebx, ebx
pop ecx
je 0x4c19a8
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
push ecx
lea esi, [ecx + 7]
mov ecx, dword [ebp - 4]
push eax
lea edx, [eax + 7]
push esi
push edx
call fcn.004c0d44
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.004c0df6
mov ebx, eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, ebx
pop ebx
pop esi
leave
ret 4
Function at 0x4c2ee4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x24
mov eax, 0x528dc7
call fcn.004e28a9
mov esi, ecx
mov dword [ebp - 0x20], esi
mov eax, dword [esi + 0x60]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x5c]
mov dword [ebp - 0x18], eax
call fcn.004b9ccd
mov edi, dword [eax + 0xc]
xor ebx, ebx
cmp dword [esi + 0x58], ebx
je 0x4c2f2f
call fcn.004b9ccd
mov edi, dword [eax + 0xc]
push 5
push dword [esi + 0x58]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
je 0x4c2f40
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jne 0x4c2f4d
or eax, 0xffffffff
jmp 0x4c30a9
mov ecx, esi
call fcn.004c2a36
mov dword [ebp - 0x14], eax
call fcn.004bd68f
and dword [ebp - 0x28], ebx
cmp dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
je 0x4c2fcb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [ebp - 0x14], eax
je 0x4c2fcb
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x4c2fcb
push 0
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x2c], 1
call fcn.004019c3
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x24], ebx
je 0x4c2fcb
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x120]
test eax, eax
je 0x4c2fcb
mov ecx, ebx
call fcn.004b8210
test eax, eax
je 0x4c2fcb
push 0
mov ecx, ebx
call fcn.004b822b
mov dword [ebp - 0x28], 1
and dword [ebp - 4], 0
push esi
call fcn.004bf301
push dword [ebp - 0x14]
call fcn.004bd5e7
push edi
push eax
push dword [ebp - 0x1c]
mov ecx, esi
call fcn.004c2cec
xor edi, edi
cmp eax, edi
je 0x4c3028
test byte [esi + 0x3c], 0x10
je 0x4c3012
push 4
pop edi
mov ecx, esi
call fcn.004b80cd
test ax, 0x100
je 0x4c3008
push 5
pop edi
push edi
mov ecx, esi
call fcn.004bd1af
xor edi, edi
cmp dword [esi + 0x20], edi
je 0x4c3028
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.004b83fe
or dword [ebp - 4], 0xffffffff
jmp 0x4c3053
cmp dword [ebp - 0x28], edi
je 0x4c3061
push 1
mov ecx, ebx
call fcn.004b822b
cmp dword [ebp - 0x2c], edi
je 0x4c3071
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x4c308a
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x20]
jne 0x4c308a
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
mov ecx, esi
call fcn.004c2a70
cmp dword [esi + 0x58], edi
je 0x4c30a6
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esi + 0x44]
call fcn.004e294e
ret
Function at 0x4c4495
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x597f54]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x800
push ebx
push esi
mov esi, ecx
mov ebx, edx
lea eax, [ebp - 0x11c]
jne 0x4c44d5
push 0x546140
push 4
push eax
call fcn.004ec526
push eax
call fcn.00401645
add esp, 0x10
jmp 0x4c44e7
push 4
push eax
push 3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x4c4555
push edi
call fcn.004e6d59
mov edi, dword [eax]
call fcn.004e6d59
and dword [eax], 0
lea eax, [ebp - 0x11c]
push eax
push ebx
push esi
push 0x111
mov esi, 0x112
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.004e87d0
add esp, 0x18
mov ebx, eax
call fcn.004e6d59
cmp dword [eax], 0
je 0x4c4535
call fcn.004e6d59
push dword [eax]
call fcn.004b3d94
pop ecx
jmp 0x4c453c
call fcn.004e6d59
mov dword [eax], edi
cmp ebx, 0xffffffff
pop edi
je 0x4c4555
cmp ebx, esi
jae 0x4c4555
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x4c4557
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004e2867
leave
ret
Function at 0x4c563f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x4c5685
call fcn.004b9ccd
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4c5685
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x4c56c8
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x4c56b1
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x4c56b1
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x4c56c5
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4c914d
Capabilities:
Read file on windows

Disassembly:
cmp dword [esp + 8], 0
push esi
mov esi, ecx
jne 0x4c9156
xor eax, eax
jmp 0x4c91bf
cmp dword [esp + 8], 0
jne 0x4c9162
call fcn.004b3efb
push edi
push dword [esi + 0x10]
push dword [esp + 0x14]
push 1
push dword [esp + 0x18]
call fcn.004e8163
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x4c919d
push dword [esi + 0x10]
call fcn.004e8ab4
test eax, eax
pop ecx
jne 0x4c919d
mov esi, dword [esi + 0xc]
call fcn.004e6d6c
push esi
push dword [eax]
push 1
call fcn.004d219d
push dword [esi + 0x10]
call fcn.004e8ae3
test eax, eax
pop ecx
je 0x4c91bc
push dword [esi + 0x10]
call fcn.004ed0da
push eax
call fcn.00401645
pop ecx
pop ecx
jmp 0x4c918b
mov eax, edi
pop edi
pop esi
ret 8

Function at 0x4c91c8
Capabilities:
Write file on windows

Disassembly:
cmp dword [esp + 4], 0
push esi
mov esi, ecx
jne 0x4c91d2
call fcn.004b3efb
push dword [esi + 0x10]
push dword [esp + 0x10]
push 1
push dword [esp + 0x14]
call fcn.004e3bd5
add esp, 0x10
cmp eax, dword [esp + 0xc]
je 0x4c91ff
mov esi, dword [esi + 0xc]
call fcn.004e6d6c
push esi
push dword [eax]
push 1
call fcn.004d219d
pop esi
ret 8

Function at 0x4cfd5a
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], vtable.CInternetSession.0
jne 0x4cfd83
call fcn.004b9ccd
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 8], eax
jne 0x4cfda6
push eax
push dword [esi + 4]
call fcn.004cfce5
push esi
push eax
mov ecx, 0x59ceac
call fcn.004cf99b
mov eax, esi
pop esi
pop ebp
ret 0x18
Function at 0x4d05d1
Capabilities:
Connect to http server

Disassembly:
push 4
mov eax, 0x52a222
call fcn.004e2876
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 0x20]
mov edi, dword [ebp + 8]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push edi
call fcn.004d0593
and dword [ebp - 4], 0
lea ecx, [esi + 0x18]
mov dword [esi], vtable.CHttpConnection.0
call fcn.004023e9
push dword [esi + 8]
mov edi, dword [edi + 8]
push dword [ebp + 0x10]
mov byte [ebp - 4], 1
push 3
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.WININET.dll_InternetConnectA]
test eax, eax
mov dword [esi + 4], eax
jne 0x4d0638
push eax
push dword [esi + 8]
call fcn.004cfce5
push dword [esi + 0xc]
mov ecx, 0x59ceac
push eax
call fcn.004cf99b
mov eax, esi
call fcn.004e294e
ret 0x1c

Function at 0x4d198d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x4d19a3
mov edi, dword [esi + 0xc]
jmp 0x4d19e3
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x4d19bc
call fcn.004c7c57
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4d19d1
call fcn.004c7c57
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x4d19e3
call fcn.004c7c57
call fcn.004b9ccd
cmp dword [eax + 0x3c], 0
je 0x4d19f8
push edi
mov ecx, ebx
call fcn.004d08b4
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.004d18a7
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x5c]
test eax, eax
je 0x4d1a16
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x5c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x4d1a22
mov edi, eax
mov dword [ebx + 0x5c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4e2867
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x597f54]
jne 0x4e2871
repz ret
jmp fcn.004ef22c

Function at 0x4e391b
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x4e3948
call fcn.004e6d6c
mov dword [eax], esi
call fcn.004e6d59
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.004e2d6d
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4e3966
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004e6d7f
pop ecx
jmp 0x4e3943
test byte [esp + 0xc], 0x80
je 0x4e3972
and eax, 0xfffffffe
jmp 0x4e3975
or eax, 1
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x4e3957
xor eax, eax
pop esi
ret
Function at 0x4e42c3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x4e42f0
call fcn.004e6d6c
mov dword [eax], esi
call fcn.004e6d59
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.004e2d6d
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x4e42cc
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4e431f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004e6d7f
pop ecx
call fcn.004e6d59
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x4e4346
test al, 1
je 0x4e4346
test byte [esp + 0xc], 2
je 0x4e4346
call fcn.004e6d6c
mov dword [eax], 5
call fcn.004e6d59
mov dword [eax], 0xd
jmp 0x4e4316
xor eax, eax
pop esi
ret
Function at 0x4e7ec7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x4e7f04
cmp dword [ebp + 0x14], edi
je 0x4e7f04
cmp ecx, edi
jne 0x4e7f0b
call fcn.004e6d59
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.004e2d6d
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x4e7f1f
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x4e7f40
cmp ebx, 0xffffffff
je 0x4e7f2f
push ebx
push edi
push ecx
call fcn.004e3e60
add esp, 0xc
cmp esi, edi
je 0x4e7eec
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x4e7eec
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x4e7f5c
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x4e7f63
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x4e8054
test word [esi + 0xc], 0x10c
je 0x4e7fb7
mov eax, dword [esi + 4]
test eax, eax
je 0x4e7fb7
jl 0x4e80b5
cmp ebx, eax
mov edi, ebx
jb 0x4e7f88
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x4e805c
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.004e2a5b
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x4e804c
cmp ebx, dword [ebp - 0xc]
jb 0x4e8024
cmp dword [ebp - 0xc], 0
je 0x4e7fe1
mov ecx, SysReAllocString
xor edx, edx
cmp ebx, ecx
jbe 0x4e7fd6
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x4e7fdd
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x4e7fec
mov eax, SysReAllocString
cmp ebx, eax
ja 0x4e7fec
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x4e8088
push eax
push dword [ebp - 8]
push esi
call fcn.004ed0ad
pop ecx
push eax
call fcn.004f6de6
add esp, 0xc
test eax, eax
je 0x4e80c7
cmp eax, 0xffffffff
je 0x4e80b5
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x4e804c
push esi
call fcn.004f6705
cmp eax, 0xffffffff
pop ecx
je 0x4e80b9
cmp dword [ebp - 4], 0
je 0x4e8088
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x4e7f6b
mov eax, dword [ebp + 0x14]
jmp 0x4e7f06
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x4e8073
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.004e3e60
add esp, 0xc
call fcn.004e6d59
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x4e7efc
cmp dword [ebp + 0xc], 0xffffffff
je 0x4e809e
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.004e3e60
add esp, 0xc
call fcn.004e6d59
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x4e7efc
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x4e7f06
or dword [esi + 0xc], 0x10
jmp 0x4e80b9