joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ba9ae
Capabilities:
Parse pe header

Disassembly:
movsx eax, byte [esp + 4]
add eax, 0xffffff9f
cmp eax, 0x19
ja case.default.0x4ba9bb
jmp dword [eax*4 + 0x4baa16]
mov al, 0x41
ret
mov al, 0x42
ret
mov al, 0x43
ret
mov al, 0x44
ret
mov al, 0x45
ret
mov al, 0x46
ret
mov al, 0x47
ret
mov al, 0x48
ret
mov al, 0x49
ret
mov al, 0x4a
ret
mov al, 0x4b
ret
mov al, 0x4c
ret
mov al, 0x4d
ret
mov al, 0x4e
ret
mov al, 0x4f
ret
mov al, 0x50
ret
mov al, 0x51
ret
mov al, 0x52
ret
mov al, 0x53
ret
mov al, 0x54
ret
mov al, 0x55
ret
mov al, 0x56
ret
mov al, 0x57
ret
mov al, 0x58
ret
mov al, 0x59
ret
mov al, 0x5a
ret
mov al, byte [esp + 4]
ret

Function at 0x4be720
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esi]
cmp dword [eax + 4], 2
push edi
jne 0x4be745
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x4be734
xor eax, eax
pop edi
ret
push dword [eax + 8]
push dword [esp + 0x10]
push 1
push dword [esp + 0x14]
call ecx
jmp 0x4be778
cmp dword [esi + 8], 0
jne 0x4be766
push 0x4e7be0
push dword [eax + 8]
call fcn.0048dfa1
test eax, eax
pop ecx
pop ecx
mov dword [esi + 8], eax
jne 0x4be766
or eax, 0xffffffff
pop edi
ret
push dword [esi + 8]
push dword [esp + 0x10]
push 1
push dword [esp + 0x14]
call fcn.0048d8a9
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x4be798
mov eax, dword [esi + 8]
test eax, eax
je 0x4be792
push eax
call fcn.0048d936
and dword [esi + 8], edi
pop ecx
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
mov eax, edi
pop edi
ret
Function at 0x4c1930
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4c1953
xor eax, eax
jmp 0x4c1a1e
push 1
mov edx, dword [ebp - 8]
push edx
call fcn.0048aff5
add esp, 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4c1971
xor eax, eax
jmp 0x4c1a1e
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x4c199d
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00489ff4
add esp, 4
xor eax, eax
jmp 0x4c1a1e
mov dword [ebp - 0x14], 0
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x14]
push eax
push 0x4dfab8
mov ecx, dword [ebp - 0x18]
push ecx
call sub.VERSION.dll_VerQueryValueW
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4c1a10
cmp dword [ebp - 0x14], 0
je 0x4c1a10
push 0x10
call fcn.00443835
add esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4c19fc
mov edx, dword [ebp - 0x14]
movzx eax, word [edx + 2]
push eax
mov ecx, dword [ebp - 0x14]
movzx edx, word [ecx]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x20]
call fcn.004c18d0
mov dword [ebp - 0x24], eax
jmp 0x4c1a03
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
jmp 0x4c1a1e
mov edx, dword [ebp - 0x18]
push edx
call fcn.00489ff4
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4c1a30
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x50331c]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov dword [ebp - 0x25c], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x25c]
mov dx, word [ecx + 4]
mov word [ebp + eax*2 - 0x18], dx
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x25c]
mov ax, word [edx + 8]
mov word [ebp + ecx*2 - 0x18], ax
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov edx, dword [ebp - 4]
mov word [ebp + edx*2 - 0x18], ax
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x25c]
mov ax, word [edx + 8]
mov word [ebp + ecx*2 - 0x18], ax
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x25c]
mov cx, word [eax + 4]
mov word [ebp + edx*2 - 0x18], cx
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov word [ebp + eax*2 - 0x18], 0x4e4
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov edx, dword [ebp - 4]
mov word [ebp + edx*2 - 0x18], ax
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov word [ebp + ecx*2 - 0x18], 0x4e4
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 8
jae 0x4c1bc0
mov eax, dword [ebp - 4]
mov cx, word [ebp + eax*2 - 0x18]
mov word [ebp - 0x2c], cx
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov cx, word [ebp + eax*2 - 0x18]
mov word [ebp - 0x1c], cx
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
push eax
movzx ecx, word [ebp - 0x1c]
push ecx
movzx edx, word [ebp - 0x2c]
push edx
push 0x4dfcc4
push 0x104
push 0x104
lea eax, [ebp - 0x238]
push eax
call fcn.0048a355
add esp, 0x1c
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x238]
push eax
mov ecx, dword [ebp - 0x25c]
mov edx, dword [ecx]
push edx
call sub.VERSION.dll_VerQueryValueW
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x4c1bbb
cmp dword [ebp - 0x20], 0
je 0x4c1bbb
mov eax, dword [ebp - 0x20]
push eax
mov esi, dword [ebp + 0xc]
call fcn.00435a66
mov al, 1
jmp 0x4c1bc2
jmp 0x4c1b18
xor al, al
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00491d9b
mov esp, ebp
pop ebp
ret 8
Function at 0x4c1d00
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4f5320
push 0x494ae0
mov eax, dword fs:[0]
push eax
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, dword [0x50331c]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
cmp dword [ebp + 8], 0
je 0x4c1d5a
cmp dword [ebp + 0xc], 0
je 0x4c1d5a
cmp dword [ebp + 0x10], 1
jae 0x4c1d5f
jmp 0x4c1e3d
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jb 0x4c1d81
mov ecx, dword [ebp + 0x10]
sub ecx, 1
cmp dword [ebp - 0x1c], ecx
jbe 0x4c1d86
jmp 0x4c1e3d
mov dword [ebp - 4], 0
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048873c
add esp, 4
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x4c1dc1
mov dword [ebp - 4], 0xfffffffe
jmp 0x4c1e3d
mov ecx, dword [ebp - 0x1c]
shl ecx, 1
push ecx
push 0
mov edx, dword [ebp - 0x20]
push edx
call fcn.00489db0
add esp, 0xc
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4c1e1d
mov eax, dword [ebp + 0x10]
sub eax, 1
cmp dword [ebp - 0x1c], eax
ja 0x4c1e1d
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp + 0x10]
sub eax, 1
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004898fa
add esp, 0x10
mov dword [ebp - 0x24], 1
mov dword [ebp - 4], 0xfffffffe
jmp 0x4c1e3d
cmp dword [ebp - 0x20], 0
je 0x4c1e5c
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
push eax
call fcn.0048aed2
add esp, 4
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c1ed0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
mov eax, dword [0x50331c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, dword [ebp + 8]
call fcn.004220b9
movzx eax, al
test eax, eax
je 0x4c1efa
xor eax, eax
jmp 0x4c2162
mov word [ebp - 0x218], 0
push 0x208
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.00489db0
add esp, 0xc
push 0x4dfd04
xor ecx, ecx
mov esi, dword [ebp + 8]
call fcn.00416053
cmp eax, 0xffffffff
je 0x4c1f6b
push 0x104
lea edx, [ebp - 0x218]
push edx
push 0x4dfd28
call fcn.004c1d00
add esp, 0xc
test eax, eax
jne 0x4c1f51
xor eax, eax
jmp 0x4c2162
lea eax, [ebp - 0x218]
push eax
push 0x4dfd4c
mov ecx, dword [ebp + 8]
push ecx
call fcn.0045b8d1
jmp 0x4c2151
push 0x4dfd70
xor ecx, ecx
mov esi, dword [ebp + 8]
call fcn.00416053
cmp eax, 0xffffffff
je 0x4c1fbd
push 0x104
lea edx, [ebp - 0x218]
push edx
push 0x4dfd84
call fcn.004c1d00
add esp, 0xc
test eax, eax
jne 0x4c1fa3
xor eax, eax
jmp 0x4c2162
lea eax, [ebp - 0x218]
push eax
push 0x4dfd98
mov ecx, dword [ebp + 8]
push ecx
call fcn.0045b8d1
jmp 0x4c2151
push 0x4dfdac
xor ecx, ecx
mov esi, dword [ebp + 8]
call fcn.00416053
cmp eax, 0xffffffff
je 0x4c200f
push 0x104
lea edx, [ebp - 0x218]
push edx
push 0x4dfdbc
call fcn.004c1d00
add esp, 0xc
test eax, eax
jne 0x4c1ff5
xor eax, eax
jmp 0x4c2162
lea eax, [ebp - 0x218]
push eax
push 0x4dfdcc
mov ecx, dword [ebp + 8]
push ecx
call fcn.0045b8d1
jmp 0x4c2151
push 0x4dfddc
xor ecx, ecx
mov esi, dword [ebp + 8]
call fcn.00416053
cmp eax, 0xffffffff
je 0x4c205a
push 0x104
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
ja 0x4c2040
xor eax, eax
jmp 0x4c2162
lea eax, [ebp - 0x218]
push eax
push 0x4dfdf0
mov ecx, dword [ebp + 8]
push ecx
call fcn.0045b8d1
jmp 0x4c2151
push 0x4dfe04
xor ecx, ecx
mov esi, dword [ebp + 8]
call fcn.00416053
cmp eax, 0xffffffff
je 0x4c20a5
push 0x104
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
ja 0x4c208b
xor eax, eax
jmp 0x4c2162
lea eax, [ebp - 0x218]
push eax
push 0x4dfe18
mov ecx, dword [ebp + 8]
push ecx
call fcn.0045b8d1
jmp 0x4c2151
push 0x4dfe2c
xor ecx, ecx
mov esi, dword [ebp + 8]
call fcn.00416053
cmp eax, 0xffffffff
je 0x4c2107
push 0x20a
push 0
lea edx, [ebp - 0x218]
push edx
call fcn.00489db0
add esp, 0xc
push 0x105
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea edx, [ebp - 0x218]
push edx
push 0x4dfe40
mov eax, dword [ebp + 8]
push eax
call fcn.0045b8d1
jmp 0x4c2151
push 0x4dfe54
xor ecx, ecx
mov esi, dword [ebp + 8]
call fcn.00416053
cmp eax, 0xffffffff
je 0x4c2151
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push 0x4dfe70
call fcn.004c1d00
add esp, 0xc
test eax, eax
jne 0x4c213c
xor eax, eax
jmp 0x4c2162
lea edx, [ebp - 0x218]
push edx
push str._Systemroot_
mov eax, dword [ebp + 8]
push eax
call fcn.0045b8d1
mov ecx, dword [ebp + 8]
push ecx
call fcn.004c1e80
add esp, 4
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00491d9b
mov esp, ebp
pop ebp
ret
Function at 0x4c2470
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x50331c]
xor eax, ebp
mov dword [ebp - 8], eax
mov word [ebp - 0x218], 0
push 0x208
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.00489db0
add esp, 0xc
mov byte [ebp - 1], 0
push 0x104
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
ja 0x4c24c6
jmp 0x4c2573
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov dword [ebp - 0x21c], 0
jmp 0x4c24ee
mov eax, dword [ebp - 0x21c]
add eax, 1
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 1
jae 0x4c2573
mov word [ebp - 0x430], 0
push 0x208
push 0
lea ecx, [ebp - 0x42e]
push ecx
call fcn.00489db0
add esp, 0xc
push 0xffffffffffffffff
lea edx, [ebp - 0x218]
push edx
push 0x104
lea eax, [ebp - 0x430]
push eax
call fcn.004898fa
add esp, 0x10
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x21c]
mov edx, dword [ecx*4 + 0x509220]
push edx
push 0x104
lea eax, [ebp - 0x430]
push eax
call fcn.004c110d
add esp, 0x10
lea ecx, [ebp - 0x430]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4c256e
mov byte [ebp - 1], 1
jmp 0x4c2573
jmp 0x4c24df
mov al, byte [ebp - 1]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00491d9b
mov esp, ebp
pop ebp
ret

Function at 0x4c2590
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov byte [ebp - 0xd], 0
push 0x288
call fcn.0048b93c
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4c25b7
xor al, al
jmp 0x4c26a1
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x288
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.iphlpapi.dll_GetAdaptersInfo
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x6f
jne 0x4c261a
mov edx, dword [ebp - 0x14]
push edx
call fcn.00489ff4
add esp, 4
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0xc]
push eax
call fcn.0048b93c
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4c260a
xor al, al
jmp 0x4c26a1
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call sub.iphlpapi.dll_GetAdaptersInfo
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
jne 0x4c267e
cmp dword [ebp - 0x14], 0
je 0x4c267e
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0x190], 3
ja 0x4c2642
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov dword [ebp - 0x14], eax
jmp 0x4c2626
mov ecx, dword [ebp - 0x14]
movzx edx, byte [ecx + 0x194]
cmp edx, 0x52
jne 0x4c2674
mov eax, dword [ebp - 0x14]
movzx ecx, byte [eax + 0x195]
cmp ecx, 0x54
jne 0x4c2674
mov edx, dword [ebp - 0x14]
movzx eax, byte [edx + 0x196]
test eax, eax
jne 0x4c2674
mov byte [ebp - 0xd], 1
jmp 0x4c267e
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
jmp 0x4c2626
cmp dword [ebp - 8], 0
je 0x4c269e
mov eax, dword [ebp - 8]
push eax
call fcn.00489ff4
add esp, 4
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret
Function at 0x4c26b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov byte [ebp - 9], 0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4c26f0
mov byte [ebp - 9], 0
jmp 0x4c276d
push 0x80
call fcn.0048b93c
add esp, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x14], 0x50
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
lea edx, [ebp - 0x1c]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4c2739
mov byte [ebp - 9], 0
jmp 0x4c2751
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.00431a31
add esp, 8
test eax, eax
je 0x4c2751
mov byte [ebp - 9], 1
cmp dword [ebp - 0x18], 0
je 0x4c2763
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00489ff4
add esp, 4
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret

Function at 0x4c2850
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x50331c]
xor eax, ebp
mov dword [ebp - 8], eax
mov word [ebp - 0x218], 0
push 0x208
push 0
lea eax, [ebp - 0x216]
push eax
call fcn.00489db0
add esp, 0xc
mov byte [ebp - 1], 0
push 0x104
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
ja 0x4c28a6
jmp 0x4c2953
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov dword [ebp - 0x21c], 0
jmp 0x4c28ce
mov eax, dword [ebp - 0x21c]
add eax, 1
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 5
jae 0x4c2953
mov word [ebp - 0x430], 0
push 0x208
push 0
lea ecx, [ebp - 0x42e]
push ecx
call fcn.00489db0
add esp, 0xc
push 0xffffffffffffffff
lea edx, [ebp - 0x218]
push edx
push 0x104
lea eax, [ebp - 0x430]
push eax
call fcn.004898fa
add esp, 0x10
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x21c]
mov edx, dword [ecx*4 + 0x5091f8]
push edx
push 0x104
lea eax, [ebp - 0x430]
push eax
call fcn.004c110d
add esp, 0x10
lea ecx, [ebp - 0x430]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4c294e
mov byte [ebp - 1], 1
jmp 0x4c2953
jmp 0x4c28bf
mov al, byte [ebp - 1]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00491d9b
mov esp, ebp
pop ebp
ret
Function at 0x4c2970
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x50331c]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x23d], 0
mov dword [ebp - 0x23c], 0xffffffff
mov dword [ebp - 0x238], 0
push 0x228
push 0
lea eax, [ebp - 0x234]
push eax
call fcn.00489db0
add esp, 0xc
mov dword [ebp - 0x238], 0x22c
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0xffffffff
jne 0x4c29da
jmp 0x4c2a29
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp - 0x23c]
push edx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4c2a29
lea eax, [ebp - 0x214]
push eax
push str.vmusrvc.exe
call fcn.0048b85c
add esp, 8
test eax, eax
jne 0x4c2a12
mov byte [ebp - 0x23d], 1
jmp 0x4c2a29
lea ecx, [ebp - 0x238]
push ecx
mov edx, dword [ebp - 0x23c]
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4c29f1
cmp dword [ebp - 0x23c], 0
je 0x4c2a49
mov eax, dword [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x23c], 0
mov al, byte [ebp - 0x23d]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00491d9b
mov esp, ebp
pop ebp
ret
Function at 0x4c51c0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x50331c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x10], 0x80004005
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x28], 0xffffffff
mov byte [ebp - 0xc], 0
xor eax, eax
mov dword [ebp - 0xb], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x2c], 0
cmp dword [ebp + 8], 0
je 0x4c5221
mov ecx, dword [ebp + 8]
movzx edx, word [ecx]
test edx, edx
jne 0x4c522b
jmp 0x4c534e
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x4c525a
jmp 0x4c534e
push 0
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
ja 0x4c5279
jmp 0x4c534e
push 0
lea edx, [ebp - 0x1c]
push edx
push 4
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4c52a2
jmp 0x4c534e
lea edx, [ebp - 0xc]
push edx
call fcn.004c50e0
add esp, 4
test eax, eax
jne 0x4c52bc
jmp 0x4c534e
mov eax, dword [ebp - 0x14]
sub eax, 4
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
add ecx, 1
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x4c52e1
jmp 0x4c534e
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x2c]
mov dword [edx], eax
push 0
push 0
push 4
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4c531e
jmp 0x4c534e
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.004c5110
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x4c534e
cmp dword [ebp - 0x24], 0
je 0x4c534e
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x24], 0
cmp dword [ebp - 0x28], 0xffffffff
je 0x4c5365
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00491d9b
mov esp, ebp
pop ebp
ret
Function at 0x4c5430
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4f5360
push 0x494ae0
mov eax, dword fs:[0]
push eax
add esp, 0xffffffe4
push ebx
push esi
push edi
mov eax, dword [0x50331c]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
cmp dword [ebp + 8], 0
je 0x4c548a
cmp dword [ebp + 0xc], 0
je 0x4c548a
cmp dword [ebp + 0x10], 1
jae 0x4c548f
jmp 0x4c556d
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jb 0x4c54b1
mov ecx, dword [ebp + 0x10]
sub ecx, 1
cmp dword [ebp - 0x1c], ecx
jbe 0x4c54b6
jmp 0x4c556d
mov dword [ebp - 4], 0
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048873c
add esp, 4
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x4c54f1
mov dword [ebp - 4], 0xfffffffe
jmp 0x4c556d
mov ecx, dword [ebp - 0x1c]
shl ecx, 1
push ecx
push 0
mov edx, dword [ebp - 0x20]
push edx
call fcn.00489db0
add esp, 0xc
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4c554d
mov eax, dword [ebp + 0x10]
sub eax, 1
cmp dword [ebp - 0x1c], eax
ja 0x4c554d
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp + 0x10]
sub eax, 1
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004898fa
add esp, 0x10
mov dword [ebp - 0x24], 1
mov dword [ebp - 4], 0xfffffffe
jmp 0x4c556d
cmp dword [ebp - 0x20], 0
je 0x4c558c
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
push eax
call fcn.0048aed2
add esp, 4
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c5630
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
call fcn.00421fdc
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4c5650
xor eax, eax
jmp 0x4c5661
mov eax, dword [ebp - 4]
and eax, 0x10
je 0x4c565c
xor eax, eax
jmp 0x4c5661
mov eax, 1
mov esp, ebp
pop ebp
ret