joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47a600
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x72b03e
push eax
mov dword fs:[0], esp
mov eax, fcn.0047a810
sub esp, 0x310
test eax, eax
mov dword [0x7c29e4], 0x47a810
jne 0x47a638
mov dword [0x7c29e4], 0x693f80
push 8
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp], eax
test eax, eax
mov dword [esp + 0x318], 0
je 0x47a65e
mov ecx, eax
call fcn.00493490
jmp 0x47a660
xor eax, eax
push ebp
push esi
push edi
push str..Morrowind.ini
push 0
push str.TryArchiveFirst
push str.General
mov dword [esp + 0x334], 0xffffffff
mov dword [0x7c9f74], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 0xffffffff
je 0x47a74c
mov ecx, dword [0x7c9f74]
push str.Data_FilesMorrowind.bsa
call fcn.004934d0
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
xor esi, esi
push esi
lea ecx, [esp + 0x14]
push str.Archive__d
push ecx
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
add esp, 0xc
push str..Morrowind.ini
push 0x104
lea edx, [esp + 0x11c]
push edx
push 0x7c6180
lea eax, [esp + 0x20]
push eax
push str.Archives
call ebp
test eax, eax
je 0x47a74c
lea ecx, [esp + 0x114]
push ecx
push str.Data_Files_
lea edx, [esp + 0x18]
push str._s_s
push edx
call edi
mov ecx, dword [0x7c9f74]
add esp, 0x10
lea eax, [esp + 0x10]
push eax
call fcn.004934d0
inc esi
push esi
lea ecx, [esp + 0x14]
push str.Archive__d
push ecx
call edi
add esp, 0xc
push str..Morrowind.ini
push 0x104
lea edx, [esp + 0x11c]
push edx
push 0x7c6180
lea eax, [esp + 0x20]
push eax
push str.Archives
call ebp
test eax, eax
jne 0x47a6e8
push 0x789c5c
push str.ArchiveInvalidationList.txt
call dword [sym.imp.MSVCRT.dll_fopen]
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x47a7c0
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_fgets]
push ebp
lea ecx, [esp + 0x220]
push 0x104
push ecx
call ebx
mov esi, eax
add esp, 0xc
test esi, esi
je 0x47a7b5
or ecx, 0xffffffff
xor eax, eax
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ecx + esi - 1], al
mov ecx, dword [0x7c9f74]
push esi
call fcn.00493580
test al, al
jne 0x47a76c
push str.Invalidater_file_not_in_archive__remove_from_list_or_fix_name.
push esi
call fcn.00694460
add esp, 8
jmp 0x47a76c
push ebp
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 4
pop ebx
mov ecx, dword [esp + 0x31c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x31c
ret
Function at 0x47cc90
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
sub esp, 0x50
push ebp
push esi
push edi
push str..Morrowind.ini
push 0
push str.SkipKFExtraction
push str.General
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea ecx, [esp + 0xc]
push ecx
mov dword [0x7c93cc], eax
mov eax, dword [0x7c6cdc]
mov eax, dword [eax + 4]
push 0xf003f
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x47cd8c
lea edx, [esp + 0x10]
push edx
push 0x7c9390
push eax
push eax
mov eax, dword [esp + 0x1c]
push str.Last_Keyframe_Extract_Time
push eax
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x7c93b0
call dword [sym.imp.MSVCRT.dll_time]
mov ebp, dword [sym.imp.MSVCRT.dll__stat]
lea edx, [esp + 0x3c]
push edx
push str.Data_FilesMeshes
call ebp
add esp, 0xc
cmp eax, 0xffffffff
jne 0x47cd35
mov byte [0x7c93c9], 1
mov eax, dword [0x7c9f74]
mov esi, dword [eax]
test esi, esi
je 0x47cd8c
lea edx, [esi + 0xb0]
test edx, edx
je 0x47cd74
or ecx, 0xffffffff
xor eax, eax
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x47cd74
lea ecx, [esp + 0x14]
push ecx
push edx
call ebp
add esp, 8
cmp eax, 0xffffffff
je 0x47cd74
mov edx, dword [esp + 0x30]
cmp edx, dword [0x7c9390]
jg 0x47cd85
mov esi, dword [esi + 0x150]
test esi, esi
jne 0x47cd40
pop edi
pop esi
pop ebp
add esp, 0x50
ret
mov byte [0x7c93c8], 1
pop edi
pop esi
pop ebp
add esp, 0x50
ret

Function at 0x47cdc0
Capabilities:
Set registry value

Disassembly:
mov eax, dword [0x7c6cdc]
mov eax, dword [eax + 4]
sub esp, 8
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 4]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x47ce17
push 4
push 0x7c93b0
push 4
push eax
mov eax, dword [esp + 0x10]
push str.Last_Keyframe_Extract_Time
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 8
ret
Function at 0x47f9a0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x34
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push esi
push edi
mov esi, ecx
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0xc]
push eax
push 0
push 0x1109
push ecx
call ebx
mov eax, dword [esp + 0x48]
test eax, eax
mov dword [esp + 0x10], 0xffff0002
mov dword [esp + 0x14], 0x27
mov dword [esp + 0xc], 0xffff0000
je 0x47f9e5
mov dword [esp + 0x24], eax
jmp 0x47f9ec
mov edx, dword [esi + 0x1c]
mov dword [esp + 0x24], edx
mov eax, dword [0x7c9770]
mov ecx, dword [esi + 0xc]
mov edi, dword [esp + 0x44]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
lea eax, [esp + 0xc]
push eax
push 0
push 0x1100
push ecx
mov dword [esp + 0x48], edi
call ebx
push edi
push eax
mov ecx, esi
mov dword [esi + 0x10], eax
call fcn.0047fa40
mov edx, dword [esi + 8]
push 0xa
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
pop edi
pop esi
pop ebx
add esp, 0x34
ret 8

Function at 0x480c40
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x72b203
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004ee8d0
xor ebx, ebx
lea ecx, [esi + 0x60]
mov dword [esp + 0x18], ebx
call fcn.0047e1e0
xor eax, eax
mov dword [esi], 0x7477bc
mov dword [esi + 4], 0x4e474552
mov ecx, 8
lea edi, [esi + 0x10]
rep stosd dword es:[edi], eax
mov ecx, 8
lea edi, [esi + 0x30]
rep stosd dword es:[edi], eax
mov al, 5
push 1
mov ecx, esi
mov byte [esp + 0x1c], 1
mov byte [esi + 0x50], al
mov byte [esi + 0x51], 0x19
mov byte [esi + 0x52], 0x23
mov byte [esi + 0x53], 0x14
mov byte [esi + 0x54], 0xa
mov byte [esi + 0x55], al
mov byte [esi + 0x56], bl
mov byte [esi + 0x57], bl
mov byte [esi + 0x58], bl
mov byte [esi + 0x59], bl
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x74], 0xffffffff
call fcn.004eed40
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x482870
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x72b258
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.004ee8d0
xor eax, eax
xor edx, edx
mov dword [esi], 0x747810
mov ecx, 8
lea edi, [esi + 0x10]
rep stosd dword es:[edi], eax
push 1
mov ecx, esi
mov dword [esp + 0x18], edx
mov dword [esi + 4], 0x52435353
mov dword [esi + 0x30], edx
call fcn.004eed40
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4873d0
Capabilities:
Suspend thread

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebp, ebp
dec eax
cmp eax, 7
mov esi, ecx
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
ja case.0x4873ef.3
jmp dword [eax*4 + 0x48754c]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x10], 1
mov dword [esi + 0xa4], ecx
jmp case.0x4873ef.3
mov edx, dword [esp + 0x20]
mov ebp, 2
mov dword [esp + 0x10], 1
mov dword [esi + 0xa4], edx
jmp case.0x4873ef.3
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], 1
mov dword [esi + 0xa0], eax
jmp case.0x4873ef.3
mov ecx, dword [esp + 0x20]
mov edi, 2
mov dword [esp + 0x14], 1
mov dword [esi + 0xa0], ecx
mov ebx, dword [esi + 0xa0]
mov eax, dword [esi + 0xa4]
mov ecx, dword [esi + 0xb538]
dec ebx
dec eax
push str.TES::Suspend_Thread
mov dword [esp + 0x20], eax
call fcn.00693f00
mov al, byte [esi + 0xb511]
test al, al
je 0x4874c3
mov edx, dword [esi + 0xb504]
push edx
push str.Suspending_Background_Thread__d_n
call fcn.006e9a00
add esp, 8
mov byte [esi + 0xb511], 0
mov ecx, dword [esi + 0xb538]
call fcn.00693f10
mov eax, dword [esi + 0xb504]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov ecx, dword [0x7c9b30]
mov edx, dword [esi + 0xb504]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
jmp 0x4874ce
mov ecx, dword [esi + 0xb538]
call fcn.00693f10
mov ecx, dword [esi]
call fcn.004b8940
push 0
mov ecx, esi
call fcn.0048eb70
mov dword [esp + 0x20], 3
mov eax, dword [esp + 0x1c]
add eax, ebp
push eax
lea ecx, [ebx + edi]
push ecx
push ebp
push edi
mov ecx, esi
call fcn.00485880
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
add edi, edx
add ebp, ecx
dec eax
mov dword [esp + 0x20], eax
jne 0x4874e6
mov eax, dword [esi + 0xb4f0]
xor ecx, ecx
cmp eax, ecx
je 0x487525
cmp eax, dword [esi + 0xb4f4]
jae 0x48752b
mov dword [esi + 0xb4f4], ecx
cmp eax, ecx
je 0x487540
mov dword [esi + 0xb4f0], ecx
mov dword [esi + 0xb4f4], ecx
call fcn.005deea0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
Function at 0x48f940
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0xb538]
push str.TES::Resume_Thread
call fcn.00693f00
mov al, byte [esi + 0xb511]
test al, al
jne 0x48f9ac
mov eax, dword [0x7c9b30]
mov ecx, dword [esi + 0xb504]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [esi + 0xb504]
push edx
push str.Resuming_Background_Thread__d_n
call fcn.006e9a00
add esp, 8
mov byte [esi + 0xb518], 0
mov byte [esi + 0xb511], 1
mov ecx, dword [esi + 0xb538]
call fcn.00693f10
mov eax, dword [esi + 0xb504]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
ret
mov ecx, dword [esi + 0xb538]
call fcn.00693f10
pop esi
ret
Function at 0x490350
Capabilities:
Read .ini file
Resume thread

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, dword [esp + 0x24]
push edi
mov edi, ecx
mov ecx, esi
call fcn.004db9d0
dec eax
mov ecx, esi
mov dword [esp + 0x18], eax
call fcn.004db9f0
dec eax
mov ebp, 1
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x14], ebp
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x28]
xor ebx, ebx
add ecx, eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0x20], ecx
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
lea eax, [ebx + edx]
push eax
push ecx
mov ecx, dword [edi]
call fcn.004baa10
mov esi, eax
test esi, esi
je 0x490498
mov ecx, esi
call fcn.004e22f0
test al, al
jne 0x490441
mov ecx, esi
call fcn.004db9f0
mov ecx, esi
mov ebx, eax
call fcn.004db9d0
mov ebp, eax
push ebx
push ebp
mov ecx, edi
call fcn.00489e40
test al, al
je 0x4903ee
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
mov al, 1
jmp 0x490469
mov eax, dword [edi + 0xa0]
mov ecx, dword [edi + 0xa4]
dec eax
dec ecx
cmp ebp, eax
jge 0x49040c
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
xor al, al
jmp 0x490469
add eax, 3
cmp ebp, eax
jl 0x49041f
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
xor al, al
jmp 0x490469
cmp ebx, ecx
jge 0x49042f
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
xor al, al
jmp 0x490469
mov ebp, dword [esp + 0x14]
add ecx, 3
cmp ebx, ecx
mov ebx, dword [esp + 0x10]
setl al
jmp 0x490469
cmp dword [edi + 0xac], esi
je 0x49046d
mov edx, dword [0x7c9b10]
xor eax, eax
test edx, edx
jbe 0x490467
mov ecx, dword [edi + 0xb0]
cmp dword [ecx], esi
je 0x49047e
inc eax
add ecx, 4
cmp eax, edx
jb 0x49045b
xor al, al
test al, al
je 0x490482
lea edx, [ebx + ebp]
mov eax, dword [edi + edx*4]
mov dword [eax], 1
mov dword [eax + 4], esi
jmp 0x490498
mov al, 1
jmp 0x490469
lea eax, [ebx + ebp]
mov eax, dword [edi + eax*4]
mov ecx, esi
mov dword [eax], 2
mov dword [eax + 4], esi
call fcn.004e2330
inc ebx
cmp ebx, 3
mov dword [esp + 0x10], ebx
jl 0x49039a
mov edx, dword [esp + 0x28]
add ebp, 3
inc edx
cmp ebp, 0xa
mov dword [esp + 0x28], edx
mov dword [esp + 0x14], ebp
jl 0x490386
push str..Morrowind.ini
push 0
push str.DontThreadLoad
push str.General
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
je 0x49056a
mov ecx, dword [edi + 0xb538]
push str.TES::Resume_Thread
call fcn.00693f00
mov al, byte [edi + 0xb511]
test al, al
jne 0x490558
mov ecx, dword [0x7c9b30]
mov edx, dword [edi + 0xb504]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [edi + 0xb504]
push eax
push str.Resuming_Background_Thread__d_n
call fcn.006e9a00
add esp, 8
mov byte [edi + 0xb518], 0
mov byte [edi + 0xb511], 1
mov ecx, dword [edi + 0xb538]
call fcn.00693f10
mov ecx, dword [edi + 0xb504]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov byte [edi + 0xb50c], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
mov ecx, dword [edi + 0xb538]
call fcn.00693f10
mov byte [edi + 0xb50c], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x493dd0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x270
push ebx
push ebp
push esi
mov ebx, ecx
mov eax, dword [ebx + 0x148]
xor esi, esi
cmp eax, esi
push edi
je 0x493ee4
lea eax, [esp + 0x18]
push eax
lea ecx, [ebx + 0xb0]
push ecx
mov dword [0x7c9f7c], esi
call dword [sym.imp.MSVCRT.dll__stat]
add esp, 8
test eax, eax
jne 0x493f57
mov ebp, dword [ebx + 0x134]
mov edx, dword [esp + 0x34]
mov eax, ebp
dec ebp
test eax, eax
mov dword [esp + 0x10], edx
je 0x493f57
or ecx, 0xffffffff
xor eax, eax
mov edi, str.Data_Files_
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edx, [esp + 0x17c]
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebx + 0x148]
and ecx, 3
test eax, eax
rep movsb byte es:[edi], byte [esi]
je 0x493e68
mov ecx, dword [ebx + 0x14c]
mov edi, dword [ecx + ebp*4]
add edi, eax
jmp 0x493e6a
xor edi, edi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
lea edx, [esp + 0x17c]
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
shr ecx, 2
dec edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
lea eax, [esp + 0x18]
rep movsb byte es:[edi], byte [esi]
push eax
lea ecx, [esp + 0x180]
push ecx
call dword [sym.imp.MSVCRT.dll__stat]
add esp, 8
test eax, eax
jne 0x493ece
mov edx, dword [esp + 0x10]
cmp dword [esp + 0x34], edx
jle 0x493ece
mov eax, dword [ebx + 0x140]
mov dword [eax + ebp*8 + 4], 0
inc dword [0x7c9f7c]
mov ecx, ebp
dec ebp
test ecx, ecx
jne 0x493e28
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x270
ret
push str..Morrowind.ini
push esi
push str.TryArchiveFirst
push str.General
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
jne 0x493f57
mov ecx, 0x50
lea edi, [esp + 0x3c]
lea edx, [esp + 0x3c]
rep stosd dword es:[edi], eax
push edx
lea eax, [ebx + 0xb0]
push eax
mov dword [0x7c9f7c], esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
test eax, eax
je 0x493f57
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x54]
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], ecx
push str.Meshes
mov ecx, ebx
mov dword [esp + 0x1c], edx
call fcn.00493f70
lea ecx, [esp + 0x10]
push ecx
push str.Textures
mov ecx, ebx
call fcn.00493f70
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x270
ret
Function at 0x493f70
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x45c
push ebx
push ebp
push esi
push edi
mov ebp, ecx
push 0
lea ecx, [esp + 0x1c]
call fcn.00494380
xor eax, eax
mov ecx, 0x50
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
or ecx, 0xffffffff
mov edi, str.Data_Files_
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
mov ebx, dword [esp + 0x470]
lea edx, [esp + 0x368]
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
xor eax, eax
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
lea edx, [esp + 0x368]
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, str..
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
lea edx, [esp + 0x368]
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
shr ecx, 2
dec edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
lea eax, [esp + 0x20]
rep movsb byte es:[edi], byte [esi]
push eax
lea ecx, [esp + 0x36c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
test eax, eax
mov dword [esp + 0x10], eax
je 0x4941f3

Function at 0x494220
Capabilities:
Write file on windows

Disassembly:
mov dword [ecx], 0x7478bc
mov byte [ecx + 0x1c], 0
jmp fcn.00475640
Function at 0x49fe70
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x72b9b3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.004eee80
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], 0
call fcn.0047e1e0
mov dword [esi], 0x748110
xor eax, eax
mov ecx, 8
lea edi, [esi + 0x44]
rep stosd dword es:[edi], eax
mov ecx, 8
lea edi, [esi + 0x64]
rep stosd dword es:[edi], eax
mov ecx, 8
lea edi, [esi + 0x88]
rep stosd dword es:[edi], eax
lea ecx, [esi + 0xa8]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
push 1
mov ecx, esi
mov byte [esp + 0x18], 1
mov dword [esi + 0x84], eax
mov dword [esi + 4], 0x41505041
call fcn.004eed40
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4a1e90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x72baa3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.004eee80
xor ebp, ebp
lea ecx, [esi + 0x30]
mov dword [esp + 0x1c], ebp
call fcn.0047e1e0
lea eax, [esi + 0x4c]
push ebp
lea edi, [esi + 0x44]
lea ebx, [esi + 0x50]
push eax
mov byte [esp + 0x24], 1
mov dword [esi], 0x7484ec
mov dword [eax], ebp
mov dword [edi], ebp
mov dword [esi + 0x48], ebp
mov dword [ebx], ebp
call fcn.0047b410
push ebp
push edi
call fcn.0047b410
push ebp
push ebx
mov dword [esi + 0x48], ebp
call fcn.0047b410
xor eax, eax
lea ecx, [esi + 0x54]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov edx, dword [0x7ca44c]
push edx
call fcn.00727530
add esp, 0x1c
mov dword [0x7ca44c], ebp
push 1
mov ecx, esi
mov dword [esi + 4], 0x4b4f4f42
mov dword [esi + 0x68], ebp
call fcn.004eed40
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4a1f70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x72bac3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x7484ec
mov eax, dword [0x7ca44c]
push eax
mov dword [esp + 0x18], 1
call fcn.00727530
mov edi, dword [sym.imp.MSVCRT.dll_free]
mov dword [0x7ca44c], 0
mov ecx, dword [esi + 8]
shr ecx, 3
add esp, 4
test cl, 1
jne 0x4a1fd2
mov eax, dword [esi + 0x68]
test eax, eax
je 0x4a1fd2
push eax
call edi
add esp, 4
lea edx, [esi + 0x4c]
push 0
push edx
call fcn.0047b410
lea eax, [esi + 0x44]
push 0
push eax
call fcn.0047b410
lea ecx, [esi + 0x50]
push 0
push ecx
call fcn.0047b410
mov edx, dword [esi + 8]
shr edx, 3
add esp, 0x18
test dl, 1
jne 0x4a200e
mov eax, dword [esi + 0x48]
test eax, eax
je 0x4a200e
push eax
call edi
add esp, 4
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 0
call fcn.0047e280
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.004eef50
mov ecx, dword [esp + 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4a57f0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x72bc13
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.004eee80
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], 0
call fcn.0047e1e0
mov dword [esi], 0x748bc8
xor eax, eax
mov ecx, 8
lea edi, [esi + 0x64]
rep stosd dword es:[edi], eax
mov ecx, 8
lea edi, [esi + 0x44]
rep stosd dword es:[edi], eax
mov ecx, 8
lea edi, [esi + 0x88]
rep stosd dword es:[edi], eax
mov dword [esi + 0x84], eax
mov ecx, 0xe
lea edi, [esi + 0xa8]
rep stosd dword es:[edi], eax
or eax, 0xffffffff
mov dword [esi + 0xb0], eax
mov dword [esi + 0xb4], eax
mov dword [esi + 0xb8], eax
mov dword [esi + 0xbc], eax
or ecx, 0xffffffff
mov dword [esi + 0xc0], ecx
mov dword [esi + 0xc4], ecx
mov dword [esi + 0xc8], ecx
mov dword [esi + 0xcc], ecx
or edx, 0xffffffff
mov dword [esi + 0xd0], edx
mov dword [esi + 0xd4], edx
mov dword [esi + 0xd8], edx
mov dword [esi + 0xdc], edx
push 1
mov ecx, esi
mov byte [esp + 0x18], 1
mov dword [esi + 4], 0x52474e49
call fcn.004eed40
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4a5de0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x72bc53
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.004eee80
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], 0
call fcn.0047e1e0
xor eax, eax
mov dword [esi], 0x748d10
mov ecx, 8
lea edi, [esi + 0x68]
rep stosd dword es:[edi], eax
mov ecx, 8
lea edi, [esi + 0x44]
rep stosd dword es:[edi], eax
mov ecx, 8
lea edi, [esi + 0x88]
rep stosd dword es:[edi], eax
mov dword [esi + 0x64], eax
lea ecx, [esi + 0xa8]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
push 1
mov ecx, esi
mov byte [esp + 0x18], 1
mov dword [esi + 4], 0x4b434f4c
call fcn.004eed40
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4a6320
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x72bc93
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004eee80
lea ecx, [esi + 0x30]
mov dword [esp + 0x18], 0
call fcn.0047e1e0
lea eax, [esi + 0x4c]
push 0
lea edi, [esi + 0x44]
lea ebx, [esi + 0x50]
push eax
mov byte [esp + 0x20], 1
mov dword [esi], 0x748e58
mov dword [eax], 0
mov dword [edi], 0
mov dword [esi + 0x48], 0
mov dword [ebx], 0
call fcn.0047b410
push 0
push edi
call fcn.0047b410
push 0
push ebx
mov dword [esi + 0x48], 0
call fcn.0047b410
xor eax, eax
lea ecx, [esi + 0x54]
mov dword [ecx], eax
mov dword [ecx + 4], eax
add esp, 0x18
mov dword [ecx + 8], eax
push 1
mov ecx, esi
mov dword [esi + 4], 0x4353494d
call fcn.004eed40
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret