joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4da1c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x59d7b9
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x6336a0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
call fcn.00555692
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4da200
push 0x80004005
call fcn.00401f90
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi], eax
lea edi, [esi + 8]
mov ecx, edi
mov dword [esp + 0x14], 0
call fcn.0055d17f
mov dword [edi], vtable.CStringArrayEx.0
lea edi, [esi + 0x1c]
mov ecx, edi
mov byte [esp + 0x14], 1
call fcn.0055d17f
mov dword [edi], vtable.CStringArrayEx.0
lea edi, [esi + 0x30]
mov ecx, edi
mov byte [esp + 0x14], 2
call fcn.0055d17f
mov dword [edi], vtable.CStringArrayEx.0
lea edi, [esi + 0x44]
mov ecx, edi
mov byte [esp + 0x14], 3
call fcn.0055d17f
mov dword [edi], vtable.CStringArrayEx.0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x4e08c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x408]
sub esp, 0x408
push 0xffffffffffffffff
push 0x59d730
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x6336a0]
xor eax, ebp
mov dword [ebp + 0x404], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x414]
mov esi, ecx
mov ebx, edx
mov dword [ebp - 0x14], eax
call dword [0x634aa0]
xor eax, eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 0x410]
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
mov dword [ebp], eax
push 2
push eax
push esi
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
mov dword [ebp - 0x20], edi
jne 0x4e0949
call fcn.004e0510
mov esi, eax
jmp 0x4e0a30
mov edx, dword [ebp - 0x14]
push edx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x4e0965
call fcn.004e0510
jmp 0x4e0a27
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 0x18], eax
jne 0x4e097e
call fcn.004e0510
jmp 0x4e0a27
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
lea eax, [ebx + 1]
cmp eax, ebx
mov dword [ebp - 0x14], ebx
jae 0x4e09b4
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x4e09a2
lea eax, [ebp]
call fcn.004e0a70
lea ecx, [ebp - 0x1c]
call fcn.0048cf30
mov eax, 0x8007000e
jmp 0x4e0a42
lea esi, [ebp]
mov byte [ebp - 4], 2
call fcn.004e0a80
mov dword [ebp - 4], 1
jmp 0x4e09dd
mov esi, dword [ebp]
test esi, esi
jne 0x4e09eb
mov esi, 0x8007000e
jmp 0x4e0a29
call dword [0x634aa0]
mov ecx, dword [ebp - 0x18]
push ebx
push esi
push ebx
push ecx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x4e0a0c
call fcn.004e0510
jmp 0x4e0a27
mov edx, dword [ebp]
mov word [edx + eax*2], 0
mov eax, dword [ebp + 0x418]
mov ecx, dword [ebp]
push eax
lea edx, [ebp - 0x28]
call fcn.004e0ac0
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp + 4]
cmp dword [ebp], ecx
je 0x4e0a40
lea eax, [ebp]
call fcn.004e0a70
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x404]
xor ecx, ebp
call fcn.00577139
add ebp, 0x408
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4e1cf0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
jne 0x4e1d03
push 0x80004005
call fcn.00401f90
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
xor edi, edi
mov esi, ebp
push esi
call ebx
add eax, 1
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x4e1d10
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x4e1e70
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x224
mov eax, dword [0x6336a0]
xor eax, esp
mov dword [esp + 0x220], eax
push ebp
push esi
push edi
mov edi, dword [esp + 0x234]
mov ebp, ecx
mov eax, dword [ebp]
lea ecx, [esp + 0x18]
push ecx
push 0x2001f
push 0
push edi
push eax
mov dword [esp + 0x30], edi
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [esp + 0x10]
mov esi, eax
test esi, esi
jne 0x4e1ede
test ecx, ecx
je 0x4e1ed0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov ecx, dword [esp + 0x18]
mov esi, eax
mov dword [esp + 0x10], ecx
je 0x4e1eec
test ecx, ecx
je 0x4e1f91
push ecx
jmp 0x4e1f8b
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea edx, [esp + 0x20]
push edx
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
lea edx, [esp + 0x3c]
push edx
push 0
push ecx
mov dword [esp + 0x34], 0x100
call esi
test eax, eax
jne 0x4e1f5e
jmp 0x4e1f20
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x14]
call fcn.004e1e70
mov edi, eax
test edi, edi
jne 0x4e1fad
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
push eax
push eax
push eax
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x3c]
push eax
push edi
push ecx
mov dword [esp + 0x34], 0x100
call esi
test eax, eax
je 0x4e1f20
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4e1f75
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], 0
mov edx, dword [ebp]
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4e1f91
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00577139
add esp, 0x224
ret 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4e1fbc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x4e1f93
Function at 0x4e4160
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x59d679
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x6336a0]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
lea ecx, [esi + 0x44]
mov dword [esp + 0x10], 3
call fcn.0055d21d
lea ecx, [esi + 0x30]
mov byte [esp + 0x10], 2
call fcn.0055d21d
lea ecx, [esi + 0x1c]
mov byte [esp + 0x10], 1
call fcn.0055d21d
lea ecx, [esi + 8]
mov byte [esp + 0x10], 0
call fcn.0055d21d
mov dword [esp + 0x10], 0xffffffff
mov esi, dword [esi]
sub esi, 0x10
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4e41e2
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 4
Function at 0x4e7530
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a29d0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebp
push esi
push edi
mov eax, dword [0x6336a0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x44]
mov eax, dword [0x63c5b0]
push eax
push 1
push 0
lea ecx, [esp + 0x1c]
call fcn.0055b9c1
lea ecx, [esp + 0x10]
push ecx
mov ecx, ebp
mov dword [esp + 0x3c], 0
call fcn.0055b905
mov esi, eax
mov eax, dword [ebx + 0xc]
sub eax, dword [ebx + 4]
mov ecx, ebp
cdq
sub eax, edx
sar eax, 1
push eax
push 0
lea edx, [esp + 0x20]
push edx
call fcn.0055b26f
mov eax, dword [ebx + 0xc]
sub eax, dword [ebx + 4]
mov ecx, ebp
cdq
sub eax, edx
sar eax, 1
push eax
mov eax, dword [ebx + 8]
push eax
call fcn.0055af51
push esi
mov ecx, ebp
call fcn.0055b905
mov eax, dword [esp + 0x40]
mov esi, dword [eax + 0x178]
sub esi, dword [eax + 0x6c]
call fcn.00555692
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4e75e3
push 0x80004005
call fcn.00401f90
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x44], eax
mov eax, 0x45e7b273
imul esi
sar edx, 0xe
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, ecx
imul eax, eax, 0xea60
mov edx, esi
sub edx, eax
mov eax, 0x10624dd3
imul edx
sar edx, 6
mov edi, edx
shr edi, 0x1f
add edi, edx
mov edx, ecx
shl edx, 4
sub edx, ecx
lea eax, [edi + edx*4]
imul eax, eax, 0x3e8
sub esi, eax
mov eax, 0x66666667
imul esi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push edi
push ecx
lea ecx, [esp + 0x50]
push 0x5fd368
push ecx
mov byte [esp + 0x4c], 1
call fcn.00404650
mov edx, dword [esp + 0x54]
mov esi, dword [edx + 0x128]
mov edi, dword [ebx + 8]
mov eax, 0xaaaaaaab
mul esi
mov eax, dword [ebx + 0xc]
sub eax, dword [ebx + 4]
mov ecx, edx
cdq
sub eax, edx
shr ecx, 2
sar eax, 1
add eax, ecx
sub edi, ecx
mov ecx, dword [0x63c5b0]
add esi, eax
add esp, 0x14
mov dword [esp + 0x24], eax
mov eax, dword [ebp]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, ebp
mov dword [esp + 0x24], 0
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], edi
call edx
mov esi, dword [esp + 0x44]
mov eax, dword [esi - 0xc]
mov edx, dword [ebp]
mov edx, dword [edx + 0x68]
push 0x22
lea ecx, [esp + 0x24]
push ecx
push eax
push esi
mov ecx, ebp
call edx
mov byte [esp + 0x38], 0
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4e76e8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], vtable.CGdiObject.0
call fcn.0055b880
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x2c
ret 8
Function at 0x4e79f0
Capabilities:
Capture screenshot

Disassembly:
push 0xffffffffffffffff
push 0x5a7d82
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
mov eax, dword [0x6336a0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [edi + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call fcn.0055b558
xor esi, esi
mov ebp, eax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], vtable.CBitmap.0
mov dword [esp + 0x38], esi
mov eax, dword [edi + 0x150]
mov ecx, dword [edi + 0x14c]
push eax
push ecx
mov ecx, dword [ebp + 4]
push ecx
mov ebx, ebp
mov dword [esp + 0x1c], esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
lea ecx, [esp + 0x1c]
call fcn.0055b82d
test eax, eax
je 0x4e7af4
push 0x10
call fcn.0055514b
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, esi
mov byte [esp + 0x38], 1
je 0x4e7a8a
mov ecx, eax
call fcn.0055b050
mov esi, eax
mov byte [esp + 0x38], 0
mov eax, dword [ebp + 4]
push eax
mov dword [esp + 0x18], esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
mov ecx, esi
call fcn.0055b566
test eax, eax
je 0x4e7adc
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4e7abc
mov edx, dword [esi + 4]
push eax
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [0x63c5b4]
push eax
lea ecx, [edi + 0x144]
push ecx
mov ecx, esi
mov ebx, esi
mov dword [esp + 0x18], 1
call fcn.0055ba58
jmp 0x4e7af4
test esi, esi
je 0x4e7aeb
mov edx, dword [esi]
mov eax, dword [edx + 4]
push 1
mov ecx, esi
call eax
lea ecx, [esp + 0x18]
call fcn.0055b880
mov eax, edi
call fcn.004e70f0
lea ecx, [esp + 0x20]
push ecx
push 0
push eax
mov dword [edi + 0x178], eax
push ebx
mov eax, edi
call fcn.004e67b0
cmp dword [esp + 0x10], 0
je 0x4e7b67
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov esi, dword [esp + 0x20]
mov ebx, dword [esp + 0x14]
sub eax, edx
sub ecx, esi
test ebx, ebx
je 0x4e7b37
mov ebx, dword [ebx + 4]
push 0xcc0020
push edx
push esi
push ebx
push eax
push ecx
push edx
mov edx, dword [ebp + 4]
push esi
push edx
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x4e7b5e
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push 1
call edx
lea ecx, [esp + 0x18]
call fcn.0055b880
mov eax, dword [ebp + 4]
mov ecx, dword [edi + 0x20]
push eax
push ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], vtable.CGdiObject.0
call fcn.0055b880
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
Function at 0x4eb3b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a28f8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x6336a0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, edi
call fcn.00402180
lea ecx, [esp + 0xc]
call fcn.00566008
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0
call fcn.00576d2e
mov ecx, esi
call fcn.004eb200
test eax, eax
je 0x4eb413
lea ecx, [esp + 0xc]
push ecx
push eax
mov ecx, esi
call fcn.004eb5b0
mov ecx, dword [esp + 0x14]
xor esi, esi
test ecx, ecx
jle 0x4eb469
lea ecx, [ecx]
mov edx, dword [edi]
cmp dword [edx - 0xc], 0
jne 0x4eb447
test esi, esi
jl 0x4eb48b
cmp esi, ecx
jge 0x4eb48b
mov eax, dword [esp + 0x10]
mov eax, dword [eax + esi*4]
test eax, eax
je 0x4eb447
push ebx
push edi
push eax
call fcn.004ebdd0
mov ecx, dword [esp + 0x14]
test esi, esi
jl 0x4eb48b
cmp esi, ecx
jge 0x4eb48b
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + esi*4]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov ecx, dword [esp + 0x14]
add esi, 1
cmp esi, ecx
jl 0x4eb420
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.0056601f
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret
jmp fcn.00555520

Function at 0x4eb490
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a28f8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x6336a0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0xb8]
push eax
push 0x5fdb94
push edi
call fcn.00404650
add esp, 0xc
lea ecx, [esp + 0xc]
call fcn.00566008
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0
call fcn.00576d2e
mov ecx, esi
call fcn.004eb200
test eax, eax
je 0x4eb501
lea ecx, [esp + 0xc]
push ecx
push eax
mov ecx, esi
call fcn.004eb5b0
mov eax, dword [esp + 0x14]
xor esi, esi
test eax, eax
jle 0x4eb558
jmp 0x4eb510
test esi, esi
jl 0x4eb57a
cmp esi, eax
jge 0x4eb57a
mov edx, dword [esp + 0x10]
mov eax, dword [edx + esi*4]
test eax, eax
je 0x4eb52a
push edi
push eax
call fcn.004eb6e0
push 4
push str._r_n_r_n
mov ecx, edi
call fcn.004044f0
cmp esi, dword [esp + 0x14]
jge 0x4eb57a
mov eax, dword [esp + 0x10]
mov eax, dword [eax + esi*4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x14]
add esi, 1
cmp esi, eax
jl 0x4eb510
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.0056601f
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret
jmp fcn.00555520
Function at 0x4f0670
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5a28f8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x6336a0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0xc]
call fcn.00566008
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0
call fcn.00576d2e
mov ecx, esi
call fcn.004eb200
test eax, eax
je 0x4f06cc
lea ecx, [esp + 0xc]
push ecx
push eax
mov ecx, esi
call fcn.004eb5b0
mov eax, dword [esp + 0x14]
xor esi, esi
test eax, eax
jle 0x4f0723
test esi, esi
jl 0x4f0774
cmp esi, eax
jge 0x4f0774
mov edx, dword [esp + 0x10]
mov eax, dword [edx + esi*4]
push edi
push str.D27CDB6E_AE6D_11CF_96B8_444553540000
push eax
call fcn.004efe70
add esp, 0xc
cmp esi, dword [esp + 0x14]
jge 0x4f0774
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + esi*4]
push edi
push 0x5dd328
push edx
call fcn.004f0100
mov eax, dword [esp + 0x20]
add esi, 1
add esp, 0xc
cmp esi, eax
jl 0x4f06d6
xor esi, esi
test eax, eax
jle 0x4f0752
lea esp, [esp]
test esi, esi
jl 0x4f0774
cmp esi, eax
jge 0x4f0774
mov eax, dword [esp + 0x10]
mov eax, dword [eax + esi*4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x14]
add esi, 1
cmp esi, eax
jl 0x4f0730
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.0056601f
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x24
ret
jmp fcn.00555520
Function at 0x4f6930
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x5a6728
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebp
push esi
push edi
mov eax, dword [0x6336a0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
call fcn.00555692
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4f6970
push 0x80004005
call fcn.00401f90
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x28], 0
call fcn.00555692
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4f69a2
push 0x80004005
call fcn.00401f90
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebp, [eax + 0x10]
mov dword [esp + 0x1c], ebp
mov byte [esp + 0x28], 1
mov ecx, dword [0x63c1d0]
push 0
push ecx
xor ecx, ecx
lea edi, [esp + 0x1c]
xor esi, esi
call fcn.0044b470
mov edx, dword [0x63c1d0]
mov edi, dword [esp + 0x1c]
mov eax, dword [0x63c1cc]
push edx
push edi
push eax
call fcn.0044f7c0
add esp, 0x14
test eax, eax
je 0x4f6a7c
push 0x63c65c
mov ecx, 0x63c1d8
call fcn.00402330
mov ecx, 0x63c268
call fcn.00411f50
mov ecx, dword [0x63c1d0]
push 5
push esi
push esi
push ecx
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [ebp - 0x10]
mov byte [esp + 0x28], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4f6a40
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
mov dword [esp + 0x28], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4f6a64
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x1c
ret
call fcn.00555692
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4f6a96
push 0x80004005
call fcn.00401f90
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov byte [esp + 0x28], 2
mov ecx, dword [0x63c670]
push ecx
lea edx, [esp + 0x1c]
push 0x5fe8e8
push edx
call fcn.00404650
mov esi, dword [esp + 0x24]
add esp, 0xc
push 0
push 0
push esi
call fcn.0055e834
lea eax, [esi - 0x10]
mov byte [esp + 0x28], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4f6af3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebp - 0x10]
mov byte [esp + 0x28], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4f6b14
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
mov dword [esp + 0x28], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4f6b38
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x1c
ret
Function at 0x4f8f70
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x2c
test eax, eax
push ebx
push esi
push edi
mov ebx, ecx
je 0x4f8fd9
push 0
push 0
push 3
push 0
push 1
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0
lea ecx, [esp + 0x18]
push ecx
push ebx
push eax
push edi
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4f9001
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, dword [esp + 0x3c]
push ebx
push edx
push eax
call fcn.0057b7b0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [esp + 0x10]
push eax
push 1
push esi
mov dword [esp + 0x1c], 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
push 0x5d2080
push 0
push ebx
push edx
call dword [sym.imp.OLEAUT32.dll_OleCreatePictureIndirect]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4f9095
mov ecx, dword [eax]
lea edx, [esp + 0x1c]
push edx
push eax
mov eax, dword [ecx + 0xc]
call eax
mov esi, dword [esp + 0x40]
mov ecx, esi
call fcn.0055b880
mov ecx, dword [esp + 0x1c]
push ecx
mov ecx, esi
call fcn.0055b82d
mov eax, dword [esi + 4]
lea edx, [esp + 0x20]
push edx
push 0x18
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x2c
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x2c
ret