joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002b3e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
test ax, ax
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_send]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x1c]
movzx esi, ax
je 0x1002b463
jmp 0x1002b400
mov ecx, dword [ebp + 0x6c]
push 0
movsx eax, si
push eax
push edi
push ecx
call ebx
movzx eax, ax
cmp ax, si
je 0x1002b463
cmp ax, 0xffff
jne 0x1002b457
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 4
je 0x1002b45e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x1002b45e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push str.send
mov ecx, eax
mov ebx, 0x14000197
mov edx, ebp
call fcn.1002b2f0
add esp, 4
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret
movsx edx, ax
add edi, edx
sub esi, eax
test si, si
jne 0x1002b400
movzx eax, word [ebp + 0x5a]
test al, 4
je 0x1002b4e8
test al, 8
jne 0x1002b4e8
mov eax, dword [esp + 0x1c]
mov ecx, dword [ebp + 0x6c]
push 1
push 1
push eax
xor edi, edi
push ecx
mov dword [esp + 0x20], edi
call ebx
movzx esi, ax
cmp si, 0xffff
jne 0x1002b4e8
lea ecx, [ecx]
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
je 0x1002b4b2
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 4
je 0x1002b4b2
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
jne 0x1002b4f0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, edi
add edi, 1
cmp edx, 0x14
mov dword [esp + 0x10], eax
jg 0x1002b4f0
push 1
push 0x32
call dword [sym.imp.KERNEL32.dll_SleepEx]
mov eax, dword [esp + 0x1c]
mov ecx, dword [ebp + 0x6c]
push 1
push 1
push eax
push ecx
call ebx
movzx esi, ax
cmp si, 0xffff
je 0x1002b490
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret
cmp si, 0xffff
jne 0x1002b4e8
mov ecx, dword [esp + 0x10]
push str.send_oob
jmp 0x1002b440

Function at 0x1002bce0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x1c
mov eax, dword [0x1007fa04]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
push 0
push edi
call fcn.1002ca60
mov ecx, dword [0x100839e4]
add esp, 8
mov esi, eax
push esi
mov dword [esp + 0xc], 0x10
call fcn.1003c960
mov edx, dword [edi + 0x6c]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_accept]
cmp eax, 0xffffffff
mov dword [esi + 0x6c], eax
jne 0x1002bd62
push ebx
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push str.accept
mov ecx, eax
mov ebx, 0x14000192
mov edx, esi
call fcn.1002b2f0
push esi
call fcn.1002ac70
add esp, 8
pop ebx
xor eax, eax
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.10052756
add esp, 0x1c
ret
push 4
lea eax, [esp + 8]
push eax
push 8
mov dword [esp + 0x10], 1
mov ecx, dword [esi + 0x6c]
push 0xffff
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
or word [esi + 0x5a], 0x200
test word [edi + 0x54], 0x100
je 0x1002bd50
mov ecx, dword [esp + 0x1c]
mov word [esi + 0x54], 0x109
mov eax, esi
pop esi
xor ecx, esp
call fcn.10052756
add esp, 0x1c
ret
Function at 0x1003d8a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
xor eax, eax
push ebx
push edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x88]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x20], eax
movsx eax, word [esp + 0x2c]
lea edx, [esp + 0xc]
push edx
mov edx, dword [esi + 0x84]
push eax
push ecx
push edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call ebx
test edi, edi
jne 0x1003d94a
cmp eax, 0x3e5
jne 0x1003d929
mov edx, dword [esi + 0x84]
push 1
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov edi, eax
call ebx
test edi, edi
jne 0x1003d94a
cmp eax, 0x6d
je 0x1003d94a
push 0x10071520
mov ecx, eax
mov ebx, 0x14000196
mov edx, esi
call fcn.1003d7c0
add esp, 4
pop edi
pop ebx
add esp, 0x18
ret
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x1003d969
test word [esi + 0x5a], 0x400
je 0x1003d962
pop edi
xor al, al
pop ebx
add esp, 0x18
ret
push str.ReadFile_end_of_file
jmp 0x1003d933
mov eax, dword [esp + 0x2c]
pop edi
mov word [eax], cx
mov al, 1
pop ebx
add esp, 0x18
ret

Function at 0x1003d980
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x14
push ebx
push ebp
push edi
movsx ebx, ax
xor eax, eax
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esi + 0x84]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 0x88]
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x2c]
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call ebp
test edi, edi
jne 0x1003da19
cmp eax, 0x3e5
jne 0x1003d9fc
mov ecx, dword [esi + 0x84]
push 1
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov edi, eax
call ebp
test edi, edi
jne 0x1003da19
push 0x10071540
mov ecx, eax
mov ebx, 0x14000197
mov edx, esi
call fcn.1003d7c0
add esp, 4
pop edi
pop ebp
pop ebx
add esp, 0x14
ret
cmp dword [esp + 0x24], ebx
je 0x1003da26
push str.WriteFile_truncated
jmp 0x1003da01
pop edi
pop ebp
mov al, 1
pop ebx
add esp, 0x14
ret
Function at 0x1003da50
Capabilities:
Connect pipe

Disassembly:
sub esp, 0x14
mov edx, dword [edi + 0x84]
xor eax, eax
push ebx
push esi
lea ecx, [esp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0x88]
push ecx
push edx
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x1003dac2
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
mov esi, eax
cmp esi, 0x217
je 0x1003dac2
cmp esi, 0x3e5
jne 0x1003dace
mov eax, dword [edi + 0x88]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1003daca
mov cl, byte [0x10083ba9]
test cl, cl
jne 0x1003dace
pop esi
mov al, 1
pop ebx
add esp, 0x14
ret
call ebx
mov esi, eax
mov dl, byte [0x10083ba9]
test dl, dl
jne 0x1003daee
push 0x1007154c
mov ecx, esi
mov ebx, 0x14000192
mov edx, edi
call fcn.1003d7c0
add esp, 4
push edi
call fcn.1003d4e0
add esp, 4
pop esi
xor al, al
pop ebx
add esp, 0x14
ret

Function at 0x1003fa40
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x100586a8
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1007fa04]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1003fab4
push 0x140001a5
lea ecx, [esp + 8]
call fcn.10049a20
push eax
mov dword [esp + 0x14], 0
call fcn.10045170
mov ecx, dword [esp + 8]
add esp, 4
test ecx, ecx
mov dword [esp + 0x10], 0xffffffff
je 0x1003fac1
mov eax, dword [ecx]
mov edx, dword [eax + 0x34]
push 1
call edx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
push eax
call fcn.10044d70
add esp, 4
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
ret
Function at 0x1003ffa0
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push ebp
lea ebp, [esp - 0x84]
sub esp, 0x84
push 0xffffffffffffffff
push 0x10058770
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x1007fa04]
xor eax, ebp
mov dword [ebp + 0x80], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0x10083be8
xor edi, edi
push str._s_CONNECT_MUTEX
lea eax, [ebp]
mov esi, ecx
push 0x80
push eax
mov dword [ebp - 0x18], esi
mov dword [0x10083bd4], edi
mov dword [0x10083bd8], edi
mov dword [0x10083bdc], edi
mov dword [0x10083be0], edi
mov dword [0x10083be4], edi
mov dword [ebp - 4], edi
call fcn.10046b10
add esp, 0x10
lea ecx, [ebp]
push ecx
push 1
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
cmp eax, edi
mov dword [0x10083bd4], eax
jne 0x100400a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x10040093
push 0x14000037
lea ecx, [ebp - 0x14]
call fcn.10049a20
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov eax, dword [edx + 0x18]
push esi
call eax
mov ecx, dword [ebp - 0x14]
cmp ecx, edi
je 0x1004006c
mov edx, dword [ecx]
mov eax, dword [edx + 0x34]
push 1
call eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x80]
xor ecx, ebp
call fcn.10052756
add ebp, 0x84
mov esp, ebp
pop ebp
ret
push str.OpenMutex
call fcn.10044d70
add esp, 4
push 0x10083be8
push str._s_CONNECT_EVENT
lea ecx, [ebp]
push 0x80
push ecx
call fcn.10046b10
mov esi, dword [sym.imp.KERNEL32.dll_OpenEventA]
add esp, 0x10
lea edx, [ebp]
push edx
push edi
push 0x1f0003
call esi
cmp eax, edi
mov dword [0x10083be0], eax
jne 0x100400e3
push str.OpenEvent
call fcn.10044d70
add esp, 4
push 0x10083be8
push str._s_RESPONSE_EVENT
lea eax, [ebp]
push 0x80
push eax
call fcn.10046b10
add esp, 0x10
lea ecx, [ebp]
push ecx
push edi
push 0x1f0003
call esi
cmp eax, edi
mov dword [0x10083be4], eax
jne 0x10040120
push str.OpenEvent
call fcn.10044d70
add esp, 4
push 0x10083be8
push str._s_CONNECT_MAP
lea edx, [ebp]
push 0x80
push edx
call fcn.10046b10
add esp, 0x10
lea eax, [ebp]
push eax
push 1
push 2
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
cmp eax, edi
mov dword [0x10083bd8], eax
jne 0x10040164
push str.OpenFileMapping
call fcn.10044d70
mov eax, dword [0x10083bd8]
add esp, 4
push 0x18
push edi
push edi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, edi
mov dword [0x10083bdc], eax
jne 0x10040187
push 0x10071830
call fcn.10044d70
add esp, 4
mov al, 1
jmp 0x1004006e
Function at 0x10040ee0
Capabilities:
Create process on windows
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x1005889b
mov eax, dword fs:[0]
push eax
sub esp, 0x188
mov eax, dword [0x1007fa04]
xor eax, esp
mov dword [esp + 0x184], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1007fa04]
xor eax, esp
push eax
lea eax, [esp + 0x19c]
mov dword fs:[0], eax
mov bx, cx
push 0x104
lea eax, [esp + 0x98]
push eax
xor ebp, ebp
push ebp
mov esi, edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call fcn.10001490
lea ecx, [esp + 0x6c]
mov dword [esp + 0x68], eax
mov dword [esp + 0x8c], ecx
mov word [esp + 0x90], bp
mov word [esp + 0x92], 0x20
mov byte [esp + 0x6c], 0
mov edx, dword [esp + 0x1ac]
push edx
lea eax, [esp + 0x98]
push eax
lea ecx, [esp + 0x70]
push str._s__x__h__lu
push ecx
mov dword [esp + 0x1b4], ebp
call fcn.10045cb0
add esp, 0x10
mov ecx, dword [esp + 0x8c]
and bl, 0x80
neg bl
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x28]
push eax
push ebp
push ebp
sbb ebx, ebx
and ebx, 0x60
add ebx, 0x20
or ebx, 0xc
push ebx
push ebp
push ebp
push ebp
push ecx
push ebp
mov dword [esp + 0x4c], 0x44
mov dword [esp + 0x50], ebp
mov dword [esp + 0x80], ebp
mov word [esp + 0x7e], bp
mov dword [esp + 0x54], ebp
mov dword [esp + 0x58], ebp
mov dword [esp + 0x78], 0x80
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
setne bl
test bl, bl
je 0x10041011
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
push eax
mov dword [esi], edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x14]
push edx
call esi
jmp 0x1004101d
xor esi, esi
mov edi, str.CreateProcess___failed
call fcn.1003fed0
mov eax, dword [esp + 0x8c]
lea ecx, [esp + 0x6c]
cmp eax, ecx
mov dword [esp + 0x1a4], 0xffffffff
je 0x10041044
cmp eax, ebp
je 0x10041044
mov ecx, dword [eax - 4]
push eax
call fcn.10004590
mov al, bl
mov ecx, dword [esp + 0x19c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x184]
xor ecx, esp
call fcn.10052756
add esp, 0x194
ret
Function at 0x10041210
Capabilities:
Check mutex on windows

Disassembly:
push ebp
lea ebp, [esp - 0x84]
sub esp, 0x84
push 0xffffffffffffffff
push 0x100588e0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x1007fa04]
xor eax, ebp
mov dword [ebp + 0x80], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov bx, cx
mov cl, byte [0x10083c68]
test cl, cl
mov eax, dword [ebp + 0x8c]
mov dword [ebp - 0x1c], eax
jne 0x1004146a
mov edi, 0x1006653a
mov esi, 0x10083be8
mov ecx, 1
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x100412a2
push 0x80
call fcn.1004bb10
push eax
push 0x10083be8
call fcn.10046950
push 0x80
push 0x10083be8
call fcn.10047b90
add esp, 0x14
and bl, 6
neg bl
push 0x10083be8
push str._s_CONNECT_MUTEX
lea eax, [ebp]
push 0x80
push eax
mov dword [0x1007f630], 0x10
sbb ebx, ebx
xor edi, edi
and ebx, 0x3f
add ebx, 1
mov dword [0x1007f634], ebx
mov dword [0x10083bd4], edi
mov dword [0x10083bd8], edi
mov dword [0x10083bdc], edi
mov dword [0x10083be0], edi
mov dword [0x10083be4], edi
mov dword [ebp - 4], edi
call fcn.10046b10
add esp, 0x10
call fcn.1000e4c0
lea ecx, [ebp]
push ecx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x10083bd4], eax
je 0x10041326
call ebx
cmp eax, 0xb7
jne 0x10041333
push str.CreateMutex
call fcn.10044d70
add esp, 4
push 0x10083be8
push str._s_CONNECT_EVENT
lea edx, [ebp]
push 0x80
push edx
call fcn.10046b10
add esp, 0x10
call fcn.1000e4c0
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
lea ecx, [ebp]
push ecx
push edi
push edi
push eax
call esi
cmp eax, edi
mov dword [0x10083be0], eax
je 0x10041374
call ebx
cmp eax, 0xb7
jne 0x10041381
push str.CreateEvent
call fcn.10044d70
add esp, 4
push 0x10083be8
push str._s_RESPONSE_EVENT
lea edx, [ebp]
push 0x80
push edx
call fcn.10046b10
add esp, 0x10
call fcn.1000e4c0
lea ecx, [ebp]
push ecx
push edi
push edi
push eax
call esi
cmp eax, edi
mov dword [0x10083be4], eax
je 0x100413bc
call ebx
cmp eax, 0xb7
jne 0x100413c9
push str.CreateEvent
call fcn.10044d70
add esp, 4
push 0x10083be8
push str._s_CONNECT_MAP
lea edx, [ebp]
push 0x80
push edx
call fcn.10046b10
add esp, 0x10
call fcn.1000e4c0
lea ecx, [ebp]
push ecx
push 0x18
push edi
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, edi
mov dword [0x10083bd8], eax
je 0x1004140d
call ebx
cmp eax, 0xb7
jne 0x1004141a
push str.CreateFileMapping
call fcn.10044d70
add esp, 4
mov edx, dword [0x10083bd8]
push 0x18
push edi
push edi
push 2
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, edi
mov dword [0x10083bdc], eax
jne 0x10041443
push 0x10071830
call fcn.10044d70
add esp, 4
push edi
push 0x10041110
mov dword [ebp - 4], 0xffffffff
mov byte [0x10083c68], 1
call sym.fbclient.dll_gds__register_cleanup
push edi
push 4
push 0x10040850
push edi
call sym.fbclient.dll_fb_shutdown_callback
mov al, 1
jmp 0x1004151d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x80]
xor ecx, ebp
call fcn.10052756
add ebp, 0x84
mov esp, ebp
pop ebp
ret
Function at 0x10046a90
Capabilities:
Query environment variable

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push esi
push edi
push 0
push 0
push ebx
call ebp
mov edi, dword [esp + 0x18]
mov esi, eax
test esi, esi
je 0x10046ae6
lea eax, [esi - 1]
push eax
mov ecx, edi
call fcn.10045ad0
mov eax, dword [edi + 0x24]
push esi
push eax
push ebx
call ebp
cmp eax, esi
jae 0x10046ae6
test eax, eax
je 0x10046ae6
mov eax, dword [edi + 0x24]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10046ad0
sub eax, edx
mov word [edi + 0x28], ax
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret
mov ecx, dword [edi + 0x24]
mov byte [ecx], 0
mov eax, dword [edi + 0x24]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10046af2
sub eax, edx
mov word [edi + 0x28], ax
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret

Function at 0x10046c00
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 4]
lea edx, [ecx + 8]
push edx
push 0
lea edx, [ecx + 4]
push edx
push 0
push eax
mov dword [ecx + 0xc], eax
mov eax, dword [ecx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
neg eax
sbb eax, eax
add eax, 1
ret 4

Function at 0x10046c30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
lea eax, [ecx + 8]
push eax
push edx
mov edx, dword [ecx + 0xc]
lea eax, [ecx + 4]
push eax
mov eax, dword [ecx]
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
neg eax
sbb eax, eax
add eax, 1
ret 4

Function at 0x100488c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10059048
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x1007fa04]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push eax
push ecx
lea ecx, [esp + 0xc]
call fcn.10052660
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
push edx
push eax
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x2c], 0
call fcn.10048600
add esp, 0xc
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
add esp, 0x20
ret
Function at 0x10049f10
Capabilities:
Get common file path
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x10059172
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x1007fa04]
xor eax, esp
mov dword [esp + 0x10c], eax
push esi
push edi
mov eax, dword [0x1007fa04]
xor eax, esp
push eax
lea eax, [esp + 0x11c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x12c]
mov dword [esp + 0xc], 0
mov eax, dword [str.FIREBIRD_TMP]
push eax
mov dword [esp + 0x128], 0
mov dword [esp + 0x14], esi
call dword [sym.imp.MSVCR80.dll_getenv]
add esp, 4
test eax, eax
mov edx, eax
jne 0x10049f81
mov edx, 0x1006653a
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10049f86
sub eax, edi
push edx
push eax
mov ecx, esi
call fcn.10045930
cmp word [esi + 0x28], 0
mov dword [esp + 0x124], 0
mov dword [esp + 0xc], 1
jne 0x1004a00e
lea ecx, [esp + 0x14]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x10049fdb
cmp eax, 0x104
jae 0x10049fdb
lea edx, [esp + 0x14]
push edx
mov ecx, esi
call fcn.10005150
cmp word [esi + 0x28], 0
jne 0x1004a00e
mov edx, dword [str.c:_temp_]
mov eax, edx
lea edi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10049ff0
sub eax, edi
push eax
push edx
push eax
mov ecx, esi
call fcn.10045a00
push eax
call sub.MSVCR80.dll_memcpy
add esp, 0xc
mov eax, esi
mov ecx, dword [esp + 0x11c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x10c]
xor ecx, esp
call fcn.10052756
add esp, 0x11c
ret
Function at 0x1004a420
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10059233
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1007fa04]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov eax, dword [esp + 0x1c]
mov dword [esi], 0x10072038
xor ecx, ecx
mov dword [esi + 8], eax
lea eax, [esi + 0xc]
mov dword [esi + 0x2c], eax
mov word [esi + 0x30], cx
mov word [esi + 0x32], 0x20
mov dword [esp + 0x14], ecx
mov byte [eax], cl
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], ecx
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], ecx
mov cl, byte [esp + 0x28]
push edx
mov byte [esi + 0x48], cl
push eax
mov ecx, esi
mov byte [esp + 0x1c], 1
call fcn.1004a0e0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x10

Function at 0x1004b0f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x10059481
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1007fa04]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov eax, dword [esp + 0x80]
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
lea edi, [esi + 8]
mov dword [esi], 0x1007235c
mov dword [edi], eax
lea eax, [edi + 4]
xor ecx, ecx
mov edx, 0x20
mov dword [edi + 0x24], eax
mov word [edi + 0x28], cx
mov word [edi + 0x2a], dx
mov byte [eax], cl
mov eax, dword [esi + 4]
lea ebp, [esi + 0x34]
mov dword [ebp], eax
lea eax, [ebp + 4]
mov dword [ebp + 0x24], eax
mov word [ebp + 0x28], cx
mov word [ebp + 0x2a], dx
mov dword [esp + 0x78], ecx
mov byte [eax], cl
mov eax, dword [esi + 4]
mov dword [esi + 0x60], eax
lea eax, [esi + 0x64]
mov dword [esi + 0x84], eax
mov word [esi + 0x88], cx
mov word [esi + 0x8a], dx
mov byte [eax], cl
mov ecx, esi
mov byte [esp + 0x78], 2
call fcn.10006730
mov ecx, esi
call fcn.1004b070
mov ecx, dword [str.firebird.conf]
mov eax, ecx
lea edx, [eax + 1]
mov bl, byte [eax]
add eax, 1
test bl, bl
jne 0x1004b1a6
push ecx
sub eax, edx
push eax
lea ecx, [esp + 0x20]
call fcn.10045930
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x48]
mov bl, 3
push edx
mov ecx, edi
mov byte [esp + 0x80], bl
call fcn.10005690
movzx ecx, word [eax + 0x28]
mov eax, dword [eax + 0x24]
push ecx
push eax
push ecx
mov ecx, ebp
mov byte [esp + 0x84], 4
call fcn.10045a00
push eax
call sub.MSVCR80.dll_memcpy
mov eax, dword [esp + 0x74]
lea ecx, [esp + 0x54]
add esp, 0xc
cmp eax, ecx
mov byte [esp + 0x78], bl
je 0x1004b215
test eax, eax
je 0x1004b215
mov ecx, dword [eax - 4]
push eax
call fcn.10004590
mov eax, dword [esp + 0x3c]
lea edx, [esp + 0x1c]
cmp eax, edx
mov byte [esp + 0x78], 2
je 0x1004b233
test eax, eax
je 0x1004b233
mov ecx, dword [eax - 4]
push eax
call fcn.10004590
mov eax, esi
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x68
ret 4

Function at 0x1004ccc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x6b5], 0
mov byte [ebp - 0x6b4], 0x33
invalid
invalid
Function at 0x10052756
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1007fa04]
jne 0x10052760
repz ret
jmp fcn.10053162