joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a5549dc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x218], ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4a554b5f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.4a507618
lea eax, [ebp - 4]
push eax
call sub.shell32.dll_SHGetMalloc
test eax, eax
jne 0x4a554b33
lea eax, [ebp - 8]
push eax
push esi
push 0xffffffffffffffff
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x4a554b33
cmp dword [0x4a5f40dc], 0
jne 0x4a554a5c
push 0x4a554b70
push 0x4a554b9c
call sub.kernel32.dll_GetModuleHandleW_1
push eax
call fcn.4a50d92c
mov dword [0x4a5f40dc], eax
cmp dword [0x4a5f40dc], 0
je 0x4a554a8e
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [0x4a5f40dc]
test eax, eax
je 0x4a554a8e
mov eax, edi
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.4a5083a4
jmp 0x4a554ac5
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x4a554ac5
lea eax, [ebp - 0x218]
lea edx, [ebp - 0x212]
mov ecx, 0
call fcn.4a507c94
mov edx, dword [ebp - 0x218]
mov eax, edi
call fcn.4a5083c0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
cmp dword [edi], 0
jne 0x4a554af1
lea edx, [ebp - 0x21c]
xor eax, eax
call fcn.4a5523d4
mov eax, dword [ebp - 0x21c]
mov edx, edi
call fcn.4a512584
cmp dword [edi], 0
je 0x4a554b33
mov eax, dword [edi]
call fcn.4a507ae8
mov edx, dword [edi]
cmp word [edx + eax*2 - 2], 0x5c
sete al
cmp bl, al
je 0x4a554b33
test bl, bl
je 0x4a554b1e
mov eax, edi
mov edx, 0x4a554bc0
call fcn.4a508490
jmp 0x4a554b33
mov eax, dword [edi]
call fcn.4a507ae8
mov edx, eax
mov eax, edi
mov ecx, 1
call fcn.4a5086a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a554b66
lea eax, [ebp - 0x21c]
call fcn.4a507618
lea eax, [ebp - 0x218]
call fcn.4a50763c
lea eax, [ebp - 4]
call fcn.4a50aaf4
ret

Function at 0x4a555644
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push esi
push edi
mov edi, eax
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4a55565e
call sub.user32.dll_EmptyClipboard
call sub.user32.dll_CloseClipboard
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x4a5556bd
mov eax, edi
call fcn.4a507ae8
add eax, eax
add eax, 2
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov ebx, eax
push ebx
call sub.kernel32.dll_GlobalLock
mov esi, eax
test esi, esi
je 0x4a5556b8
mov eax, edi
call fcn.4a507ae8
add eax, eax
add eax, 2
push eax
mov eax, edi
call fcn.4a5082f8
mov edx, esi
pop ecx
call fcn.4a504a94
push ebx
call sub.kernel32.dll_GlobalUnlock
push ebx
push 0xd
call sub.user32.dll_SetClipboardData
call sub.user32.dll_CloseClipboard
pop edi
pop esi
pop ebx
ret
Function at 0x4a5579e4
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], eax
xor eax, eax
push ebp
push 0x4a557b98
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
call fcn.4a557918
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x4a557b76
push dword fs:[edx]
mov dword fs:[edx], esp
cmp dword [0x4a5e8d58], 0
jne 0x4a557b4a
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x14]
call fcn.4a553164
lea eax, [ebp - 0x30]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.4a510ea4
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov edx, 0x4a557bb8
call fcn.4a507dac
mov eax, dword [ebp - 0x2c]
call fcn.4a507f78
push eax
push 0
push 6
call sub.kernel32.dll_OpenFileMappingA
mov edi, eax
test edi, edi
sete bl
test bl, bl
je 0x4a557abe
lea eax, [ebp - 0x38]
push eax
call sub.kernel32.dll_GetCurrentProcessId
mov cl, 0x30
mov edx, 1
call fcn.4a510ea4
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x34]
mov edx, 0x4a557bb8
call fcn.4a507dac
mov eax, dword [ebp - 0x34]
call fcn.4a507f78
push eax
push 4
push 0
push 4
lea eax, [ebp - 0x14]
push eax
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov edi, eax
test edi, edi
jne 0x4a557ad9
xor esi, esi
push 0
push 0x4a557bd0
push 0x4a557bdc
push 0
call sub.user32.dll_MessageBoxA
jmp 0x4a557b39
test bl, bl
je 0x4a557b20
push 0
push 0
push 0
push 0xf001f
push edi
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
push 4
push 0x1000
push 0x28
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov ebx, eax
mov dword [esi], ebx
mov eax, ebx
mov edx, 0x28
call fcn.4a50e138
mov eax, dword [esi]
mov dword [eax + 4], edi
add eax, 8
push eax
call sub.kernel32.dll_InitializeCriticalSection_1
jmp 0x4a557b39
push 0
push 0
push 0
push 0xf001f
push edi
call sub.kernel32.dll_MapViewOfFile
mov esi, eax
push edi
call sub.kernel32.dll_CloseHandle_1
test esi, esi
je 0x4a557b4a
mov eax, esi
call fcn.4a58fe04
mov dword [0x4a5e8d58], esi
cmp dword [0x4a5e8d58], 0
je 0x4a557b60
mov eax, dword [0x4a5e8d58]
mov eax, dword [eax]
inc dword [eax]
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a557b7d
mov eax, dword [ebp - 8]
call fcn.4a5579d0
ret

Function at 0x4a562a98
Capabilities:
Create thread
Resume thread

Disassembly:
cmp dword [0x4a5e8d84], 0
jne 0x4a562b2b
xor eax, eax
call fcn.4a516164
mov dword [0x4a5e8d84], eax
cmp dword [0x4a5e8d84], 0
je 0x4a562b2b
mov eax, 0x4a5628fc
xor ecx, ecx
xor edx, edx
call fcn.4a516668
mov dword [0x4a5e8d88], eax
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x4a5e8d98], eax
push 0x4a5e8d7c
push 4
push 0
push 0x4a562944
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x4a5e8d80], eax
cmp dword [0x4a5e8d80], 0
je 0x4a562b2b
mov edx, 0x4a562b38
mov eax, dword [0x4a5e8d7c]
call fcn.4a553d68
push 2
mov eax, dword [0x4a5e8d80]
push eax
call sub.kernel32.dll_SetThreadPriority
mov eax, dword [0x4a5e8d80]
push eax
call sub.kernel32.dll_ResumeThread
ret
Function at 0x4a562b74
Capabilities:
Terminate thread

Disassembly:
push ebx
cmp dword [0x4a5e8d84], 0
je 0x4a562c45
mov ebx, dword [0x4a5e8d98]
xor eax, eax
mov dword [0x4a5e8d98], eax
push ebx
call sub.kernel32.dll_SetEvent
push ebx
call sub.kernel32.dll_CloseHandle_1
cmp dword [0x4a5e8d94], 0
je 0x4a562bbd
mov ebx, dword [0x4a5e8d94]
xor eax, eax
mov dword [0x4a5e8d94], eax
push ebx
call sub.kernel32.dll_SetEvent
push ebx
call sub.kernel32.dll_CloseHandle_1
mov dword [0x4a5e8d90], 0xffffffff
mov eax, 0x4a5628fc
xor ecx, ecx
xor edx, edx
call fcn.4a516894
push 0x1f4
mov eax, dword [0x4a5e8d80]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
je 0x4a562c0a
push 0
mov eax, dword [0x4a5e8d80]
push eax
call sub.kernel32.dll_TerminateThread
cmp dword [0x4a5e8d9c], 0
je 0x4a562c0a
mov eax, dword [0x4a5e8d9c]
push eax
call sub.kernel32.dll_LocalFree_1
xor eax, eax
mov dword [0x4a5e8d9c], eax
mov eax, dword [0x4a5e8d80]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0
push 0
push 0
xor ecx, ecx
xor edx, edx
mov eax, dword [0x4a5e8d7c]
call fcn.4a553adc
xor eax, eax
mov dword [0x4a5e8d80], eax
xor eax, eax
mov dword [0x4a5e8d7c], eax
xor eax, eax
mov dword [0x4a5e8d84], eax
pop ebx
ret
Function at 0x4a56aaac
Capabilities:
Resolve dns

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, esi
call fcn.4a507f78
mov edi, eax
push edi
call sub.wsock32.dll_inet_addr
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4a56aad8
push edi
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4a56aad8
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ebx, dword [eax]
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4a56cf84
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
or dword [ebp + 0xc], 0xc11c
cmp byte [0x4a5e8440], 0
je 0x4a56cfaa
or dword [ebp + 0xc], 0x80000
push 1
xor eax, eax
mov dword [ebp - 0x2c], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
push 1
push 0x4a56d06c
push 1
push 0x4a56d074
push 1
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.4a56cf1c
push 0
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push eax
push esi
lea eax, [ebx + 0x44]
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x18]
mov esi, eax
mov eax, esi
call fcn.4a550f78
test al, al
jne 0x4a56d014
cmp esi, 0x80090318
jne 0x4a56d01c
test edi, edi
je 0x4a56d01c
mov byte [ebx + 0x5c], 1
mov edi, dword [ebp - 0x1c]
test edi, edi
je 0x4a56d04c
cmp dword [ebp - 0x24], 0
je 0x4a56d04c
push 0
mov eax, dword [ebp - 0x24]
push eax
push edi
mov eax, dword [ebx + 0x50]
push eax
call sub.wsock32.dll_send
test eax, eax
jg 0x4a56d042
mov esi, 0x80090304
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x40]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4a56d060
cmp dword [ebp - 0x18], 0
je 0x4a56d060
push eax
mov eax, dword [ebx + 8]
call dword [eax + 0x40]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4a56d07c
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffeb4
mov edi, edx
mov ebx, eax
mov byte [esp], 0
xor esi, esi
xor eax, eax
mov dword [esp + 8], eax
test edi, edi
je 0x4a56d101
mov dword [esp + 0x38], 1
mov eax, dword [ebx + 0x50]
mov dword [esp + 0x3c], eax
mov eax, dword [0x4a5e8454]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
lea eax, [esp + 0x44]
push eax
push 0
call sub.wsock32.dll_select
test eax, eax
jle 0x4a56d224
push 0
mov eax, dword [ebx + 0x74]
sub eax, esi
push eax
mov eax, dword [ebx + 0x78]
add eax, esi
push eax
mov eax, dword [ebx + 0x50]
push eax
call sub.wsock32.dll_recv
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jle 0x4a56d224
mov eax, dword [esp + 4]
add esi, eax
test esi, esi
sete al
neg al
sbb edi, edi
push 1
mov eax, dword [ebx + 0x78]
mov dword [esp + 0x140], eax
xor eax, eax
mov dword [esp + 0x144], eax
lea eax, [esp + 0x140]
push eax
push 1
mov dword [esp + 0x150], esi
xor eax, eax
mov dword [esp + 0x154], eax
lea eax, [esp + 0x150]
push eax
push 1
push 0x4a56d234
push 1
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x30]
mov eax, ebx
call fcn.4a56cf1c
push 0
mov eax, dword [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push eax
lea edx, [ebx + 0x54]
xor ecx, ecx
mov eax, ebx
call fcn.4a56cf84
mov ebp, eax
sub ebp, 0x80090318
je 0x4a56d21c
sub ebp, 0x7ff6fce8
je 0x4a56d199
sub ebp, 0x90312
je 0x4a56d1e1
sub ebp, 0xe
je 0x4a56d20d
jmp 0x4a56d224
cmp dword [esp + 0x30], 5
jne 0x4a56d1db
mov eax, dword [esp + 0x2c]
push eax
push 0x40
call sub.kernel32.dll_LocalAlloc_1
mov dword [ebx + 0x84], eax
mov edx, dword [ebx + 0x84]
mov eax, dword [ebx + 0x78]
add eax, esi
sub eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x2c]
call fcn.4a504a94
mov eax, dword [esp + 0x2c]
mov dword [ebx + 0x7c], eax
mov dword [ebx + 0x80], 2
mov byte [esp], 1
jmp 0x4a56d224
cmp dword [esp + 0x30], 5
jne 0x4a56d206
mov edx, dword [ebx + 0x78]
mov eax, dword [ebx + 0x78]
add eax, esi
sub eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x2c]
call fcn.4a504a94
mov esi, dword [esp + 0x2c]
jmp 0x4a56d096
xor esi, esi
jmp 0x4a56d096
or dword [esp + 8], 0x80
xor edi, edi
jmp 0x4a56d096
or edi, 0xffffffff
jmp 0x4a56d096
movzx eax, byte [esp]
add esp, 0x14c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4a56d23c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff98
mov esi, edx
mov ebp, eax
mov bl, 1
mov eax, esi
call fcn.4a507f78
mov dword [esp], eax
mov dword [esp + 0x44], esi
mov eax, dword [esp + 0x44]
call fcn.4a507af4
mov edi, eax
mov dword [esp + 4], 0x400
cmp dword [ebp + 8], 0
je 0x4a56d370
mov eax, dword [esp + 4]
cmp eax, dword [ebp + 0x68]
jbe 0x4a56d370
mov eax, dword [ebp + 0x68]
mov dword [esp + 4], eax
jmp 0x4a56d370
cmp edi, dword [esp + 4]
jbe 0x4a56d299
mov esi, dword [esp + 4]
jmp 0x4a56d29b
mov esi, edi
cmp dword [ebp + 8], 0
je 0x4a56d355
mov edx, dword [ebp + 0x78]
add edx, dword [ebp + 0x60]
mov eax, dword [esp]
mov ecx, esi
call fcn.4a504a94
push 3
mov eax, dword [ebp + 0x78]
mov dword [esp + 0x4c], eax
mov eax, dword [ebp + 0x78]
add eax, dword [ebp + 0x60]
mov dword [esp + 0x50], eax
mov eax, dword [ebp + 0x78]
add eax, dword [ebp + 0x60]
add eax, esi
mov dword [esp + 0x54], eax
xor eax, eax
mov dword [esp + 0x58], eax
lea eax, [esp + 0x4c]
push eax
push 3
mov eax, dword [ebp + 0x60]
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], esi
mov eax, dword [ebp + 0x64]
mov dword [esp + 0x6c], eax
xor eax, eax
mov dword [esp + 0x70], eax
lea eax, [esp + 0x64]
push eax
push 3
push 0x4a56d388
push 3
lea ecx, [esp + 0x30]
lea edx, [esp + 0x24]
mov eax, ebp
call fcn.4a56cf1c
push 0
lea eax, [esp + 0xc]
push eax
push 0
lea eax, [ebp + 0x54]
push eax
mov eax, dword [ebp + 8]
call dword [eax + 0x64]
test eax, eax
jne 0x4a56d34d
push 0
mov eax, dword [esp + 0x18]
add eax, dword [esp + 0x24]
add eax, dword [esp + 0x30]
push eax
mov eax, dword [ebp + 0x78]
push eax
mov eax, dword [ebp + 0x50]
push eax
call sub.wsock32.dll_send
test eax, eax
jg 0x4a56d351
xor ebx, ebx
jmp 0x4a56d36b
mov bl, 1
jmp 0x4a56d36b
push 0
push esi
mov eax, dword [esp + 8]
push eax
mov eax, dword [ebp + 0x50]
push eax
call sub.wsock32.dll_send
test eax, eax
setg bl
add dword [esp], esi
sub edi, esi
test bl, bl
je 0x4a56d37c
test edi, edi
ja 0x4a56d28d
mov eax, ebx
add esp, 0x68
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4a56e0d4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdcc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x4a56e33b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
movzx eax, byte [edi + 0x8f]
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4a56e2f7
cmp byte [0x4a5e8442], 0
jne 0x4a56e15f
mov eax, ebx
call fcn.4a55386c
test al, al
je 0x4a56e19c
push 0x4a56e35c
lea edx, [ebp - 0x220]
mov eax, ebx
call fcn.4a512318
mov eax, dword [ebp - 0x220]
lea edx, [ebp - 0x21c]
call fcn.4a52438c
push dword [ebp - 0x21c]
push 0x4a56e374
lea eax, [ebp - 4]
mov edx, 3
call fcn.4a507e30
jmp 0x4a56e1ab
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0
call fcn.4a508124
push 0x4a56e384
lea eax, [ebp - 0x228]
mov edx, dword [0x4a5e8e0c]
mov ecx, 0
call fcn.4a507c94
push dword [ebp - 0x228]
push 0x4a56e394
push 0x4a56e3a4
lea edx, [ebp - 0x230]
mov eax, ebx
call fcn.4a56b4b0
mov edx, dword [ebp - 0x230]
lea eax, [ebp - 0x22c]
mov ecx, 0
call fcn.4a508124
push dword [ebp - 0x22c]
push 0x4a56e3c0
push dword [ebp - 4]
push 0x4a56e3d8
push 0x4a56e394
push 0x4a56e3e8
push 0x4a56e394
push 0x4a56e418
push dword [ebp - 4]
push 0x4a56e3d8
push 0x4a56e394
push 0x4a56e394
lea eax, [ebp - 0x224]
mov edx, 0x10
call fcn.4a507e30
mov edx, dword [ebp - 0x224]
mov eax, edi
call fcn.4a56d23c
mov esi, dword [ebp - 0xc]
test esi, esi
jbe 0x4a56e2f7
cmp esi, 0xff
jbe 0x4a56e269
mov ebx, 0xff
jmp 0x4a56e26b
mov ebx, esi
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x215]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x4a56e28b
cmp ebx, dword [ebp - 0x14]
je 0x4a56e29d
mov edx, 0x4a56e394
mov eax, edi
call fcn.4a56d23c
mov byte [ebp - 0xd], 0
jmp 0x4a56e2f7
lea ecx, [ebp - 0x234]
lea eax, [ebp - 0x215]
mov edx, ebx
call fcn.4a524254
lea eax, [ebp - 0x234]
mov edx, 0x4a56e394
call fcn.4a507d54
mov edx, dword [ebp - 0x234]
mov eax, edi
call fcn.4a56d23c
sub esi, ebx
cmp dword [ebp + 8], 0
je 0x4a56e2ef
mov eax, dword [ebp - 0xc]
sub eax, esi
imul eax, eax, 0x3e8
xor edx, edx
div dword [ebp - 0xc]
mov edx, eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
call dword [ecx + 0x18]
test esi, esi
ja 0x4a56e25a
mov eax, dword [ebp + 8]
mov edx, dword [eax]
call dword [edx + 0x24]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a56e342
lea eax, [ebp - 0x234]
call fcn.4a50763c
lea eax, [ebp - 0x230]
call fcn.4a507618
lea eax, [ebp - 0x22c]
mov edx, 5
call fcn.4a5076a8
lea eax, [ebp - 4]
call fcn.4a50763c
ret
Function at 0x4a571b64
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4a571c7d
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
push 0
push 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetFilePointer_1
mov esi, dword [ebp - 0xc]
cmp byte [ebp + 8], 0
je 0x4a571bae
mov dword [ebp - 0x10], 0x600
jmp 0x4a571bb5
mov dword [ebp - 0x10], 0x800
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
call fcn.4a5080ac
test esi, esi
jbe 0x4a571c5f
cmp esi, dword [ebp - 0x10]
jae 0x4a571bdb
lea eax, [ebp - 4]
xor ecx, ecx
mov edx, esi
call fcn.4a5080ac
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
call fcn.4a507af4
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
je 0x4a571c08
mov eax, dword [ebp - 4]
call fcn.4a507af4
cmp eax, dword [ebp - 0x14]
je 0x4a571c0c
xor ebx, ebx
jmp 0x4a571c5f
cmp byte [ebp + 8], 0
je 0x4a571c2b
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.4a52438c
mov edx, dword [ebp - 0x18]
mov eax, edi
call fcn.4a570f58
mov ebx, eax
jmp 0x4a571c37
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.4a570f58
mov ebx, eax
test bl, bl
je 0x4a571c5f
sub esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
sub eax, esi
imul eax, eax, 0x3e8
xor edx, edx
div dword [ebp - 0xc]
mov edx, eax
mov eax, edi
call fcn.4a5714a8
test esi, esi
ja 0x4a571bca
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a571c84
lea eax, [ebp - 0x18]
call fcn.4a50763c
lea eax, [ebp - 4]
call fcn.4a50763c
ret
Function at 0x4a577618
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.4a5076fc
xor eax, eax
push ebp
push 0x4a57775b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.4a512584
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.4a507a20
cmp dword [ebp - 4], 0
je 0x4a577731
mov eax, dword [ebp - 4]
call fcn.4a507ae8
mov edx, dword [ebp - 4]
cmp word [edx + eax*2 - 2], 0x5c
jne 0x4a577685
mov eax, dword [ebp - 4]
call fcn.4a507ae8
mov edx, eax
lea eax, [ebp - 4]
mov ecx, 1
call fcn.4a5086a0
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x4a5776d1
mov eax, dword [ebp - 4]
call fcn.4a5082f8
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
jne 0x4a5776cd
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.4a577618
pop ecx
test al, al
je 0x4a5776c9
push 0
mov eax, dword [ebp - 4]
call fcn.4a5082f8
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x4a5776cd
xor ebx, ebx
jmp 0x4a577733
mov bl, 1
jmp 0x4a577733
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.4a508124
mov eax, dword [ebp - 0xc]
call fcn.4a507f78
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x4a57772d
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.4a577618
pop ecx
test al, al
je 0x4a577729
push 0
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
mov ecx, 0
call fcn.4a508124
mov eax, dword [ebp - 0x10]
call fcn.4a507f78
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x4a57772d
xor ebx, ebx
jmp 0x4a577733
mov bl, 1
jmp 0x4a577733
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a577762
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.4a5076a8
lea eax, [ebp - 8]
mov edx, 2
call fcn.4a507678
ret
Function at 0x4a57a26c
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended
Get common file path
Read file via mapping
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd6c
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x290], ecx
mov dword [ebp - 0x294], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov byte [ebp - 9], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x4a57a486
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x70]
mov edx, 0x44
call fcn.4a50e138
mov dword [ebp - 0x70], 0x44
call sub.kernel32.dll_GetVersion_1
test eax, 0x80000000
jne 0x4a57a31f
test ebx, ebx
jne 0x4a57a2d3
call sub.kernel32.dll_GetCommandLineW_1
mov edx, eax
lea eax, [ebp - 4]
call fcn.4a508350
jmp 0x4a57a2dd
lea eax, [ebp - 4]
mov edx, ebx
call fcn.4a507a20
lea eax, [ebp - 0x28a]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryW
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x28a]
push eax
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.4a5082f8
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x4a57a388
test ebx, ebx
jne 0x4a57a339
call sub.kernel32.dll_GetCommandLineA
mov edx, eax
lea eax, [ebp - 8]
mov ecx, 0
call fcn.4a507c94
jmp 0x4a57a348
lea eax, [ebp - 8]
mov edx, ebx
mov ecx, 0
call fcn.4a508124
lea eax, [ebp - 0x28a]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x28a]
push eax
push 0
push 4
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.4a507f78
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x4a57a439
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x18]
call fcn.4a553164
lea eax, [ebp - 0x294]
push eax
mov cl, 0x30
mov edx, 1
mov eax, dword [ebp - 0x78]
call fcn.4a510ea4
mov ecx, dword [ebp - 0x294]
lea eax, [ebp - 0x290]
mov edx, 0x4a57a4a0
call fcn.4a507dac
mov eax, dword [ebp - 0x290]
call fcn.4a507f78
push eax
push 0x58
push 0
push 4
lea eax, [ebp - 0x18]
push eax
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov esi, eax
push 0
push 0
push 0
push 0xf001f
push esi
call sub.kernel32.dll_MapViewOfFile
mov ebx, eax
test ebx, ebx
je 0x4a57a430
call sub.kernel32.dll_GetCurrentProcessId
mov dword [ebx], eax
push 2
push 0
push 0
lea eax, [ebx + 4]
push eax
mov eax, dword [ebp - 0x80]
push eax
push esi
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_DuplicateHandle
lea edx, [ebx + 8]
mov eax, 0x4a5e8578
mov ecx, 0x50
call fcn.4a504a94
mov eax, dword [ebp - 0x7c]
push eax
call sub.kernel32.dll_ResumeThread
cmp byte [ebp - 9], 0
je 0x4a57a44e
push 2
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_TerminateProcess
jmp 0x4a57a458
mov eax, 2
call fcn.4a507458
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a57a48d
lea eax, [ebp - 0x294]
mov edx, 2
call fcn.4a5076a8
lea eax, [ebp - 8]
call fcn.4a50763c
lea eax, [ebp - 4]
call fcn.4a507618
ret