joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46c120
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x14
xor eax, eax
lea ecx, [esp]
mov dword [esp + 8], eax
push ecx
mov dword [esp + 0x10], eax
push 0x28
mov dword [esp + 0xc], 0
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea edx, [esp + 8]
push edx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov ecx, dword [esp]
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
push ecx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov edx, dword [esp]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x14
ret

Function at 0x46cda0
Capabilities:
Create process on windows
Set environment variable

Disassembly:
push 0xffffffffffffffff
push 0x521d7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf4
push ebx
xor eax, eax
push esi
mov edx, ecx
push edi
mov ecx, 0x11
lea edi, [esp + 0x2c]
rep stosd dword es:[edi], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], eax
cmp dword [edx + 0x130], 0x10
mov dword [esp + 0x2c], 0x44
mov dword [esp + 0x20], 0xc
mov dword [esp + 0x28], 1
jb 0x46ce0a
mov eax, dword [edx + 0x11c]
jmp 0x46ce10
lea eax, [edx + 0x11c]
push eax
push str.VERSIONSDATPATH
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
lea ecx, [esp + 0x1c]
push 0
push ecx
call fcn.0043be5c
mov eax, dword [eax]
mov esi, dword [esp + 0x120]
mov edi, dword [esp + 0x118]
add esp, 8
lea edx, [esp + 0xc]
push edx
lea ecx, [esp + 0x30]
push ecx
push eax
push 0
push 0
push 1
lea edx, [esp + 0x38]
push edx
mov eax, edx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ebx, eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x46ce7c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
test ebx, ebx
jne 0x46cf24
push 2
push 0x82
push str..LiveUpdateProxy.cpp
lea ecx, [esp + 0x7c]
call fcn.0044a748
mov ebx, eax
mov dword [esp + 0x108], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._lastError:
push esi
push str._cmd:
push edi
push 0x535710
add ebx, 4
push ebx
call fcn.004063dd
add esp, 8
push eax
call fcn.004063dd
add esp, 8
push eax
call fcn.004063dd
add esp, 8
push eax
call fcn.004063dd
add esp, 8
push eax
call fcn.004063dd
add esp, 8
mov ecx, eax
call fcn.0044a275
lea ecx, [esp + 0x70]
mov dword [esp + 0x108], 0xffffffff
call fcn.0044a78a
mov edx, dword [esp + 0x114]
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ecx
mov eax, ecx
mov dword [esp + 0x18], ecx
mov dword [edx], eax
jmp 0x46cf31
mov eax, dword [esp + 0x114]
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
mov ecx, dword [esp + 0x100]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x100
ret 0xc
Function at 0x46ff30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x420
mov eax, dword [0x561be8]
xor eax, esp
push esi
mov esi, ecx
mov dword [esp + 0x420], eax
mov eax, dword [esi + 0x30]
push edi
mov edi, dword [esi + 0x2c]
cmp edi, eax
je 0x46ffb9
jmp 0x46ff60
mov dword [esp + 0x14], 0x410
mov dword [esp + 0x18], 0x3211
mov eax, dword [edi + 4]
push 0x400
push eax
lea ecx, [esp + 0x24]
push ecx
call fcn.004a4320
mov edx, dword [edi + 8]
mov ecx, dword [esi + 0x80]
mov dword [esp + 0x428], edx
mov eax, dword [edi + 0xc]
add esp, 0xc
mov dword [esp + 0x420], eax
mov edx, dword [ecx]
push 0x410
lea eax, [esp + 0x18]
push eax
call dword [edx + 0x14]
mov eax, dword [esi + 0x30]
add edi, 0x10
cmp edi, eax
jne 0x46ff60
mov ecx, dword [esi + 0x6c]
mov dword [esp + 0x10], ecx
mov ecx, dword [esi + 0x80]
push 0xc
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0xc
mov dword [esp + 0x10], 0x3218
mov edx, dword [ecx]
push eax
call dword [edx + 0x14]
mov eax, dword [esi + 0x88]
test eax, eax
mov ecx, dword [esp + 0x42c]
mov dword [esi + 0x3c], ecx
mov dword [esi + 0x84], 1
je 0x470024
cmp dword [esi + 0x5c], 0x10
jb 0x47000b
mov eax, dword [esi + 0x48]
jmp 0x47000e
lea eax, [esi + 0x48]
mov edx, dword [esi + 0x60]
mov ecx, dword [esi + 0x68]
push edx
mov edx, dword [esi + 0x64]
push ecx
push eax
push edx
mov ecx, esi
call fcn.0046c7f0
jmp 0x470073
mov eax, dword [esi + 0x78]
test eax, eax
je 0x470073
jmp 0x470030
mov eax, dword [esi + 0x74]
mov ecx, dword [eax]
mov eax, dword [ecx + 8]
test eax, eax
je 0x470044
push eax
mov ecx, esi
call fcn.0046fe10
mov ecx, dword [esi + 0x74]
mov eax, dword [ecx]
cmp eax, ecx
je 0x47006c
mov edx, dword [eax + 4]
mov ecx, dword [eax]
mov dword [edx], ecx
mov edx, dword [eax]
mov ecx, dword [eax + 4]
push eax
mov dword [edx + 4], ecx
call fcn.00507ed8
mov eax, dword [esi + 0x78]
add esp, 4
dec eax
mov dword [esi + 0x78], eax
mov eax, dword [esi + 0x78]
test eax, eax
jne 0x470030
mov ecx, dword [esp + 0x424]
pop edi
pop esi
xor ecx, esp
call fcn.004a2d97
add esp, 0x420
ret 4
Function at 0x470650
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x52223d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esi + 4], 0x535640
xor ebx, ebx
mov dword [esi + 8], ebx
lea edi, [esi + 0xc]
mov ecx, edi
mov dword [esp + 0x10], esi
mov dword [esi], 0x5358c0
mov dword [esi + 4], 0x535858
call fcn.0046c4f0
mov dword [edi + 4], eax
mov byte [eax + 0x2d], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebx
lea ecx, [esi + 0x18]
mov dword [esp + 0x1c], ebx
call fcn.004745a0
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], 1
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov ebp, 0xf
mov dword [esi + 0x5c], ebp
mov dword [esi + 0x58], ebx
mov byte [esi + 0x48], bl
lea edi, [esi + 0x70]
mov ecx, edi
mov byte [esp + 0x1c], 3
mov dword [esi + 0x60], ebx
mov dword [esi + 0x6c], ebx
call fcn.004dc620
mov dword [edi + 4], eax
mov dword [edi + 8], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0xa4], ebp
mov dword [esi + 0xa0], ebx
mov byte [esi + 0x90], bl
mov dword [esi + 0xc0], ebp
mov dword [esi + 0xbc], ebx
mov byte [esi + 0xac], bl
mov dword [esi + 0xdc], ebp
mov dword [esi + 0xd8], ebx
mov byte [esi + 0xc8], bl
mov dword [esi + 0xf8], ebp
mov dword [esi + 0xf4], ebx
mov byte [esi + 0xe4], bl
mov dword [esi + 0x114], ebp
mov dword [esi + 0x110], ebx
mov byte [esi + 0x100], bl
lea ecx, [esi + 0x118]
push 0x13
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push str.config_versions.dat
mov byte [esp + 0x24], 9
mov byte [ecx + 4], bl
call fcn.0040279a
mov ecx, dword [esp + 0x14]
pop edi
mov dword [esi + 0x134], ebx
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4733c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5225e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
mov eax, dword [0x561be8]
xor eax, esp
push ebx
mov dword [esp + 0x5c], eax
push esi
mov esi, dword [esp + 0x74]
xor ebx, ebx
mov eax, 0xf
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ebx
mov byte [esp + 0xc], bl
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
mov dword [esp + 0x58], eax
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
mov dword [esp + 0x5c], 3
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x80]
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x78], 1
call fcn.0040270b
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x9c]
push ecx
lea ecx, [esp + 0x30]
call fcn.0040270b
mov edx, dword [esp + 0x144]
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x150]
push eax
lea ecx, [esp + 0x4c]
mov dword [esp + 0x68], edx
call fcn.0040270b
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.004732c0
lea ecx, [esp + 8]
call fcn.0046cb00
lea ecx, [esp + 0x78]
call fcn.00472840
mov ecx, dword [esp + 0x64]
pop esi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x5c]
pop ebx
xor ecx, esp
call fcn.004a2d97
add esp, 0x68
ret 0x138

Function at 0x475440
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x3c]
test eax, eax
push edi
je 0x475496
mov eax, dword [esp + 0xc]
test eax, eax
mov dword [esi + 0x3c], 0
je 0x475506
mov eax, dword [esp + 0x10]
test eax, eax
je 0x475506
mov eax, dword [esi + 0x78]
test eax, eax
je 0x4754fc
lea edi, [esi + 0x68]
push ebx
mov ecx, edi
call fcn.00475350
mov ebx, dword [eax]
mov ecx, edi
call fcn.004cdd20
test ebx, ebx
je 0x475495
mov eax, dword [ebx]
push 1
mov ecx, ebx
call dword [eax]
pop ebx
mov eax, dword [esi + 0x78]
test eax, eax
je 0x4754fc
mov edi, dword [esi + 0x58]
cmp edi, 0xffffffff
je 0x47550c
mov ecx, dword [esi + 0x74]
mov eax, ecx
shr eax, 2
lea edx, [eax*4]
sub ecx, edx
mov edx, dword [esi + 0x70]
cmp edx, eax
ja 0x4754bf
sub eax, edx
mov edx, dword [esi + 0x6c]
mov eax, dword [edx + eax*4]
mov eax, dword [eax + ecx*4]
mov ecx, dword [eax + 4]
mov edx, dword [ecx]
mov eax, dword [eax + 8]
add eax, edx
lea edx, [esi + 0x24]
push edx
lea edx, [esp + 0x14]
push edx
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4754f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x47550c
mov dword [esi + 0x3c], 1
pop edi
mov eax, 1
pop esi
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
xor eax, eax
pop esi
ret 8
Function at 0x475760
Capabilities:
Read file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5228f8
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebp
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x20]
test eax, eax
je 0x4757a4
mov eax, dword [esp + 0x3c]
test eax, eax
mov dword [edi + 0x20], 0
je 0x47593f
mov eax, dword [esp + 0x40]
test eax, eax
jne 0x4757b0
jmp 0x47593f
mov eax, dword [esp + 0x40]
test eax, eax
je 0x4758c2
mov ecx, dword [edi + 0x2090]
test ecx, ecx
jne 0x4757c2
lea esi, [edi + 0x7c]
lea ebp, [esi + eax]
jmp 0x4757f9
mov edx, 0x10000000
sub edx, eax
cmp ecx, edx
ja 0x475910
push eax
lea eax, [edi + 0x7c]
lea esi, [edi + 0x207c]
push eax
mov ecx, esi
call fcn.00407620
cmp dword [esi + 0x18], 0x10
jb 0x4757ee
mov esi, dword [esi + 4]
jmp 0x4757f1
add esi, 4
mov ebp, dword [edi + 0x2090]
add ebp, esi
cmp esi, ebp
jae 0x4758ab
push ebx
push ebp
push esi
push 0x10
call fcn.00476d50
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x4758aa
sub eax, esi
push eax
push esi
lea ecx, [esp + 0x24]
call fcn.00476d00
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 4]
xor edx, edx
cmp ecx, 0xfffffffe
mov dword [esp + 0x38], edx
jne 0x475879
cmp word [eax + 8], 0xffff
jne 0x475879
cmp dword [edi + 0x64], edx
mov dword [edi + 0x20bc], 1
je 0x47588f
mov dword [esp + 0x18], edx
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x20]
push eax
mov dword [esp + 0x1c], ecx
call fcn.00476e40
mov eax, dword [esp + 0x40]
mov ecx, dword [edi + 0x64]
mov edx, dword [ecx]
push eax
push edi
call dword [edx + 4]
jmp 0x47588f
mov ecx, dword [edi + 0x64]
cmp ecx, edx
je 0x47588f
mov edx, dword [eax]
mov esi, dword [ecx]
push edx
mov edx, dword [esp + 0x28]
add edx, eax
push edx
push edi
call dword [esi]
lea ecx, [esp + 0x1c]
mov esi, ebx
mov dword [esp + 0x38], 0xffffffff
call fcn.00476d30
cmp ebx, ebp
jb 0x475802
pop ebx
sub ebp, esi
push ebp
push esi
lea ecx, [edi + 0x207c]
call fcn.0040279a
mov dword [esp + 0x40], 0
mov eax, dword [edi + 0x58]
cmp eax, 0xffffffff
je 0x47593f
lea ecx, [edi + 8]
push ecx
lea edx, [esp + 0x44]
push edx
push 0x2000
lea ecx, [edi + 0x7c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4758f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x47593f
mov eax, 1
mov dword [edi + 0x20], eax
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 8
lea ecx, [edi + 0x207c]
mov edi, dword [ecx + 0x18]
cmp edi, 0x10
lea edx, [ecx + 4]
jb 0x475925
mov esi, dword [edx]
jmp 0x475927
mov esi, edx
mov eax, dword [ecx + 0x14]
add eax, esi
cmp edi, 0x10
jb 0x475933
mov edx, dword [edx]
push eax
push edx
lea edx, [esp + 0x14]
push edx
call fcn.0044ab64
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
xor eax, eax
pop ebp
mov dword fs:[0], ecx
add esp, 0x2c
ret 8
Function at 0x475dc0
Capabilities:
Create pipe

Disassembly:
push 0xffffffffffffffff
push 0x522983
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [esp + 0x20]
push ebx
push esi
push edi
mov esi, ecx
push eax
lea ecx, [esp + 0x30]
push ecx
mov ecx, esi
call fcn.004756c0
mov eax, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x24], ebx
jne 0x475e5e
lea eax, [esp + 0x10]
push eax
push 0x1388
push 0x2000
push 0x2000
push 1
push ebx
xor edx, edx
mov dword [esp + 0x2c], edx
push 0x40080003
mov dword [esp + 0x34], edx
push edi
mov dword [esp + 0x38], ebx
mov dword [esp + 0x30], 0xc
mov dword [esp + 0x34], ebx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
cmp eax, 0xffffffff
mov dword [esi + 0x58], eax
jne 0x475e92
mov dword [esp + 0x24], eax
lea eax, [edi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x475f0d
push ebx
push 0x40110000
push 3
push ebx
push ebx
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 0x58], eax
jne 0x475e92
mov dword [esp + 0x24], eax
lea eax, [edi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x475f0d
push ebp
push 0x14
call fcn.00507ead
add esp, 4
mov dword [esp + 0x34], eax
cmp eax, ebx
mov byte [esp + 0x28], 1
je 0x475ebe
push 2
push 0xffff
push 0xfffffffffffffffe
mov ecx, eax
call fcn.00476dd0
mov ebp, eax
jmp 0x475ec0
xor ebp, ebp
mov ecx, ebp
mov byte [esp + 0x28], bl
mov dword [esp + 0x10], ebp
call fcn.00476d70
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0x34], eax
push 4
lea eax, [esp + 0x38]
push eax
mov ecx, ebp
call fcn.00476f20
test eax, eax
pop ebp
jne 0x475f2d
mov ecx, dword [esi + 0x58]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or ecx, 0xffffffff
lea eax, [edi - 0x10]
mov dword [esi + 0x58], ecx
mov dword [esp + 0x24], ecx
lea edx, [eax + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x475f17
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 8
lea eax, [esp + 0xc]
push eax
lea ecx, [esi + 0x68]
call fcn.00475ca0
lea eax, [edi - 0x10]
mov dword [esp + 0x24], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x475f5c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 8
Function at 0x485980
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x70]
test eax, eax
je 0x4859a1
mov ecx, dword [esp + 0xc]
mov dword [eax + 0x44], ecx
mov edx, dword [esi + 0x70]
push 1
add edx, 4
push edx
call fcn.004a826c
mov eax, dword [esp + 0xc]
mov ecx, dword [esi + 0x10]
mov byte [esi + 6], al
mov edx, dword [ecx + 0x58]
test edx, edx
je 0x4859c2
push eax
call fcn.00485900
mov edx, dword [esi + 0x10]
push esi
call dword [edx + 0x58]
add esp, 8
push 1
call fcn.004a822a
int3
Function at 0x48aff0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
mov eax, ebx
shr eax, 5
push ebp
push esi
mov esi, dword [esp + 0x14]
inc eax
cmp ebx, eax
push edi
mov edx, ebx
mov ecx, ebx
jb 0x48b02b
lea ebx, [ebx]
movzx edi, byte [esi + ecx - 1]
mov ebp, edx
shl ebp, 5
add edi, ebp
mov ebp, edx
shr ebp, 2
add edi, ebp
sub ecx, eax
xor edx, edi
cmp ecx, eax
jae 0x48b010
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 8]
mov eax, dword [eax]
dec ecx
and ecx, edx
mov eax, dword [eax + ecx*4]
test eax, eax
je 0x48b05b
cmp dword [eax + 0xc], ebx
jne 0x48b055
mov ecx, ebx
lea edi, [eax + 0x10]
xor ebp, ebp
repe cmpsb byte [esi], byte es:[edi]
je 0x48b06f
mov esi, dword [esp + 0x18]
mov eax, dword [eax]
test eax, eax
jne 0x48b041
mov eax, dword [esp + 0x14]
push edx
push esi
push eax
call fcn.0048af40
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
ret
mov cl, byte [eax + 5]
mov edx, dword [esp + 0x14]
mov edx, dword [edx + 0x10]
movzx edx, byte [edx + 0x14]
xor ebx, ebx
mov bl, cl
not edx
and ebx, 3
test bl, dl
je 0x48b06a
pop edi
pop esi
xor cl, 3
pop ebp
mov byte [eax + 5], cl
pop ebx
ret
Function at 0x4a023a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x4a028d
call fcn.00518db1
mov edi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x4a028d
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x4a0283
xor eax, eax
jmp 0x4a03a6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], 1
je 0x4a02bd
mov eax, dword [esi]
push edi
push dword [ebp - 4]
mov ecx, esi
push ebx
call dword [eax + 0x1c]
cmp dword [ebp - 8], 0
mov dword [ebp - 0xc], eax
je 0x4a02bd
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x4a03a3
mov ecx, dword [eax + 0x40]
and dword [ebp + 0xc], 0
test ecx, ecx
mov dword [ebp + 8], ecx
mov dword [ebp - 8], ecx
je 0x4a02ea
lea ecx, [eax + 0x3c]
lea eax, [ebp + 8]
push eax
call fcn.0049e7b7
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
xor eax, eax
cmp dword [edi + 8], eax
mov dword [ebp - 4], eax
jbe 0x4a03a3
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x4a0333
mov ecx, dword [ecx + 4]
mov edx, dword [edi + 0xc]
mov ecx, dword [ecx + 0x28]
cmp ecx, dword [edx + eax*8]
jne 0x4a0333
mov eax, dword [ebp + 8]
test eax, eax
mov dword [ebp - 8], eax
je 0x4a032d
mov ecx, dword [ebx + 0x48]
lea eax, [ebp + 8]
add ecx, 0x3c
push eax
call fcn.0049e7b7
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x4a0393
and dword [ebp + 0xc], 0
jmp 0x4a0393
mov ecx, dword [edi + 0xc]
shl eax, 3
cmp dword [eax + ecx], 0
mov dword [ebp - 0x10], eax
je 0x4a0393
push 0xc
call fcn.00507ead
mov esi, eax
test esi, esi
pop ecx
je 0x4a0375
mov eax, dword [edi + 0xc]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x1c]
add eax, edx
push dword [eax]
mov edi, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
and dword [esi + 4], 0
mov dword [esi + 8], edi
mov edi, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x4a0377
xor esi, esi
mov ecx, dword [ebx + 0x48]
add ecx, 0x3c
cmp dword [ebp - 8], 0
push esi
je 0x4a038e
push dword [ebp - 8]
call fcn.00507959
jmp 0x4a0393
call fcn.00507930
mov eax, dword [ebp - 4]
inc eax
cmp eax, dword [edi + 8]
mov dword [ebp - 4], eax
jb 0x4a02f8
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4a3421
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.004a3660
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4a34bc
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x569120]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x4a34bc
cmp eax, 1
je 0x4a34dd
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4a34bc
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x4a3489
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x4a34b8
xor eax, eax
inc eax
jmp 0x4a34fc
cmp edi, eax
jae 0x4a34c0
xor eax, eax
jmp 0x4a34fc
cmp eax, esi
jae 0x4a34c7
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x569120]
jmp 0x4a34e0
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4a5ec8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x4a5ee5
call fcn.004a2ce1
mov dword [eax], 0x16
xor eax, eax
jmp 0x4a5f4f
push esi
push 0x8c
push 1
call fcn.004a676a
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4a5f3a
push esi
call fcn.004ac8e7
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x4a5f18
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x4a5e33
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x4a5f4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.004a235d
test ebx, ebx
pop ecx
je 0x4a5f4c
push ebx
call fcn.004a2cf3
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret