joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4862f0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f1ce6
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x70
mov eax, dword [0x571180]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov eax, dword [ebx + 8]
push eax
mov dword [ebp - 0x20], edi
call fcn.00440d20
mov dword [ebp - 4], 0
lea eax, [edi + 0x20]
mov dword [edi + 0x18], 0
xor esi, esi
mov dword [edi + 0x1c], 0xa
mov dword [ebp - 0x18], eax
push 0x40
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.004c2b27
mov edi, eax
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword [edi], edi
mov dword [edi + 4], edi
mov dword [edi + 8], edi
mov word [edi + 0xc], 0x101
mov dword [eax], edi
mov byte [ebp - 4], 1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x80]
push 0xc
xorps xmm0, xmm0
mov dword [ebp - 0x70], esi
push str.Content_Type
movups xmmword [ebp - 0x80], xmm0
mov dword [ebp - 0x6c], esi
call fcn.00440f80
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x68]
push 0x18
xorps xmm0, xmm0
mov dword [ebp - 0x58], esi
push str.text_html__charsetutf_8
movups xmmword [ebp - 0x68], xmm0
mov dword [ebp - 0x54], esi
call fcn.00440f80
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x50]
push 6
xorps xmm0, xmm0
mov dword [ebp - 0x40], esi
push str.Accept
movups xmmword [ebp - 0x50], xmm0
mov dword [ebp - 0x3c], esi
call fcn.00440f80
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x38]
push 3
xorps xmm0, xmm0
mov dword [ebp - 0x28], esi
push 0x54ddc0
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x24], esi
call fcn.00440f80
mov byte [ebp - 4], 6
lea eax, [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x80]
push eax
push ecx
lea ecx, [esi + 0x28]
call fcn.00487410
push fcn.00479ca0
push 2
mov byte [ebp - 4], 8
lea eax, [ebp - 0x80]
push 0x30
push eax
call fcn.004c2cec
lea ecx, [esi + 0x30]
xorps xmm0, xmm0
push 0
movups xmmword [ecx], xmm0
push 0x534829
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00440f80
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004c2b19
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x486830
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f1dbb
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x571180]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
sub esp, 0x18
mov dword [ebp - 4], 0
lea eax, [ebp + 0xc]
mov ecx, esp
push eax
call fcn.00440d20
push dword [ebp + 8]
mov ecx, edi
call fcn.00486700
xorps xmm0, xmm0
movups xmmword [edi + 0x1c], xmm0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0xf
mov byte [edi + 0x1c], 0
movups xmmword [edi + 0x34], xmm0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0xf
mov byte [edi + 0x34], 0
lea esi, [edi + 0x4c]
mov byte [ebp - 4], 3
push 0x38
mov dword [ebp - 0x10], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004c2b27
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov ecx, dword [ebp + 0x20]
mov dword [esi], eax
cmp ecx, 0xf
jbe 0x48690e
mov edx, dword [ebp + 0xc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x486904
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x486923
push ecx
push edx
call fcn.004c2b57
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x1c
call fcn.004c869e
int3
Function at 0x48c840
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f2c0c
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x571180]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [edi], eax
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
lea esi, [edi + 0x38]
mov dword [edi + 0x30], 0
mov byte [edi + 0x34], 0
mov dword [ebp - 0x14], esi
mov dword [esi + 0x24], 0
mov byte [ebp - 4], 4
mov ecx, dword [ebp + 0x30]
test ecx, ecx
je 0x48c8f4
mov eax, dword [ecx]
push esi
call dword [eax]
mov dword [esi + 0x24], eax
mov al, byte [ebp + 0x34]
lea ecx, [edi + 0x70]
mov byte [ebp - 4], 5
mov byte [edi + 0x60], al
push 9
mov byte [edi + 0x68], 9
call fcn.00489770
lea eax, [ebp - 0xd]
mov byte [ebp - 4], 6
push eax
lea ecx, [edi + 0x10]
mov byte [ebp - 0xd], 1
call fcn.0048d670
mov ecx, dword [ebp + 0x30]
test ecx, ecx
je 0x48c938
mov esi, dword [ecx]
lea eax, [ebp + 0xc]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x30
Function at 0x48f540
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f2e67
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x18
mov eax, dword [0x571180]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
mov esi, dword [ebx + 8]
push 0xa0
mov dword [ebp - 0x20], esi
call fcn.004c2b27
mov edi, eax
add esp, 4
mov dword [ebp - 0x24], edi
mov dword [ebp - 4], 0
mov eax, dword [esi]
mov dword [esi], 0
mov dword [edi], eax
mov byte [edi + 4], 0
mov al, byte [esi + 8]
mov dword [ebp - 0x18], edi
mov byte [edi + 8], al
lea eax, [esi + 0xc]
mov byte [ebp - 4], 1
push eax
lea ecx, [edi + 0xc]
call fcn.00489f20
add esi, 0x58
mov dword [edi + 0x7c], 0
lea edx, [edi + 0x58]
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x48f60b
cmp ecx, esi
jne 0x48f601
mov eax, dword [ecx]
push edx
mov eax, dword [eax + 4]
call eax
mov dword [edi + 0x7c], eax
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x48f60b
mov edx, dword [ecx]
cmp ecx, esi
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
jmp 0x48f604
mov dword [edx + 0x24], ecx
mov dword [esi + 0x24], 0
mov ecx, dword [ebp - 0x20]
xorps xmm0, xmm0
mov dword [ebp - 0x18], edi
mov eax, dword [ecx + 0x80]
mov dword [edi + 0x80], eax
movups xmmword [edi + 0x84], xmm0
mov dword [edi + 0x94], 0
mov dword [edi + 0x98], 0
movups xmm0, xmmword [ecx + 0x84]
movups xmmword [edi + 0x84], xmm0
movq xmm0, qword [ecx + 0x94]
movq qword [edi + 0x94], xmm0
mov dword [ecx + 0x94], 0
mov dword [ecx + 0x98], 0xf
mov byte [ecx + 0x84], 0
mov eax, dword [ecx + 0x9c]
mov dword [edi + 0x9c], eax
mov esi, dword [ebp - 0x1c]
add esi, 4
mov dword [ebp - 4], 2
push esi
push 0
push edi
push 0x494450
push 0
push 0
call fcn.004d1053
mov ecx, dword [ebp - 0x1c]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
je 0x48f6cd
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004c2b19
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
push 6
mov dword [esi], 0
call fcn.004c0bc9
int3
Function at 0x498910
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x571180]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x5814b4], 0
push ebx
push esi
push edi
jne 0x49893a
cmp dword [0x5814bc], 0
je 0x49893a
call fcn.00461f90
mov ebx, dword [0x57bab8]
lea eax, [ebp - 0x30]
push eax
push dword [0x5814c4]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x30]
movd xmm1, eax
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x2c]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [ebp - 0x18]
cvtdq2ps xmm0, xmm0
push eax
movss dword [ebx + 0x10], xmm1
movss dword [ebx + 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [ebp - 0x18]
mov ecx, edi
sub ecx, dword [0x5814c8]
mov esi, dword [ebp - 0x14]
mov edx, esi
sbb edx, dword [0x5814cc]
call fcn.004c37c0
mov edx, dword [0x5814d4]
mov ecx, dword [0x5814d0]
cvtsd2ss xmm0, xmm0
movss dword [ebp - 8], xmm0
call fcn.004c37c0
movss xmm1, dword [ebp - 8]
cvtsd2ss xmm0, xmm0
push 0x11
divss xmm1, xmm0
movss dword [ebx + 0x18], xmm1
mov dword [0x5814cc], esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [0x5814c8], edi
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [ebx + 0x100], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [ebx + 0x101], al
call esi
mov ecx, dword [0x57bab8]
shr eax, 0xf
and al, 1
mov byte [ebx + 0x103], 0
mov byte [ebx + 0x102], al
cmp byte [ecx + 0x35b], 0
lea esi, [ecx + 0xe8]
je 0x498a4e
cvttss2si eax, dword [esi]
mov dword [ebp - 0xc], eax
cvttss2si eax, dword [ecx + 0xec]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push dword [0x5814c4]
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [esi], 0xff7fffff
mov dword [esi + 4], 0xff7fffff
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x498ab6
mov ecx, dword [0x5814c4]
cmp eax, ecx
je 0x498a7b
push ecx
push eax
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x498ab6
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x498ab6
lea eax, [ebp - 0x20]
push eax
push dword [0x5814c4]
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x498ab6
movd xmm0, dword [ebp - 0x20]
movd xmm1, dword [ebp - 0x1c]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [esi], xmm0
movss dword [esi + 4], xmm1
cmp byte [ebx + 0xb0], 0
je 0x498ac4
or eax, 0xffffffff
jmp 0x498acf
mov eax, dword [0x57bab8]
mov eax, dword [eax + 0x1d94]
cmp dword [0x571ca0], eax
je 0x498ae1
mov dword [0x571ca0], eax
call fcn.00462250
call fcn.00445ff0
mov ecx, dword [0x57e28c]
test ecx, ecx
je 0x498b28
mov eax, dword [ecx]
call dword [eax + 8]
call fcn.00447710
call fcn.004479c0
mov ecx, dword [0x57bab8]
xor eax, eax
add ecx, 0x1c5c
cmp byte [ecx], al
cmove ecx, eax
call fcn.00461aa0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004c2b19
mov esp, ebp
pop ebp
ret
call fcn.004bffe3
int3
Function at 0x4aff30
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
mov bl, cl
mov esi, edx
push 0
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
cmp bl, 0xa5
je 0x4aff91
cmp bl, 0xa3
je 0x4aff91
cmp bl, 0x25
je 0x4aff91
cmp bl, 0x27
je 0x4aff91
cmp bl, 0x26
je 0x4aff91
cmp bl, 0x28
je 0x4aff91
cmp bl, 0x2d
je 0x4aff91
cmp bl, 0x2e
je 0x4aff91
cmp bl, 0x24
je 0x4aff91
cmp bl, 0x23
je 0x4aff91
cmp bl, 0x21
je 0x4aff91
cmp bl, 0x22
je 0x4aff91
cmp bl, 0x90
je 0x4aff91
cmp bl, 0x2a
je 0x4aff91
cmp bl, 0x6f
je 0x4aff91
xor cl, cl
jmp 0x4aff93
mov cl, 1
movzx eax, al
mov word [esi + 6], ax
movzx eax, bl
mov dword [esi], 1
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov word [esi + 4], ax
mov dword [esi + 8], 8
test cl, cl
je 0x4affc7
mov dword [esi + 8], 9
pop esi
pop ebx
ret
Function at 0x4b5b20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ff995
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
mov eax, dword [0x571180]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov bl, byte [ecx]
movzx eax, bl
cmp eax, 9
ja case.0x4b5b54.0
jmp dword [eax*4 + 0x4b5c38]
lea eax, [ecx + 8]
xor ecx, ecx
cmp bl, 6
cmovne eax, ecx
mov al, byte [eax]
mov byte [edx], al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
cmp bl, 5
je 0x4b5ba4
cmp bl, 6
je 0x4b5ba4
lea eax, [ecx + 8]
xor bl, bl
xor ecx, ecx
test bl, bl
cmove eax, ecx
mov al, byte [eax]
mov byte [edx], al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ecx + 8]
mov bl, 1
xor ecx, ecx
test bl, bl
cmove eax, ecx
mov al, byte [eax]
mov byte [edx], al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ecx + 8]
xor ecx, ecx
cmp bl, 7
cmovne eax, ecx
cvttsd2si eax, qword [eax]
mov byte [edx], al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ecx + 8]
xor ecx, ecx
cmp bl, 4
jmp 0x4b5b63
call fcn.00489130
push eax
lea ecx, [ebp - 0x38]
call fcn.00440ce0
push eax
mov edx, str.type_must_be_number__but_is
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x50]
call fcn.00489a70
push eax
mov edx, 0x12e
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x20]
call fcn.0048acb0
add esp, 8
lea eax, [ebp - 0x20]
push 0x56f680
push eax
call fcn.004c57e2
pop ebx
dec ebx
add dl, dh
pop ebx
dec ebx
add dl, dh
pop ebx
dec ebx
add dl, dh
pop ebx
dec ebx
add ch, ah
pop ebx
dec ebx
add byte [edx + 0x5b], bh
dec ebx
add byte [ebx + 0x5b], bl
dec ebx
add ah, al
pop ebx
dec ebx
add dl, dh
pop ebx
dec ebx
add dl, dh
pop ebx
dec ebx
invalid
Function at 0x4b9520
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x438
mov eax, dword [0x571180]
xor eax, esp
mov dword [esp + 0x434], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edx
mov dword [esp + 8], eax
lea eax, [esp + 0x30]
push edi
push eax
mov dword [esp + 0x38], 0
call fcn.004b8dd0
add esp, 8
test al, al
je 0x4b9644
cmp dword [esi + 0x14], 0xf
mov dword [esp + 0x34], 0x400
jbe 0x4b9576
mov esi, dword [esi]
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push esi
push dword [esp + 0x44]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4b960d
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], eax
xorps xmm0, xmm0
mov eax, dword [esp + 0x34]
dec eax
movaps xmmword [esp + 0x10], xmm0
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.00440f80
mov ecx, dword [esp + 8]
lea eax, [esp + 0x10]
push eax
call fcn.00476860
mov ecx, dword [esp + 0x24]
cmp ecx, 0xf
jbe 0x4b95f7
mov edx, dword [esp + 0x10]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4b95ed
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4b965a
push ecx
push edx
call fcn.004c2b57
add esp, 8
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x434]
xor ecx, esp
call fcn.004c2b19
mov esp, ebp
pop ebp
ret
cmp eax, 0xea
jne 0x4b9644
push SysReAllocString
push str.The_allocated_buffer_is_not_enough_to_retrieve_the_value.
call fcn.004bb280
add esp, 8
mov dword [esp + 0xc], eax
lea eax, [esp + 8]
mov dword [esp + 8], str.The_allocated_buffer_is_not_enough_to_retrieve_the_value.
mov ecx, edi
push eax
push dword [0x54c388]
call fcn.004796f0
mov ecx, dword [esp + 0x43c]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.004c2b19
mov esp, ebp
pop ebp
ret
call fcn.004c869e
int3
Function at 0x4baf80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x74
push ebx
push ebp
push esi
mov esi, dword [esp + 0x8c]
push edi
mov edi, dword [esp + 0x8c]
cmp edi, 1
jle 0x4bb0a3
mov ebx, dword [esp + 0x88]
xorps xmm0, xmm0
mov dword [esp + 0x58], 0
lea eax, [esp + 0x74]
mov dword [esp + 0x54], eax
movlpd qword [esp + 0x5c], xmm0
movlpd qword [esp + 0x64], xmm0
movlpd qword [esp + 0x6c], xmm0
mov dword [esp + 0x4c], 0x550434
mov dword [esp + 0x50], 0x55042c
mov dword [esp + 0x74], 0x550420
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], edi
mov dword [esp + 0x1c], 0x534829
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x14], 0x534829
mov dword [esp + 0x18], 0
test esi, esi
je 0x4bb035
mov ecx, SysReAllocString
mov eax, esi
nop dword [eax]
cmp byte [eax], 0
je 0x4bb02b
dec ecx
inc eax
test ecx, ecx
jg 0x4bb020
sub eax, esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x98]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x58]
push eax
call fcn.004bb870
add esp, 0x10
mov ebp, eax
cmp dword [esp + 0x24], 0
jne 0x4bb09e
mov ecx, dword [esp + 0x4c]
lea eax, [esp + 0x1c]
push eax
push 1
lea eax, [esp + 0x1b]
mov byte [esp + 0x1b], 0
mov edx, dword [ecx + 4]
lea ecx, [esp + 0x54]
push eax
cmp edx, fcn.004af0b0
jne 0x4bb091
call fcn.004af0b0
pop edi
dec eax
pop esi
add eax, ebp
pop ebp
pop ebx
add esp, 0x74
ret
call edx
pop edi
dec eax
pop esi
add eax, ebp
pop ebp
pop ebx
add esp, 0x74
ret
mov byte [ebx + edi - 1], 0
mov dword [esp + 0x28], 0x534829
xorps xmm0, xmm0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0x52c340
mov dword [esp + 0x38], 0x52c348
movlpd qword [esp + 0x3c], xmm0
movlpd qword [esp + 0x44], xmm0
mov dword [esp + 0x14], 0x534829
mov dword [esp + 0x18], 0
test esi, esi
je 0x4bb10a
mov ecx, SysReAllocString
mov eax, esi
cmp byte [eax], 0
je 0x4bb100
dec ecx
inc eax
test ecx, ecx
jg 0x4bb0f5
sub eax, esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x98]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.004bb870
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x74
ret
Function at 0x4bccd0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x414
mov eax, dword [esp + 0x418]
push esi
mov esi, 0x400
mov dword [esp + 4], esi
push edi
mov edi, ecx
sub eax, 0
je 0x4bcd88
sub eax, 1
je 0x4bcd76
sub eax, 1
je 0x4bcd04
xor esi, esi
jmp 0x4bcdb2
push SysReAllocString
push str.USERPROFILE
call fcn.004bb280
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
push 1
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], str.USERPROFILE
push eax
lea eax, [esp + 0x30]
push eax
call fcn.004bce80
add esp, 0x18
test al, al
jne 0x4bcd70
push SysReAllocString
push str.HOME
call fcn.004bb280
mov dword [esp + 0x20], eax
lea eax, [esp + 0x1c]
push 1
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x24], str.HOME
push eax
lea eax, [esp + 0x30]
push eax
call fcn.004bce80
add esp, 0x18
mov esi, dword [esp + 8]
jmp 0x4bcdb2
lea eax, [esp + 0x1c]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x4bcdb0
lea eax, [esp + 0x1c]
push 0x400
push eax
call fcn.004d368c
add esp, 8
test eax, eax
je 0x4bcdb2
lea eax, [esp + 0x1c]
push SysReAllocString
push eax
call fcn.004bb280
add esp, 8
mov esi, eax
cmp esi, 0x7fffffff
jne 0x4bcdca
lea eax, [esp + 0x1c]
push esi
push eax
call fcn.004bb280
add esp, 8
mov esi, eax
push esi
lea eax, [esp + 0x20]
push eax
push 0x400
push edi
call fcn.004bd0a0
add esp, 0x10
mov eax, edi
pop edi
pop esi
add esp, 0x414
ret 4

Function at 0x4bd780
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [esi + 4]
inc edi
mov eax, edi
call fcn.004c3620
mov ebx, esp
push SysReAllocString
push esi
push edi
push ebx
call fcn.004bb200
mov esi, dword [ebp + 0xc]
add esp, 0x10
push dword [esi]
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x4bd7cb
cmp eax, dword [esi]
jae 0x4bd7cb
mov cl, 1
mov dword [esi], eax
mov al, cl
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
xor cl, cl
mov dword [esi], eax
mov al, cl
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4bd850
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov eax, dword [0x57ab00]
sub esp, 0x10
or eax, dword [0x57ab04]
jne 0x4bd87c
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov dword [0x57ab00], eax
mov dword [0x57ab04], ecx
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov ecx, dword [esp]
sub ecx, dword [0x57ab00]
mov edx, dword [esp + 4]
sbb edx, dword [0x57ab04]
call fcn.004c37c0
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
movsd qword [esp], xmm0
call fcn.004c37c0
movsd xmm1, qword [esp]
divsd xmm1, xmm0
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
movsd qword [ecx], xmm1
subsd xmm1, qword [0x57aaf8]
cvtpd2ps xmm0, xmm1
movss dword [eax], xmm0
movsd xmm0, qword [ecx]
movsd qword [0x57aaf8], xmm0
add esp, 0x10
ret
Function at 0x4beae0
Capabilities:
Initialize winsock library

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x190
test eax, eax
je 0x4beaf3
mov dword [0x571004], eax
push ebx
push esi
push edi
lea eax, [esp + 0xc]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ax, word [esp + 0x1a0]
mov edx, 1
movzx ecx, ax
test ax, ax
push 0
cmovne edx, ecx
mov dword [0x57ab18], 0x57ab24
mov ecx, dword [0x571004]
push 0
push 0
mov dword [0x57ab1c], 0x57ab24
mov eax, dword [ecx]
push 8
push 0
movzx ebx, dx
call dword [eax + 4]
mov edi, eax
test edi, edi
je 0x4beb86
mov ecx, dword [0x571004]
mov edx, ebx
push 0
push 0
push 0
mov esi, dword [ecx]
lea eax, [edx + edx*8]
shl eax, 3
push eax
push 0
call dword [esi + 4]
mov dword [edi], eax
push ebx
push dword [0x571004]
call fcn.004be810
mov dword [edi + 4], eax
add esp, 8
mov dword [0x57ab08], edi
jmp 0x4beb90
mov dword [0x57ab08], 0
mov edi, dword [esp + 0x1a4]
xor eax, eax
cmp ax, di
je 0x4bec01
mov ecx, dword [0x571004]
push 0
push 0
push 0
mov eax, dword [ecx]
push 8
push 0
call dword [eax + 4]
mov ebx, eax
test ebx, ebx
je 0x4bebf7
mov ecx, dword [0x571004]
push 0
push 0
push 0
mov esi, dword [ecx]
movzx edx, di
shl edx, 5
push edx
push 0
call dword [esi + 4]
mov dword [ebx], eax
push edi
push dword [0x571004]
call fcn.004be810
add esp, 8
mov dword [ebx + 4], eax
mov dword [0x57ab0c], ebx
pop edi
pop esi
pop ebx
add esp, 0x190
ret
mov dword [0x57ab0c], 0
pop edi
pop esi
pop ebx
add esp, 0x190
ret