joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a9490
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x5954a0]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x138], 0x114
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4a9568
mov ecx, dword [ebp - 0x134]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x130]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x128], 2
je 0x4a9514
mov dword [ebp - 8], 1
cmp dword [ebp - 4], 5
jne 0x4a9535
cmp dword [ebp - 0x10], 1
jne 0x4a952c
mov dword [ebp - 0x13c], 1
jmp 0x4a9533
mov dword [ebp - 0x14], 1
jmp 0x4a9566
cmp dword [ebp - 4], 6
jne 0x4a9559
cmp dword [ebp - 0x10], 1
je 0x4a9547
cmp dword [ebp - 0x10], 2
jne 0x4a9550
mov dword [ebp - 0x18], 1
jmp 0x4a9557
mov dword [ebp - 0xc], 1
jmp 0x4a9566
cmp dword [ebp - 4], 6
jbe 0x4a9566
mov dword [ebp - 0x18], 1
jmp 0x4a9576
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004f8124
mov esp, ebp
pop ebp
ret

Function at 0x4a9590
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x62c
mov eax, dword [0x5954a0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push eax
push 0xf
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 4], eax
mov dword [ebp - 0x628], 0x620
cmp dword [ebp - 4], 0xffffffff
jne 0x4a95d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x62c], eax
xor eax, eax
jmp 0x4a9630
lea ecx, [ebp - 0x628]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x4a9624
lea eax, [ebp - 0x628]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.KERNEL32.dll_Module32NextW
test eax, eax
je 0x4a9624
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x608]
push eax
call fcn.004fd061
add esp, 8
test eax, eax
jne 0x4a9622
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x614]
jmp 0x4a9630
jmp 0x4a95e5
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004f8124
mov esp, ebp
pop ebp
ret
Function at 0x4a9640
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1450
call fcn.004fa800
mov eax, dword [0x5954a0]
xor eax, ebp
mov dword [ebp - 0x1028], eax
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp - 8]
call fcn.0044f320
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
push 0xc
push 0
lea ecx, [ebp - 0x14]
push ecx
call fcn.004f8090
add esp, 0xc
mov edx, dword [ebp + 8]
push edx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4a980e
mov dword [ebp - 0x1020], 0
push 0xffc
push 0
lea eax, [ebp - 0x101c]
push eax
call fcn.004f8090
add esp, 0xc
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x20]
push ecx
push 0x1000
lea edx, [ebp - 0x1020]
push edx
mov eax, dword [ebp - 4]
push eax
call sub.PSAPI.DLL_EnumProcessModules
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4a9804
mov dword [ebp - 0x1024], 0
jmp 0x4a9718
mov ecx, dword [ebp - 0x1024]
add ecx, 1
mov dword [ebp - 0x1024], ecx
mov edx, dword [ebp - 0x20]
shr edx, 2
cmp dword [ebp - 0x1024], edx
jae 0x4a9804
xor eax, eax
mov word [ebp - 0x1430], ax
push 0x400
push 0
lea ecx, [ebp - 0x142e]
push ecx
call fcn.004f8090
add esp, 0xc
push 0x200
lea edx, [ebp - 0x1430]
push edx
mov eax, dword [ebp - 0x1024]
mov ecx, dword [ebp + eax*4 - 0x1020]
push ecx
mov edx, dword [ebp - 4]
push edx
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
jne 0x4a9772
jmp 0x4a9709
push 0x5c
lea eax, [ebp - 0x1430]
push eax
call fcn.004f8f45
add esp, 8
mov dword [ebp - 0x1434], eax
cmp dword [ebp - 0x1434], 0
je 0x4a97ff
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x1434]
add edx, 2
push edx
call fcn.004fd061
add esp, 8
test eax, eax
jne 0x4a97ff
push 0xc
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x1024]
mov edx, dword [ebp + ecx*4 - 0x1020]
push edx
mov eax, dword [ebp - 4]
push eax
call sub.PSAPI.DLL_GetModuleInformation
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4a97fd
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x10]
mov dword [edx], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x1438], ecx
lea ecx, [ebp - 8]
call fcn.0044f990
mov eax, dword [ebp - 0x1438]
jmp 0x4a9826
jmp 0x4a9804
jmp 0x4a9709
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x143c], 0
lea ecx, [ebp - 8]
call fcn.0044f990
mov eax, dword [ebp - 0x143c]
mov ecx, dword [ebp - 0x1028]
xor ecx, ebp
call fcn.004f8124
mov esp, ebp
pop ebp
ret
Function at 0x4a9b20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53da23
mov eax, dword fs:[0]
push eax
sub esp, 0x8bc
mov eax, dword [0x5954a0]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x200
lea eax, [ebp - 0x874]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x4a9b6a
xor eax, eax
jmp 0x4a9d3f
lea ecx, [ebp - 0x874]
push ecx
lea ecx, [ebp - 0x18]
call fcn.0044f380
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x898], edx
push 0x5c
mov eax, dword [ebp - 0x898]
push eax
call fcn.004f8f45
add esp, 8
mov dword [ebp - 0x894], eax
cmp dword [ebp - 0x894], 0
jne 0x4a9bb5
mov dword [ebp - 0x8c4], 0xffffffff
jmp 0x4a9bc6
mov ecx, dword [ebp - 0x894]
sub ecx, dword [ebp - 0x18]
sar ecx, 1
mov dword [ebp - 0x8c4], ecx
mov edx, dword [ebp - 0x8c4]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
push eax
push 0
lea ecx, [ebp - 0x878]
push ecx
lea ecx, [ebp - 0x18]
call fcn.00451010
mov dword [ebp - 0x8c8], eax
mov edx, dword [ebp - 0x8c8]
mov dword [ebp - 0x8b0], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x8b0]
push eax
lea ecx, [ebp - 0x18]
call fcn.0044f9d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x878]
call fcn.0044f990
mov ecx, str._addrsupply.exe
test ecx, ecx
jne 0x4a9c2d
mov dword [ebp - 0x8b8], 0
jmp 0x4a9c40
push str._addrsupply.exe
call fcn.004f810a
add esp, 4
mov dword [ebp - 0x8b8], eax
mov edx, dword [ebp - 0x8b8]
push edx
push str._addrsupply.exe
lea ecx, [ebp - 0x18]
call fcn.0044ecb0
push 0x44
push 0
lea eax, [ebp - 0x474]
push eax
call fcn.004f8090
add esp, 0xc
mov dword [ebp - 0x474], 0x44
push 0x10
push 0
lea ecx, [ebp - 0x42c]
push ecx
call fcn.004f8090
add esp, 0xc
xor edx, edx
mov word [ebp - 0x41c], dx
push 0x3fe
push 0
lea eax, [ebp - 0x41a]
push eax
call fcn.004f8090
add esp, 0xc
mov ecx, dword [ebp - 0x18]
push ecx
push 0x200
lea edx, [ebp - 0x41c]
push edx
call fcn.004fe1b0
add esp, 0xc
lea eax, [ebp - 0x42c]
push eax
lea ecx, [ebp - 0x474]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x41c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4a9d0e
mov dword [ebp - 0x87c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0044f990
mov eax, dword [ebp - 0x87c]
jmp 0x4a9d3f
push 0x1f4
mov eax, dword [ebp - 0x42c]
push eax
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov dword [ebp - 0x880], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0044f990
mov eax, dword [ebp - 0x880]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004f8124
mov esp, ebp
pop ebp
ret
Function at 0x4aa1e0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push str.ESAFENETAddrSupply32
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4aa202
xor eax, eax
jmp 0x4aa22c
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4aa221
xor eax, eax
jmp 0x4aa22c
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4aa390
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push 0x44
push 0
lea eax, [ebp - 0x50]
push eax
call fcn.004f8090
add esp, 0xc
mov dword [ebp - 0x50], 0x44
push 0x10
push 0
mov ecx, dword [ebp + 8]
add ecx, 4
push ecx
call fcn.004f8090
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, 4
push edx
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push 2
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
add ecx, 0x14
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4aa3f0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push 0x44
push 0
lea eax, [ebp - 0x50]
push eax
call fcn.004f8090
add esp, 0xc
mov dword [ebp - 0x50], 0x44
push 0x10
push 0
mov ecx, dword [ebp + 8]
add ecx, 0x24
push ecx
call fcn.004f8090
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, 0x24
push edx
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push 2
push 0
push 0
push 0
mov ecx, dword [ebp + 8]
add ecx, 0x34
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4aa450
Capabilities:
Get disk information
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc40
mov eax, dword [0x5954a0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0x41c], 0
lea eax, [ebp - 0x41c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0
jne 0x4aa4a4
cmp dword [ebp - 0x41c], 0
jne 0x4aa4a4
xor eax, eax
jmp 0x4aa65e
push 0
push 1
push 0
push 2
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4aa659
push 1
push 0
push 0
push 4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0
je 0x4aa64f
push 0x200
lea ecx, [ebp - 0x418]
push ecx
mov edx, dword [ebp - 0x424]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.PSAPI.DLL_GetMappedFileNameW
test eax, eax
je 0x4aa63b
xor eax, eax
mov word [ebp - 0x828], ax
lea ecx, [ebp - 0x828]
push ecx
push 0x1ff
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x4aa63b
mov edx, dword [0x554120]
mov dword [ebp - 0x834], edx
mov ax, word [0x554124]
mov word [ebp - 0x830], ax
mov dword [ebp - 0xc3c], 0
lea ecx, [ebp - 0x828]
mov dword [ebp - 0x82c], ecx
mov edx, dword [ebp - 0x82c]
mov ax, word [edx]
mov word [ebp - 0x834], ax
push 0x200
lea ecx, [ebp - 0xc38]
push ecx
lea edx, [ebp - 0x834]
push edx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x4aa603
lea eax, [ebp - 0xc38]
push eax
call fcn.004f810a
add esp, 4
mov dword [ebp - 0xc40], eax
cmp dword [ebp - 0xc40], 0x200
jae 0x4aa603
mov ecx, dword [ebp - 0xc40]
push ecx
lea edx, [ebp - 0xc38]
push edx
lea eax, [ebp - 0x418]
push eax
call fcn.004fddb6
add esp, 0xc
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0xc3c], eax
je 0x4aa603
mov ecx, dword [ebp - 0xc40]
lea edx, [ebp + ecx*2 - 0x418]
push edx
lea eax, [ebp - 0x834]
push eax
push 0x548c34
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00451560
add esp, 0x10
mov edx, dword [ebp - 0x82c]
movzx eax, word [edx]
mov ecx, dword [ebp - 0x82c]
add ecx, 2
mov dword [ebp - 0x82c], ecx
test eax, eax
je 0x4aa621
jmp 0x4aa603
cmp dword [ebp - 0xc3c], 0
jne 0x4aa63b
mov edx, dword [ebp - 0x82c]
movzx eax, word [edx]
test eax, eax
jne 0x4aa563
mov dword [ebp - 8], 1
mov ecx, dword [ebp - 0x424]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004f8124
mov esp, ebp
pop ebp
ret

Function at 0x4aac70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0x4aa760
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x4ab040
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0x4aac90
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x4ac150
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov ecx, dword [esi + 0x14]
push eax
push ecx
mov ecx, esi
call fcn.004ab6d0
mov dword [esi + 0x14], eax
movzx eax, al
add eax, dword [esi + 0x18]
mov ecx, esi
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x18], eax
shr eax, 0x18
mov byte [esp + 8], al
mov edx, dword [esp + 8]
mov eax, dword [esi + 0x1c]
push edx
push eax
call fcn.004ab6d0
mov dword [esi + 0x1c], eax
pop esi
ret 4

Function at 0x4acba0
Capabilities:
Set file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x230]
sub esp, 0x230
push 0xffffffffffffffff
push 0x53dc80
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x5954a0]
xor eax, ebp
mov dword [ebp + 0x22c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0x238]
mov esi, ecx
cmp byte [esi + 0xe4], 0xff
je 0x4acbf4
xor eax, eax
jmp 0x4acce3
xor ebx, ebx
mov dword [ebp - 0x14], 1
cmp byte [ebp + 0x23c], bl
jne 0x4accb9
cmp dword [esi + 0x60], ebx
jne 0x4acc26
call fcn.004ab3d0
mov ecx, dword [esi + 0x68]
cmp ecx, dword [eax + 0x14]
je 0x4acc2d
push 0xffffffffffffff9a
mov ecx, esi
call fcn.004ac840
jmp 0x4acc2d
mov dword [ebp - 0x14], 0xffffffff
mov ecx, esi
call fcn.004ab3d0
cmp word [eax + 0xe], 8
jne 0x4acc44
lea edx, [esi + 0x28]
push edx
call fcn.0052b3b0
cmp edi, ebx
je 0x4accb9
push ebx
mov dword [ebp - 4], ebx
mov dword [ebp], ebx
mov dword [ebp + 4], ebx
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], ebx
mov dword [ebp + 0x10], ebx
mov dword [ebp + 0x14], ebx
call fcn.004fb64b
mov dword [ebp + 0x10], eax
mov dword [ebp], eax
add esp, 4
lea eax, [ebp - 0x20]
push eax
mov ecx, esi
mov dword [ebp + 0x14], edx
mov dword [ebp + 4], edx
mov byte [ebp + 0x20], bl
call fcn.004ab3d0
mov ecx, eax
call fcn.004afc70
mov ecx, dword [eax]
mov dword [ebp + 8], ecx
mov edx, dword [eax + 4]
lea eax, [ebp]
push eax
push edi
mov dword [ebp + 0xc], edx
call fcn.004b46a8
mov ecx, esi
call fcn.004ab3d0
mov ecx, dword [eax + 0x24]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x4accb9
mov dword [ebp - 0x14], 0xfffffffe
lea ecx, [esi + 0xe8]
mov dword [ebp - 4], 0xffffffff
call fcn.004b2340
lea ecx, [esi + 0x6c]
mov byte [esi + 0xe4], bl
call fcn.004b1320
mov ecx, esi
call fcn.004ac2e0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x22c]
xor ecx, ebp
call fcn.004f8124
add ebp, 0x230
mov esp, ebp
pop ebp
ret 8
Function at 0x4ad2a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
mov esi, ecx
push edi
lea edi, [esi + 0xe8]
push ebp
mov ecx, edi
call fcn.004b18c0
test al, al
jne 0x4ad2c3
pop edi
pop esi
xor al, al
pop ebp
ret 4
lea ecx, [esi + 0x78]
call fcn.004b0230
cmp eax, 1
je 0x4ad2bb
cmp byte [esi + 0xe4], 0
jne 0x4ad2bb
lea ecx, [esi + 0x20]
call fcn.004b2ed0
push ebp
mov ecx, edi
call fcn.004b2270
mov ecx, esi
call fcn.004ab3d0
mov ecx, eax
call fcn.004af9a0
test al, al
je 0x4ad31c
cmp dword [esi + 0x10], 0
je 0x4ad2bb
mov ecx, esi
call fcn.004ac5d0
mov ecx, esi
call fcn.004ac610
test al, al
jne 0x4ad31c
push 0xffffffffffffff94
mov ecx, esi
call fcn.004ac840
mov ecx, esi
call fcn.004ab3d0
movzx edi, word [eax + 0xe]
test di, di
je 0x4ad339
cmp di, 8
je 0x4ad33f
push 0xffffffffffffff9b
call fcn.004ac840
cmp di, 8
jne 0x4ad36c
cmp byte [esi + 4], 0
je 0x4ad34d
lea eax, [esi + 0xc8]
jmp 0x4ad34f
xor eax, eax
push 0x38
push 0x554338
mov dword [esi + 0x50], eax
push 0xfffffffffffffff1
lea eax, [esi + 0x28]
push eax
call fcn.0052b400
push eax
mov ecx, esi
call fcn.004aca10
mov ecx, esi
call fcn.004ab3d0
mov ecx, dword [eax + 0x18]
mov dword [esi + 0x64], ecx
mov ecx, esi
call fcn.004ab3d0
mov ecx, eax
call fcn.004af9a0
test al, al
je 0x4ad38f
add dword [esi + 0x64], 0xfffffff4
mov ecx, esi
call fcn.004ab3d0
mov edx, dword [eax + 0x1c]
pop edi
mov dword [esi + 0x60], edx
mov dword [esi + 0x68], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x2c], 0
mov byte [esi + 0xe4], 0xff
pop esi
mov al, 1
pop ebp
ret 4
Function at 0x4addd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x53dde6
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x5954a0]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
push edi
mov eax, dword [0x5954a0]
xor eax, esp
push eax
lea eax, [esp + 0x220]
mov dword fs:[0], eax
mov eax, dword [esp + 0x234]
mov esi, dword [esp + 0x230]
push 0
push 0
push 0
push 0
push 0x100
lea ecx, [esp + 0x30]
push ecx
push 3
lea edx, [esp + 0x30]
push edx
push eax
mov dword [esp + 0x30], 0
call fcn.004fad12
add esp, 0x24
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x10]
call fcn.0044f380
mov edi, eax
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x22c], 0
call fcn.0044f380
push edi
push eax
push esi
mov byte [esp + 0x234], 1
call fcn.00451150
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
add esp, 0xc
mov byte [esp + 0x228], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4adea5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x228], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4aded0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x220]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.004f8124
add esp, 0x220
ret

Function at 0x4ae140
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x53de86
mov eax, dword fs:[0]
push eax
sub esp, 0x40c
mov eax, dword [0x5954a0]
xor eax, esp
mov dword [esp + 0x408], eax
push esi
push edi
mov eax, dword [0x5954a0]
xor eax, esp
push eax
lea eax, [esp + 0x418]
mov dword fs:[0], eax
mov eax, dword [esp + 0x42c]
mov esi, dword [esp + 0x428]
push 0x100
lea ecx, [esp + 0x18]
push ecx
push 0x100
lea edx, [esp + 0x220]
push edx
push 0
push 0
push 0
push 0
push eax
mov dword [esp + 0x30], 0
call fcn.004fad12
add esp, 0x24
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
call fcn.0044f380
mov edi, eax
lea ecx, [esp + 0x214]
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x424], 0
call fcn.0044f380
push edi
push eax
push esi
mov byte [esp + 0x42c], 1
call fcn.00451150
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
add esp, 0xc
mov byte [esp + 0x420], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4ae21e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x420], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4ae249
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x418]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x408]
xor ecx, esp
call fcn.004f8124
add esp, 0x418
ret
Function at 0x4ae280
Capabilities:
Access peb ldr_data
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x53dee9
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
mov eax, dword [0x5954a0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [esp + 0x28]
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 0
call fcn.0044f380
push 0x5668c0
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0
call fcn.0046fa60
mov ecx, dword [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.004addd0
lea ecx, [esp + 0x14]
push ecx
push eax
mov byte [esp + 0x30], 1
mov dword [esp + 0x20], 1
call fcn.0047fb40
add esp, 0x10
or esi, 0xffffffff
test al, al
jne 0x4ae317
mov edx, dword [esp + 0xc]
push edx
call fcn.004ac020
add esp, 4
cmp eax, esi
je 0x4ae317
xor bl, bl
jmp 0x4ae319
mov bl, 1
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov dword [esp + 0x20], 0
lea ecx, [eax + 0xc]
mov edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4ae340
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
jne 0x4ae40f
mov ecx, dword [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.004addd0
mov eax, dword [eax]
push eax
mov byte [esp + 0x2c], 2
call fcn.004ae280
add esp, 0xc
test al, al
mov eax, dword [esp + 0x14]
sete bl
add eax, 0xfffffff0
mov byte [esp + 0x20], 0
lea ecx, [eax + 0xc]
mov edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4ae390
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x4ae3c9
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x20], esi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], esi
dec esi
test esi, esi
jg 0x4ae3b5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret
mov ecx, dword [esp + 0xc]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4ae40f
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x20], esi
lea edx, [eax + 0xc]
lock xadd dword [edx], esi
dec esi
test esi, esi
jg 0x4ae3b5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov dword [esp + 0x20], esi
lock xadd dword [ecx], esi
dec esi
test esi, esi
jg 0x4ae430
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x18
ret