joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4987e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5aecb8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
mov dword [esp + 4], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x5e0604
mov ecx, dword [esp + 0x20]
lea eax, [esp + 4]
push eax
push ecx
mov dword [esp + 0x20], 0
call fcn.004925d0
add esp, 8
test eax, eax
jne 0x49885e
mov dword [esp + 8], 0x5c52dc
lea ecx, [esp + 8]
mov dword [esp + 0x18], 1
call fcn.0058b409
xor eax, eax
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 0x18
push eax
lea ecx, [esp + 0xc]
call fcn.0058b3b2
mov edx, dword [esp + 4]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x30]
push edx
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
mov ecx, esi
call fcn.00498420
mov esi, eax
mov dword [esp + 8], 0x5c52dc
lea ecx, [esp + 8]
mov dword [esp + 0x18], 2
call fcn.0058b409
mov ecx, dword [esp + 0x10]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 0x18

Function at 0x49ee60
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5af178
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
je 0x49ef33
call fcn.0049ee10
mov ecx, dword [esi]
mov edi, eax
lea eax, [esp + 0x10]
push eax
push 0x18
push ecx
call dword [sym.imp.GDI32.dll_GetObjectA]
test eax, eax
je 0x49ef33
mov eax, dword [esp + 0x18]
test eax, eax
je 0x49ef33
mov eax, dword [esp + 0x14]
test eax, eax
je 0x49ef33
lea ecx, [esp + 8]
call fcn.0057f791
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push 1
push 0
push 0x19
push edx
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x44], 0
call fcn.0057f856
mov esi, dword [esi]
push esi
call fcn.0058b39d
test eax, eax
je 0x49eef1
mov eax, dword [eax + 4]
mov ecx, dword [esp + 0xc]
push edi
push eax
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
mov edx, dword [esp + 0xc]
push 0
push 0
push edx
call dword [sym.imp.COMCTL32.dll_ImageList_GetIcon]
lea ecx, [esp + 8]
mov esi, eax
mov dword [esp + 0x30], 0xffffffff
call fcn.0057f7ba
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
mov ecx, dword [esp + 0x28]
pop edi
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x4b01d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5b030e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xbc
mov eax, dword [esp + 0xcc]
push ebx
push esi
xor ebx, ebx
push edi
push ebx
mov esi, ecx
push 0x1000
push 1
push eax
lea ecx, [esp + 0x94]
call fcn.00588e1e
lea ecx, [esp + 0x84]
mov dword [esp + 0xd0], ebx
push ecx
lea ecx, [esp + 0x44]
call fcn.004d1bc0
mov edi, dword [esp + 0xdc]
lea ecx, [esp + 0xc]
mov byte [esp + 0xd0], 1
mov dword [esp + 0x5c], edi
call fcn.0058541f
mov dword [esp + 0x2c], 0x5ccd88
mov dword [esp + 0x30], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0xc], 0x5ceb18
mov dword [esp + 0x28], esi
mov edx, dword [esi]
lea eax, [esp + 0xc]
lea ecx, [esp + 0x40]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0xd8], 2
call dword [edx + 0x88]
test eax, eax
je 0x4b0299
mov eax, dword [edi + 8]
mov edx, dword [esi]
lea ecx, [esp + 0xc]
push eax
push ecx
mov ecx, esi
call dword [edx + 0x90]
lea ecx, [esp + 0x84]
call fcn.00588f82
lea ecx, [esp + 0xc]
mov byte [esp + 0xd0], 1
call fcn.0049a820
lea ecx, [esp + 0x40]
mov byte [esp + 0xd0], bl
call fcn.004d0700
lea ecx, [esp + 0x84]
mov dword [esp + 0xd0], 0xffffffff
call fcn.00588efa
mov ecx, dword [esp + 0xc8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0xc8
ret 8

Function at 0x4b7620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.004b6740
mov ecx, eax
jmp fcn.004b76b0
Function at 0x4b8d70
Capabilities:
Enumerate gui resources

Disassembly:
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push 0x4b8da0
push ecx
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
mov ax, word [esp]
pop ecx
ret

Function at 0x4b97c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ebx
push ebp
mov dword [esp + 8], ecx
push esi
mov ecx, dword [esp + 0x1c]
push edi
call fcn.00585b4c
mov edi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov eax, edi
push 6
shr eax, 4
inc eax
and eax, 0xffff
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
jne 0x4b97fd
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4b9811
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4b9826
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x4b9845
cmp esi, eax
jae 0x4b9849
xor ecx, ecx
dec edi
mov cx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x4b9835
cmp esi, eax
jb 0x4b9853
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0xc
xor ebx, ebx
mov bx, word [esi]
test ebx, ebx
jne 0x4b9866
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 0xc]
test eax, eax
je 0x4b9876
mov ebp, dword [eax + 4]
jmp 0x4b9878
xor ebp, ebp
push 0
push 0
push 0
lea edi, [esi + 2]
push 0
push ebx
push edi
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [esp + 0x20]
mov esi, eax
push esi
call fcn.00586068
push 0
push 0
push esi
push eax
push ebx
push edi
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [esp + 0x20]
push esi
call fcn.00586040
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x4be4c0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x5b0e76
push eax
mov eax, 0x1014
mov dword fs:[0], esp
call fcn.0045a5d0
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov ecx, dword [0x62770c]
mov dword [esp + 0x1c], ebx
cmp dword [ecx - 8], ebx
jne 0x4be5e9
mov ecx, dword [esp + 0x1038]
mov eax, dword [edi]
push 0x20019
push ecx
mov ecx, edi
call dword [eax + 8]
mov esi, eax
mov dword [esp + 0x20], esi
cmp esi, ebx
mov dword [esp + 0x102c], ebx
jne 0x4be52c
mov edx, dword [esp + 0x1040]
push edx
jmp 0x4be624
mov eax, dword [0x616c44]
mov dword [esp + 0x14], eax
mov ebp, dword [esp + 0x103c]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push ebx
push edx
push ebx
mov ebx, dword [0x6230fc]
push ebp
push esi
mov byte [esp + 0x1044], 1
call ebx
test eax, eax
mov dword [edi + 0x10], eax
je 0x4be596
mov eax, dword [esp + 0x1040]
push eax
mov edi, dword [esp + 0x1038]
mov ecx, edi
call fcn.00585c2f
lea ecx, [esp + 0x14]
mov byte [esp + 0x102c], 0
call fcn.00585bc1
push esi
call dword [0x623128]
mov eax, edi
jmp 0x4be634
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x18]
push ecx
push edx
lea ecx, [esp + 0x1c]
call fcn.00585ff1
push eax
lea eax, [esp + 0x24]
push eax
push 0
push ebp
push esi
call ebx
push 0xffffffffffffffff
lea ecx, [esp + 0x18]
mov dword [edi + 0x10], eax
call fcn.00586040
mov eax, dword [edi + 0x10]
test eax, eax
je 0x4be5d4
mov ecx, dword [esp + 0x1040]
push ecx
jmp 0x4be569
mov edi, dword [esp + 0x1034]
lea edx, [esp + 0x14]
push edx
mov ecx, edi
call fcn.00585936
jmp 0x4be577
mov eax, dword [esp + 0x1040]
mov byte [esp + 0x13], 0
cmp eax, ebx
jne 0x4be5fd
lea eax, [esp + 0x13]
mov edx, dword [esp + 0x103c]
push ecx
lea ecx, [esp + 0x28]
push 0x1000
push ecx
push eax
mov eax, dword [esp + 0x1048]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0x24]
push ecx
mov esi, dword [esp + 0x1038]
mov ecx, esi
call fcn.00585c2f
mov eax, esi
mov ecx, dword [esp + 0x1024]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1020
ret 0x10
Function at 0x4c1e70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5b12ef
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov dword [esp + 0xc], 0
push ecx
lea eax, [esp + 0x30]
mov ebx, 1
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
mov dword [esp + 0x28], ebx
call fcn.00585936
push ecx
mov byte [esp + 0x28], 2
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x61a488
call fcn.00585c2f
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], bl
push ecx
mov ecx, esi
call fcn.004c25a0
mov edx, dword [esp + 8]
mov byte [esp + 0x20], 3
mov eax, dword [edx - 8]
test eax, eax
je 0x4c1ef2
lea eax, [esp + 8]
lea ecx, [esp + 0x2c]
push eax
call fcn.00585cfa
push 0x5f
push 0x2e
lea ecx, [esp + 0x34]
call fcn.0057db5c
push 0x5f
push 0x5c
lea ecx, [esp + 0x34]
call fcn.0057db5c
mov esi, dword [esp + 0x28]
lea ecx, [esp + 0x2c]
push ecx
mov ecx, esi
call fcn.00585936
mov dword [esp + 0xc], ebx
lea ecx, [esp + 8]
mov byte [esp + 0x20], bl
call fcn.00585bc1
lea ecx, [esp + 0x2c]
mov byte [esp + 0x20], 0
call fcn.00585bc1
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x1c
ret 8

Function at 0x4c2050
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5b1338
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0xc]
lea eax, [edi + 0x30]
push eax
call fcn.004caf00
mov eax, dword [edi + 0x20]
mov dword [esp + 0x1c], 0
test eax, eax
jne 0x4c20b0
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004caf20
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 4
mov esi, dword [esp + 0x24]
test esi, esi
jne 0x4c20df
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004caf20
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 4
lea ecx, [esp + 0x10]
lea ebx, [edi + 0x68]
push ecx
push esi
mov ecx, ebx
mov dword [esp + 0x18], 0
call fcn.00580ff3
test eax, eax
jne 0x4c214a
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push esi
call fcn.00585c2f
mov ecx, edi
call fcn.004c1f50
test eax, eax
mov dword [esp + 0x10], eax
jne 0x4c213e
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004caf20
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 4
push esi
mov ecx, ebx
mov edi, eax
call fcn.00581037
mov dword [eax], edi
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004caf20
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x14
ret 4
Function at 0x4c2270
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x5b1378
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0x20]
cmp eax, edi
je 0x4c22a1
cmp dword [esi + 0x2c], edi
je 0x4c22a1
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebp, dword [esp + 0x28]
lea ecx, [esp + 0x10]
push ebp
call fcn.00585c2f
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], edi
cmp dword [eax - 8], edi
jne 0x4c22ca
push 0x61b810
lea ecx, [esp + 0x14]
call fcn.00585d4a
push 0x5f
push 0x2e
lea ecx, [esp + 0x18]
call fcn.0057db5c
mov ecx, dword [esp + 0x2c]
mov ebx, dword [esp + 0x24]
mov dword [esi + 0x2c], ecx
mov ecx, esi
mov dword [esi + 0x20], ebx
mov dword [esi + 0x28], edi
mov dword [esi + 0x24], edi
call fcn.004c1dd0
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 0x20]
push 0x61b804
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x4c231a
test ebp, ebp
jne 0x4c231a
push ebx
mov ecx, esi
call fcn.004c21c0
mov edi, eax
xor ebx, ebx
test edi, edi
je 0x4c2351
mov ecx, dword [esi + 0x20]
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4c2351
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, dword [esi + 0x20]
push edi
push edx
mov dword [esi + 0x24], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esi + 0x24]
mov ebx, 1
add eax, ecx
mov dword [esi + 0x28], eax
mov ecx, dword [esi + 0x64]
test ecx, ecx
je 0x4c2368
push 0
push 0
push 0
push 0x294f
call fcn.0053ae10
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00585bc1
mov ecx, dword [esp + 0x14]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
Function at 0x4c2470
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5b13d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push ecx
lea eax, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
mov dword [esp + 0x30], 1
call fcn.00585936
push ecx
lea edx, [esp + 0x38]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
mov byte [esp + 0x34], 2
call fcn.00585936
lea eax, [esp + 0x10]
mov ecx, esi
push eax
mov byte [esp + 0x34], 1
call fcn.004c2640
mov eax, dword [esp + 8]
xor ebx, ebx
cmp dword [eax - 8], ebx
jne 0x4c2519
lea ecx, [esp + 8]
mov byte [esp + 0x28], 1
call fcn.00585bc1
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], bl
call fcn.00585bc1
lea ecx, [esp + 0x34]
mov dword [esp + 0x28], 0xffffffff
call fcn.00585bc1
or eax, 0xffffffff
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop esi
pop ebx
add esp, 0x24
ret 8
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x18]
push edx
push ecx
push 0x61b824
push eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
call fcn.0057950d
mov eax, dword [esp + 0x28]
xor edx, edx
mov dh, byte [esp + 0x20]
and eax, 0xff
mov dl, byte [esp + 0x24]
add esp, 0x14
shl edx, 8
or edx, eax
lea ecx, [esp + 8]
mov esi, edx
mov byte [esp + 0x28], 1
call fcn.00585bc1
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], bl
call fcn.00585bc1
lea ecx, [esp + 0x34]
mov dword [esp + 0x28], 0xffffffff
call fcn.00585bc1
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x24
ret 8
Function at 0x4cb870
Capabilities:
Create thread
Resume thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
mov dword [esi], 0
push eax
mov dword [esi + 0xc], 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea ecx, [esp + 4]
push ecx
push 4
push esi
push 0x4cb7f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 8], eax
je 0x4cb8bc
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [esi + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
pop ecx
ret

Function at 0x4cb8c0
Capabilities:
Terminate thread

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 8], ebx
je 0x4cb946
mov eax, dword [esi + 0x10]
push ebp
push edi
push eax
mov dword [esi + 0xc], 1
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, dword [esi + 8]
mov edi, dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], ebx
push ecx
push edx
call edi
test eax, eax
je 0x4cb933
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [esp + 0x10], 0x103
jne 0x4cb933
inc ebx
cmp ebx, 0xa
ja 0x4cb927
mov eax, dword [esi + 8]
push 0x64
push eax
call ebp
mov edx, dword [esi + 8]
lea ecx, [esp + 0x10]
push ecx
push edx
call edi
test eax, eax
jne 0x4cb8fe
jmp 0x4cb933
mov eax, dword [esi + 8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov dword [esi + 8], 0
pop ebp
pop esi
pop ebx
pop ecx
ret

Function at 0x4cf446
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5b1d9e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
xor eax, eax
mov dword [esi + 8], 0x5d2080
mov dword [esp + 0x10], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x2c], 0x5d2074
push 1
mov byte [esp + 0x14], 2
mov dword [esi], 0x5d2070
mov dword [esi + 0x1c], eax
mov dword [esi + 4], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x40], eax
call fcn.004cfb30
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4d03a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5b1e87
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [0x616c44]
push ebx
push esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov esi, dword [esp + 0x34]
mov ebx, 1
mov dword [esp + 0x28], ebx
fld qword [esi]
call fcn.0045ace4
test eax, eax
jne 0x4d0410
lea ecx, [esp + 0x34]
push 0x61bb50
push ecx
mov ecx, esi
call fcn.0045970a
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 2
call fcn.00585cfa
mov byte [esp + 0x28], bl
lea ecx, [esp + 0x34]
jmp 0x4d0491
mov edx, dword [esi]
mov eax, dword [esi + 4]
fld qword [esi]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
call fcn.0045ace4
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
fild qword [esp + 0x10]
fcomp qword [esp + 0x18]
fnstsw ax
test ah, 0x40
je 0x4d0469
lea ecx, [esp + 0x34]
push 0x61bb44
push ecx
mov ecx, esi
call fcn.0045970a
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 3
call fcn.00585cfa
mov byte [esp + 0x28], bl
lea ecx, [esp + 0x34]
jmp 0x4d0491
lea edx, [esp + 0x34]
push 0x61bb30
push edx
mov ecx, esi
call fcn.0045970a
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 4
call fcn.00585cfa
mov byte [esp + 0x28], bl
lea ecx, [esp + 0x34]
call fcn.00585bc1
mov esi, dword [esp + 0x30]
lea eax, [esp + 8]
push eax
mov ecx, esi
call fcn.00585936
mov dword [esp + 0xc], ebx
lea ecx, [esp + 8]
mov byte [esp + 0x28], 0
call fcn.00585bc1
mov ecx, dword [esp + 0x20]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x4d2f90
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x5b2123
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
mov dword [esi], 0x5d22d8
mov eax, dword [esi + 0x2c]
mov dword [esp + 0x10], 1
test eax, eax
jne 0x4d2fda
mov eax, dword [esi + 0x44]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x4d2fda
mov ecx, dword [esi + 0x48]
test ecx, ecx
je 0x4d2fda
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esi + 0x44]
call fcn.00585bc1
lea ecx, [esi + 0x40]
mov byte [esp + 0x10], 0
call fcn.00585bc1
mov ecx, esi
mov dword [esp + 0x10], 0xffffffff
call fcn.004d0700
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4da6c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5b25db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 8], esi
mov dword [esi + 0x20], 0x5ccd88
mov dword [esi + 0x24], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], edi
mov dword [esp + 0x14], edi
call fcn.004b8ad0
mov edx, dword [eax]
push 0x2393
mov ecx, eax
call dword [edx + 0x18]
mov dword [esi + 0x38], eax
call fcn.004b8ad0
mov edx, dword [eax]
push 0x2392
mov ecx, eax
call dword [edx + 0x18]
mov dword [esi + 0x3c], eax
call fcn.004b8ad0
mov edx, dword [eax]
push 0x2391
mov ecx, eax
call dword [edx + 0x18]
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x40], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 0x14], edi
mov dword [esi + 0x34], eax
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x4daff0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5b2680
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [0x616c44]
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], eax
xor esi, esi
mov dword [esp + 0x24], esi
call fcn.004b8ad0
mov edx, dword [eax]
lea ecx, [esp + 0x10]
push 0x23cb
push ecx
mov ecx, eax
call dword [edx + 8]
mov edx, dword [0x616c44]
mov ebp, 1
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0x10]
push ebp
lea ecx, [esp + 0x10]
push eax
push ecx
mov byte [esp + 0x30], 1
call fcn.0057e262
mov edx, dword [edi + 0x68]
add esp, 0xc
mov eax, dword [edx + 0x80]
cmp eax, esi
mov dword [esp + 0x18], eax
jle 0x4db0c8
push ebx
mov ecx, dword [edi + 0x68]
push esi
call fcn.004819f0
test eax, eax
je 0x4db0c0
lea ecx, [esp + 0x18]
push ecx
mov ecx, eax
call fcn.00480370
mov eax, dword [eax]
mov edx, dword [esp + 0x10]
push eax
push edx
call fcn.0045a2e5
add esp, 8
lea ecx, [esp + 0x18]
test eax, eax
sete bl
call fcn.00585bc1
test bl, bl
je 0x4db0c0
mov eax, ebp
lea ecx, [esp + 0x10]
push eax
mov eax, dword [esp + 0x18]
push eax
push ecx
inc ebp
call fcn.0057e262
add esp, 0xc
xor esi, esi
jmp 0x4db0c1
inc esi
cmp esi, dword [esp + 0x1c]
jl 0x4db06b
pop ebx
lea edx, [esp + 0xc]
lea ecx, [edi + 0x60]
push edx
call fcn.00585cfa
push 0
mov ecx, edi
call fcn.00584549
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 0
call fcn.00585bc1
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.00585bc1
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x4e53b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5b2c7a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov ecx, dword [esp + 0x20]
push esi
call fcn.0049d760
mov esi, eax
test esi, esi
mov dword [esp + 8], esi
je 0x4e5559
mov eax, dword [esi + 0x80]
push ebp
xor ebp, ebp
mov dword [esp + 0x10], eax
test eax, eax
jle 0x4e5524
push ebx
mov ebx, dword [esp + 0x3c]
push edi
push ebp
mov ecx, esi
call fcn.004819f0
mov edi, eax
mov eax, dword [edi + 0x194]
test eax, eax
je 0x4e5515
mov eax, dword [edi + 0x11c]
test eax, eax
je 0x4e5515
push 0x170
call fcn.005861ce
mov esi, eax
add esp, 4
mov dword [esp + 0x1c], esi
xor eax, eax
cmp esi, eax
mov dword [esp + 0x28], eax
je 0x4e5454
mov ecx, esi
call fcn.004a47b0
mov dword [esi], 0x5d4754
mov dword [esi + 0x1c], 0x5d46f8
mov eax, esi
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push 1
push edx
mov edx, dword [esp + 0x40]
mov ecx, dword [ecx + 0xe4]
push 0x61c000
push edx
push eax
mov dword [esp + 0x3c], 0xffffffff
call fcn.00488510
mov esi, eax
push ebx
mov ecx, esi
mov eax, dword [esi]
mov dword [esi + 0x78], ebp
call dword [eax + 0x5c]
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
call fcn.00480370
push 0
lea edx, [esp + 0x44]
push eax
push edx
mov dword [esp + 0x34], 1
call fcn.004e4e40
add esp, 0xc
mov eax, dword [eax]
mov ecx, esi
push eax
mov byte [esp + 0x2c], 2
call fcn.0048f130
lea ecx, [esp + 0x40]
mov byte [esp + 0x28], 1
call fcn.00585bc1
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
call fcn.00585bc1
push 8
mov ecx, esi
call fcn.004905c0
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xdc]
cmp dword [esi + 0x9c], eax
je 0x4e5506
push 1
mov ecx, esi
mov dword [esi + 0x9c], eax
call fcn.0048ee00
mov eax, dword [esp + 0x34]
mov esi, dword [esp + 0x14]
inc eax
xor ebx, ebx
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x18]
inc ebp
cmp ebp, eax
jl 0x4e53fb
pop edi
pop ebx
mov eax, dword [esp + 0x34]
pop ebp
test eax, eax
je 0x4e5559
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x4e5559
mov ecx, dword [esp + 0x24]
push 0
push 0xffffffffffffffff
push 0
mov ecx, dword [ecx + 0xe4]
push 0x88b9
push 1
call fcn.004881e0
mov edx, dword [eax]
push 1
mov ecx, eax
call dword [edx + 0x5c]
mov ecx, dword [esp + 0x14]
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret