joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d8da0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x74fb88
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x81f390]
xor eax, esp
mov dword [esp + 0x44], eax
push esi
push edi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
push 5
push str.Tcpip
lea ecx, [esp + 0x24]
mov dword [esp + 0x64], 0
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], 0
mov byte [esp + 0x24], 0
call fcn.00409620
mov dword [esp + 0x18], vtable.wbs::StringBase_char_.0
lea eax, [esp + 0x18]
mov byte [esp + 0x5c], 1
push eax
lea ecx, [esp + 0x10]
call fcn.00409c30
cmp dword [esp + 0x30], 0x10
mov byte [esp + 0x5c], 0
mov dword [esp + 0x18], vtable.wbs::StringBase_char_.0
jb 0x4d8e52
push dword [esp + 0x1c]
call fcn.006f75a9
add esp, 4
push 7
push str.Winmgmt
lea ecx, [esp + 0x24]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], 0
mov byte [esp + 0x24], 0
call fcn.00409620
mov dword [esp + 0x18], vtable.wbs::StringBase_char_.0
lea eax, [esp + 0x18]
mov byte [esp + 0x5c], 2
push eax
lea ecx, [esp + 0x10]
call fcn.00409c30
cmp dword [esp + 0x30], 0x10
mov byte [esp + 0x5c], 0
mov dword [esp + 0x18], vtable.wbs::StringBase_char_.0
jb 0x4d8eb2
push dword [esp + 0x1c]
call fcn.006f75a9
add esp, 4
lea eax, [esp + 0xc]
mov ecx, 0x852d00
push eax
call fcn.00515bb0
push 0
push 0x77e880
lea ecx, [esp + 0x40]
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], 0
mov byte [esp + 0x40], 0
call fcn.00409620
mov dword [esp + 0x34], vtable.wbs::StringBase_char_.0
push 0x18
push 0x7884b4
lea ecx, [esp + 0x24]
mov byte [esp + 0x64], 3
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], 0
mov byte [esp + 0x24], 0
call fcn.00409620
mov dword [esp + 0x18], vtable.wbs::StringBase_char_.0
push 0x14
push 0x11
lea eax, [esp + 0x3c]
mov byte [esp + 0x64], 4
push eax
lea eax, [esp + 0x24]
mov ecx, 0x852d00
push eax
lea eax, [esi + 0x200]
push eax
lea eax, [esi + 0x238]
push eax
call fcn.00515dc0
cmp dword [esp + 0x30], 0x10
mov dword [esp + 0x18], vtable.wbs::StringBase_char_.0
jb 0x4d8f66
push dword [esp + 0x1c]
call fcn.006f75a9
add esp, 4
cmp dword [esp + 0x4c], 0x10
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
mov dword [esp + 0x34], vtable.wbs::StringBase_char_.0
jb 0x4d8f96
push dword [esp + 0x38]
call fcn.006f75a9
add esp, 4
mov esi, dword [esp + 0xc]
mov dword [esp + 0x5c], 0xffffffff
test esi, esi
je 0x4d8fcc
mov edi, dword [esp + 0x10]
cmp esi, edi
je 0x4d8fc3
mov edi, edi
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax]
add esi, 0x1c
cmp esi, edi
jne 0x4d8fb0
mov esi, dword [esp + 0xc]
push esi
call fcn.006f75a9
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.006f7ca4
add esp, 0x54
ret
Function at 0x4f4b10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x75265e
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov esi, dword [esp + 0x20]
push 0xffffffffffffffff
push 0
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], 0
push esi
mov byte [edi], 0
call fcn.00404c20
push 0xffffffffffffffff
lea ecx, [edi + 0x18]
mov dword [esp + 0x1c], 0
lea eax, [esi + 0x18]
mov dword [ecx + 0x14], 0xf
push 0
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.00404c20
push 0xffffffffffffffff
lea ecx, [edi + 0x30]
mov byte [esp + 0x1c], 1
lea eax, [esi + 0x30]
mov dword [ecx + 0x14], 0xf
push 0
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.00404c20
mov ax, word [esi + 0x48]
lea ecx, [edi + 0x58]
mov word [edi + 0x48], ax
mov eax, dword [esi + 0x4c]
mov dword [edi + 0x4c], eax
mov eax, dword [esi + 0x50]
mov dword [edi + 0x50], eax
mov eax, dword [esi + 0x54]
mov dword [edi + 0x54], eax
lea eax, [esp + 0x20]
push eax
lea eax, [esi + 0x58]
mov byte [esp + 0x1c], 2
push eax
call fcn.004f4a70
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x4f4f80
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
push esi
mov esi, ecx
cmp byte [esi], 0
jne 0x4f500d
lea eax, [esp + 4]
mov dword [esp + 4], 0xffffffff
push eax
push 0
push 0x28
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x4f4fe5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
jne 0x4f4ffe
push 2
call dword [sym.imp.ADVAPI32.dll_ImpersonateSelf]
test eax, eax
je 0x4f4ffe
lea eax, [esp + 4]
push eax
push 0
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
je 0x4f4ffe
push 1
push str.SeDebugPrivilege
push dword [esp + 0xc]
mov ecx, esi
call fcn.004f4de0
test al, al
je 0x4f4ffe
mov byte [esi], 1
mov eax, dword [esp + 4]
test eax, eax
je 0x4f500d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [esi]
pop esi
pop ecx
ret
Function at 0x4f8a70
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x752c38
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x81f390]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x20]
mov byte [ebp - 0x28], 0
push eax
push 0
push 8
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov word [ebp - 0x14], 0x500
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4f8af9
call esi
cmp eax, 0x3f0
jne 0x4f8b1b
lea eax, [ebp - 0x20]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4f8b1b
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 2
push dword [ebp - 0x20]
call edi
test eax, eax
je 0x4f8b22
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x4f8bf1
call esi
cmp eax, 0x7a
jne 0x4f8b12
mov esi, dword [ebp - 0x1c]
mov eax, esi
call fcn.007021d0
mov ebx, esp
test ebx, ebx
je 0x4f8b12
lea eax, [ebp - 0x1c]
push eax
push esi
push ebx
push 2
push dword [ebp - 0x20]
call edi
test eax, eax
je 0x4f8b12
lea eax, [ebp - 0x24]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x4f8b12
xor esi, esi
cmp dword [ebx], esi
jbe 0x4f8bdc
lea edi, [ebx + 4]
lea ebx, [ebx]
push dword [ebp - 0x24]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x4f8b99
inc esi
add edi, 8
cmp esi, dword [ebx]
jb 0x4f8b80
jmp 0x4f8bdc
call fcn.004f77c0
mov dword [ebp - 0x2c], eax
cmp byte [ebp + 8], 0
mov dword [ebp - 4], 0
je 0x4f8bd1
push 0
push 0
push 6
call fcn.004f8870
add esp, 0xc
test al, al
je 0x4f8bd1
mov eax, dword [ebx + esi*8 + 8]
shr eax, 2
and eax, 0xffffff01
mov dword [ebp - 0x28], eax
jmp 0x4f8bd5
mov byte [ebp - 0x28], 1
mov dword [ebp - 4], 0xffffffff
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0x28]
lea esp, [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006f7ca4
mov esp, ebp
pop ebp
ret
Function at 0x4f8f10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x752cb4
mov eax, dword fs:[0]
push eax
push ecx
push edi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 8], edi
push dword [esp + 0x1c]
call fcn.006f8a00
mov dword [edi], vtable.wbs::Exception.0
mov byte [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x2c], 0xf
mov dword [edi + 0x28], 0
mov byte [edi + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [edi + 0x14], vtable.wbs::StringBase_char_.0
mov dword [edi + 0x48], 0xf
mov dword [edi + 0x44], 0
mov byte [edi + 0x34], 0
mov dword [edi + 0x30], vtable.wbs::StringBase_char_.0
mov dword [edi + 0x64], 0xf
mov dword [edi + 0x60], 0
mov byte [edi + 0x50], 0
mov dword [edi + 0x4c], vtable.wbs::StringBase_char_.0
mov dword [edi + 0x80], 0xf
mov dword [edi + 0x7c], 0
mov byte [edi + 0x6c], 0
mov dword [edi + 0x68], vtable.wbs::StringBase_char_.0
push dword [esp + 0x1c]
mov ecx, edi
mov byte [esp + 0x18], 4
mov dword [edi + 0x84], 0
mov dword [edi + 0x88], 0
call fcn.004f9f30
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x10
ret 4
Function at 0x4f9000
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x752d1a
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
call fcn.006f8a23
mov eax, dword [esp + 0x28]
mov dword [esi], vtable.wbs::Exception.0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], eax
mov dword [esi + 0x2c], 0xf
mov dword [esi + 0x28], 0
mov byte [esi + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esi + 0x14], vtable.wbs::StringBase_char_.0
mov dword [esi + 0x48], 0xf
mov dword [esi + 0x44], 0
mov byte [esi + 0x34], 0
mov dword [esi + 0x30], vtable.wbs::StringBase_char_.0
mov dword [esi + 0x64], 0xf
mov dword [esi + 0x60], 0
mov byte [esi + 0x50], 0
mov dword [esi + 0x4c], vtable.wbs::StringBase_char_.0
mov dword [esi + 0x80], 0xf
mov dword [esi + 0x7c], 0
mov byte [esi + 0x6c], 0
mov dword [esi + 0x68], vtable.wbs::StringBase_char_.0
push 0x1c
mov byte [esp + 0x20], 4
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0
call fcn.006f7558
mov edi, eax
add esp, 4
mov dword [esp + 0x28], edi
mov ebx, dword [esp + 0x24]
mov byte [esp + 0x1c], 5
test edi, edi
je 0x4f9116
test ebx, ebx
je 0x4f90ee
lea eax, [ebx + 4]
jmp 0x4f90f0
xor eax, eax
push 0xffffffffffffffff
lea ecx, [edi + 4]
mov dword [ecx + 0x14], 0xf
push 0
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.00404c20
mov dword [edi], vtable.wbs::StringBase_char_.0
jmp 0x4f9118
xor edi, edi
push 0x1c
mov byte [esp + 0x20], 4
mov dword [esi + 0x84], edi
call fcn.006f7558
mov edi, eax
add esp, 4
mov dword [esp + 0x28], edi
mov byte [esp + 0x1c], 6
test edi, edi
je 0x4f9173
test ebx, ebx
je 0x4f9145
add ebx, 4
jmp 0x4f9147
xor ebx, ebx
push 0xffffffffffffffff
lea ecx, [edi + 4]
mov dword [ecx + 0x14], 0xf
push 0
mov dword [ecx + 0x10], 0
push ebx
mov byte [ecx], 0
call fcn.00404c20
mov dword [edi], vtable.wbs::StringBase_char_.0
mov dword [esi + 0x88], edi
jmp 0x4f917d
mov dword [esi + 0x88], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 8
Function at 0x4f93a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x752dfc
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
call fcn.006f8a23
mov dword [edi], vtable.wbs::Exception.0
mov byte [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x2c], 0xf
mov dword [edi + 0x28], 0
mov byte [edi + 0x18], 0
mov dword [esp + 0x34], 0
mov dword [edi + 0x14], vtable.wbs::StringBase_char_.0
mov dword [edi + 0x48], 0xf
mov dword [edi + 0x44], 0
mov byte [edi + 0x34], 0
mov dword [edi + 0x30], vtable.wbs::StringBase_char_.0
mov dword [edi + 0x64], 0xf
mov dword [edi + 0x60], 0
mov byte [edi + 0x50], 0
mov dword [edi + 0x4c], vtable.wbs::StringBase_char_.0
mov dword [edi + 0x80], 0xf
mov dword [edi + 0x7c], 0
mov byte [edi + 0x6c], 0
mov dword [edi + 0x68], vtable.wbs::StringBase_char_.0
lea eax, [esp + 0x10]
mov byte [esp + 0x34], 4
push eax
mov dword [edi + 0x84], 0
mov dword [edi + 0x88], 0
call fcn.0051a0c0
add esp, 4
push eax
lea ecx, [edi + 0x68]
mov byte [esp + 0x38], 5
call fcn.004f59b0
cmp dword [esp + 0x28], 0x10
mov dword [esp + 0x10], vtable.wbs::StringBase_char_.0
jb 0x4f949f
push dword [esp + 0x14]
call fcn.006f75a9
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x2c
ret
Function at 0x4f9f30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x73f736
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [esp + 0x20]
lea ecx, [ebx + 0x14]
mov eax, dword [edi + 0x10]
mov dword [ebx + 0x10], eax
lea eax, [edi + 0x14]
push eax
call fcn.004f59b0
lea eax, [edi + 0x30]
push eax
lea ecx, [ebx + 0x30]
call fcn.004f59b0
lea eax, [edi + 0x4c]
push eax
lea ecx, [ebx + 0x4c]
call fcn.004f59b0
lea eax, [edi + 0x68]
push eax
lea ecx, [ebx + 0x68]
call fcn.004f59b0
mov al, byte [edi + 0xc]
mov byte [ebx + 0xc], al
test al, al
je 0x4fa05b
push 0x1c
call fcn.006f7558
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], 0
test esi, esi
je 0x4f9ff0
mov eax, dword [edi + 0x84]
test eax, eax
je 0x4f9fc8
add eax, 4
jmp 0x4f9fca
xor eax, eax
push 0xffffffffffffffff
lea ecx, [esi + 4]
mov dword [ecx + 0x14], 0xf
push 0
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.00404c20
mov dword [esi], vtable.wbs::StringBase_char_.0
jmp 0x4f9ff2
xor esi, esi
push 0x1c
mov dword [esp + 0x1c], 0xffffffff
mov dword [ebx + 0x84], esi
call fcn.006f7558
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], 1
test esi, esi
je 0x4fa053
mov eax, dword [edi + 0x88]
test eax, eax
je 0x4fa02b
add eax, 4
jmp 0x4fa02d
xor eax, eax
push 0xffffffffffffffff
lea ecx, [esi + 4]
mov dword [ecx + 0x14], 0xf
push 0
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.00404c20
mov dword [esi], vtable.wbs::StringBase_char_.0
jmp 0x4fa055
xor esi, esi
mov dword [ebx + 0x88], esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4

Function at 0x4fa640
Capabilities:
Create thread

Disassembly:
push esi
push 8
mov esi, ecx
call fcn.006f7558
mov edx, dword [esp + 0xc]
mov dword [eax], esi
mov dword [eax + 4], edx
mov ecx, dword [esi + 4]
add ecx, 4
push ecx
push 0
push eax
push 0x4fa5d0
push 0
push 0
call fcn.007025b3
mov ecx, dword [esi + 4]
add esp, 0x1c
mov dword [ecx], eax
mov eax, dword [esi + 4]
cmp dword [eax], 0
jne 0x4fa681
mov dword [eax], 0xffffffff
mov eax, dword [esi + 4]
pop esi
test eax, eax
je 0x4fa69f
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x4fa69f
test ecx, ecx
je 0x4fa69f
cmp dword [eax + 4], 0
je 0x4fa69f
mov al, 1
ret 8
xor al, al
ret 8
Function at 0x4fbe00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x753177
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [edi], vtable.wbs::ProfilingImpl.0
mov esi, dword [edi + 0x74]
mov dword [esp + 0x18], 4
cmp esi, dword [edi + 0x78]
je 0x4fbe54
nop
mov ecx, dword [esi]
test ecx, ecx
je 0x4fbe4c
mov eax, dword [ecx]
push 1
call dword [eax]
add esi, 4
cmp esi, dword [edi + 0x78]
jne 0x4fbe40
mov eax, dword [edi + 0x74]
mov dword [edi + 0x78], eax
test eax, eax
je 0x4fbe7c
push eax
call fcn.006f75a9
add esp, 4
mov dword [edi + 0x74], 0
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0
mov dword [edi + 0x58], vtable.wbs::StringBase_char_.0
cmp dword [edi + 0x70], 0x10
jb 0x4fbe94
push dword [edi + 0x5c]
call fcn.006f75a9
add esp, 4
mov dword [edi + 0x70], 0xf
mov dword [edi + 0x6c], 0
mov byte [edi + 0x5c], 0
mov dword [edi + 0x3c], vtable.wbs::StringBase_char_.0
cmp dword [edi + 0x54], 0x10
jb 0x4fbebe
push dword [edi + 0x40]
call fcn.006f75a9
add esp, 4
mov dword [edi + 0x54], 0xf
mov dword [edi + 0x50], 0
mov byte [edi + 0x40], 0
mov dword [edi + 0x20], vtable.wbs::StringBase_char_.0
cmp dword [edi + 0x38], 0x10
jb 0x4fbee8
push dword [edi + 0x24]
call fcn.006f75a9
add esp, 4
mov dword [edi + 0x38], 0xf
lea ecx, [edi + 4]
mov dword [edi + 0x34], 0
mov byte [edi + 0x24], 0
mov dword [esp + 0x18], 0xffffffff
call fcn.0061b700
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x4fbf20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov dword [esi + 0xa0], vtable.wbs::StringBase_char_.0
cmp dword [esi + 0xb8], 0x10
jb 0x4fbf44
push dword [esi + 0xa4]
call fcn.006f75a9
add esp, 4
mov dword [esi + 0xb8], 0xf
mov dword [esi + 0xb4], 0
mov byte [esi + 0xa4], 0
mov dword [esi + 0x84], vtable.wbs::StringBase_char_.0
cmp dword [esi + 0x9c], 0x10
jb 0x4fbf80
push dword [esi + 0x88]
call fcn.006f75a9
add esp, 4
mov dword [esi + 0x9c], 0xf
mov ecx, esi
mov dword [esi + 0x98], 0
mov byte [esi + 0x88], 0
pop esi
jmp fcn.004fbe00

Function at 0x4ff070
Capabilities:
Read .ini file

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x1c], 0x10
lea edx, [esi + 8]
jb 0x4ff07e
mov edx, dword [edx]
mov ecx, dword [esp + 8]
add ecx, 4
cmp dword [ecx + 0x14], 0x10
jb 0x4ff08d
mov ecx, dword [ecx]
cmp dword [esi + 0x9c], 0x10
lea eax, [esi + 0x88]
pop esi
jb 0x4ff09f
mov eax, dword [eax]
push edx
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
xor edx, edx
ret 4

Function at 0x4ff1d0
Capabilities:
Read .ini file

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x1c], 0x10
lea edx, [esi + 8]
jb 0x4ff1de
mov edx, dword [edx]
mov ecx, dword [esp + 8]
add ecx, 4
cmp dword [ecx + 0x14], 0x10
jb 0x4ff1ed
mov ecx, dword [ecx]
cmp dword [esi + 0x9c], 0x10
lea eax, [esi + 0x88]
pop esi
jb 0x4ff1ff
mov eax, dword [eax]
push edx
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
ret 4
Function at 0x500270
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x7551b8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x38]
lea ecx, [esp + 0xc]
push edi
call fcn.00503e70
lea eax, [esp + 0xc]
mov dword [esp + 0x30], 0
push eax
lea ecx, [esi + 0x18]
call fcn.00503f80
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.0061b700
cmp dword [esi + 8], 0
jne 0x50032c
cmp dword [esi + 4], 0
jne 0x50032c
push dword [esi + 0xc]
mov dword [esi + 0x10], 2
call fcn.00501ba0
add esp, 4
mov dword [esi + 8], eax
mov ecx, eax
mov edx, dword [eax]
push 2
call dword [edx + 0x78]
mov eax, dword [esi + 0xc]
cmp eax, 2
jl 0x50032c
cmp eax, 3
jle 0x500307
cmp eax, 6
jne 0x50032c
mov eax, dword [esi + 0x10]
dec eax
je 0x500318
dec eax
je 0x500322
dec eax
jne 0x50032c
mov ecx, dword [esi + 4]
jmp 0x500325
mov ecx, dword [esi + 4]
push 2
mov eax, dword [ecx]
call dword [eax + 0x78]
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
push 2
call dword [eax + 0x78]
mov eax, dword [esi + 0x10]
dec eax
je 0x50033d
dec eax
je 0x500349
dec eax
jne 0x500355
mov ecx, dword [esi + 4]
jmp 0x50034c
mov ecx, dword [esi + 4]
push edi
mov eax, dword [ecx]
call dword [eax + 0x90]
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
push edi
call dword [eax + 0x90]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret 4
Function at 0x504200
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x753c86
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
mov eax, dword [0x81f390]
xor eax, esp
mov dword [esp + 0xb8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x81f390]
xor eax, esp
push eax
lea eax, [esp + 0xd0]
mov dword fs:[0], eax
mov eax, ecx
mov dword [esp + 0x14], eax
cmp dword [eax + 0x18], 0x10
lea edi, [eax + 4]
jb 0x50424e
mov ecx, dword [edi]
jmp 0x504250
mov ecx, edi
mov eax, dword [edi + 0x10]
add eax, ecx
cmp dword [edi + 0x14], 0x10
jb 0x50425f
mov ecx, dword [edi]
jmp 0x504261
mov ecx, edi
mov esi, eax
xor ebx, ebx
sub esi, ecx
xor ebp, ebp
xor edx, edx
cmp ecx, eax
cmova esi, ebx
test esi, esi
je 0x5043b3
cmp byte [ecx], 0x25
jne 0x50427e
inc ebp
inc edx
inc ecx
cmp edx, esi
jne 0x504278
mov dword [esp + 0x18], ebp
cmp ebp, 2
jb 0x5043b3
mov eax, dword [esp + 0x14]
mov ebx, ebp
shl ebx, 4
sub ebx, ebp
add ebx, dword [eax + 0x14]
xor esi, esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0xd8], esi
lea esp, [esp]
push ebx
mov dword [esp + 0x24], ebx
call fcn.006f2a95
mov ebp, eax
add esp, 4
cmp ebp, esi
je 0x5042cc
push esi
call fcn.006f75a9
add esp, 4
cmp dword [edi + 0x14], 0x10
mov esi, ebp
mov dword [esp + 0x1c], esi
jb 0x5042dc
mov eax, dword [edi]
jmp 0x5042de
mov eax, edi
push ebx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov ebx, eax
test ebx, ebx
je 0x50437e
cmp ebx, dword [esp + 0x20]
ja 0x5042b0
push ebp
lea ecx, [esp + 0x28]
call fcn.00503eb0
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0xdc], 1
call fcn.004f59b0
cmp dword [esp + 0x3c], 0x10
mov dword [esp + 0x24], vtable.wbs::StringBase_char_.0
jb 0x504332
push dword [esp + 0x28]
call fcn.006f75a9
add esp, 4
cmp dword [edi + 0x14], 0x10
jb 0x50433c
mov ecx, dword [edi]
jmp 0x50433e
mov ecx, edi
mov eax, dword [edi + 0x10]
add eax, ecx
cmp dword [edi + 0x14], 0x10
jb 0x50434b
mov edi, dword [edi]
mov edx, eax
xor ebx, ebx
sub edx, edi
xor esi, esi
xor ecx, ecx
cmp edi, eax
cmova edx, ebx
test edx, edx
je 0x50436c
mov edi, edi
cmp byte [edi], 0x25
jne 0x504366
inc esi
inc ecx
inc edi
cmp ecx, edx
jne 0x504360
push ebp
call fcn.006f75a9
add esp, 4
cmp dword [esp + 0x18], esi
setne al
jmp 0x5043b5
call fcn.004f68c0
push eax
call fcn.004f68c0
push eax
call fcn.004f68c0
push eax
call fcn.004f68c0
push eax
push 0x3e8
lea ecx, [esp + 0x54]
call fcn.004f91a0
push 0x7c24a4
lea eax, [esp + 0x44]
push eax
call fcn.006f7cb3
xor al, al
mov ecx, dword [esp + 0xd0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xb8]
xor ecx, esp
call fcn.006f7ca4
add esp, 0xc8
ret

Function at 0x505050
Capabilities:
Check if file exists
Get file attributes

Disassembly:
add ecx, 4
cmp dword [ecx + 0x14], 0x10
jb 0x50505b
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x50506e
test al, 0x10
je 0x50506e
mov al, 1
ret
xor al, al
ret
Function at 0x505080
Capabilities:
Check if file exists
Get file attributes

Disassembly:
add ecx, 4
cmp dword [ecx + 0x14], 0x10
jb 0x50508b
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x50509e
test al, 0x10
jne 0x50509e
mov al, 1
ret
xor al, al
ret