joyce8/EMBER2024-capa huggingface dataset:
Function at 0x447690
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x5d86f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.00549ef3
add esp, 4
mov byte [ebp - 0x108], 0
test eax, eax
je 0x4476f4
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [ebp - 0x108], 0
je 0x4476f4
lea edx, [ebp - 0x108]
push edx
call dword [0x5d037c]
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054546b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.0054546b
mov esp, ebp
pop ebp
ret

Function at 0x447710
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00447690

Function at 0x44b2f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push str.kernel32
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x44b314
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
push str.LoadLibraryExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, dword [ebp + 8]
mov edi, eax
push 0x5943fc
push ebx
mov dword [ebp - 8], edi
call fcn.0054bdde
add esp, 8
test eax, eax
je 0x44b362
test edi, edi
je 0x44b351
push 8
push 0
push ebx
call edi
pop edi
pop ebx
mov dword [ebp - 4], eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
pop ebx
mov dword [ebp - 4], eax
pop esi
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x44b38a
push str.AddDllDirectory
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x44b38a
push 0x800
push 0
push ebx
call edi
pop edi
pop ebx
mov dword [ebp - 4], eax
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, eax
test edi, edi
je 0x44b426
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44b3a3
sub eax, edx
lea eax, [eax + edi + 1]
push eax
call dword [0x5d0370]
mov esi, eax
add esp, 4
test esi, esi
je 0x44b41c
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x44b41c
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44b3d1
sub eax, edx
mov ecx, 0x5c
mov word [eax + esi], cx
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44b3e8
sub eax, edx
lea edx, [eax + esi]
mov ecx, ebx
sub edx, ebx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x44b3f8
mov eax, dword [ebp - 8]
test eax, eax
je 0x44b412
push 8
push 0
push esi
call eax
jmp 0x44b419
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 4], eax
push esi
call dword [0x5d0374]
add esp, 4
mov eax, dword [ebp - 4]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44e290
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x474
call fcn.005458d0
mov eax, dword [0x5d86f0]
xor eax, esp
mov dword [esp + 0x470], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esp + 0x3c], 0
test esi, esi
jne 0x44e2d7
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x470]
xor ecx, esp
call fcn.0054546b
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x48]
push eax
push esi
call fcn.0054c054
add esp, 8
test eax, eax
js 0x44e2c0
mov eax, 8
call fcn.005458d0
fldz
fstp qword [esp]
lea ecx, [esp + 0x50]
push 0x30
push ecx
call fcn.0040f490
mov ebx, dword [ebp + 0xc]
add esp, 0x10
test ebx, ebx
je 0x44e2c0
push 0x57ce20
push esi
call fcn.00545eee
add esp, 8
mov dword [esp + 0x40], eax
test eax, eax
je 0x44e3b1
jmp 0x44e334
mov eax, dword [esp + 0x40]
test ebx, ebx
jle 0x44e342
mov esi, ebx
cmp ebx, 0x400
jl 0x44e347
mov esi, 0x400
push eax
push esi
lea edx, [esp + 0x80]
push 1
push edx
call fcn.0054610d
mov edi, eax
add esp, 0x10
mov dword [esp + 0x44], edi
test edi, edi
jle 0x44e395
fild dword [esp + 0x44]
mov eax, 8
call fcn.005458d0
lea eax, [esp + 0x80]
fstp qword [esp]
push esi
push eax
call fcn.0040f490
add dword [esp + 0x4c], edi
add esp, 0x10
test ebx, ebx
jle 0x44e330
sub ebx, esi
test ebx, ebx
jg 0x44e330
mov ecx, dword [esp + 0x40]
push ecx
call fcn.00545d43
lea edx, [esp + 0x7c]
push 0x400
push edx
call fcn.004c9fd0
add esp, 0xc
mov ecx, dword [esp + 0x47c]
mov eax, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0054546b
mov esp, ebp
pop ebp
ret

Function at 0x460820
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
push ebx
mov ebx, dword [ecx]
mov dword [ebp - 4], ecx
mov ecx, dword [ebx + 0x204]
push esi
push edi
mov esi, ecx
test ecx, ecx
jne 0x460841
mov esi, dword [eax + 0x28]
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
push ecx
push edx
call fcn.00423070
push edx
push eax
call fcn.004230a0
mov ecx, eax
mov eax, esi
mov dword [ebp + 8], edx
cdq
add esp, 0x10
mov edi, eax
sub edi, ecx
mov esi, edx
sbb esi, dword [ebp + 8]
cmp dword [ebx + 0x1f8], 0
je 0x4608ad
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x18c]
mov eax, dword [eax + 0x188]
push edx
push eax
call fcn.00423070
push edx
push eax
call fcn.004230a0
mov ecx, eax
mov eax, dword [ebx + 0x1f8]
mov dword [ebp + 8], edx
cdq
add esp, 0x10
sub eax, ecx
sbb edx, dword [ebp + 8]
cmp esi, edx
jl 0x4608ad
jg 0x4608b1
cmp edi, eax
jae 0x4608b1
mov eax, edi
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x461980
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [esi + edi - 1], 0
test eax, eax
jne 0x4619b3
push 0x2e
push esi
call fcn.00548f20
add esp, 8
test eax, eax
je 0x4619b1
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x464e80
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, eax
mov eax, dword [esi]
cmp dword [eax + 4], 3
jne 0x464ea2
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x464e96
xor eax, eax
pop edi
ret
mov eax, dword [eax + 8]
push eax
push edi
push 1
push ebx
call ecx
jmp 0x464ed2
cmp dword [esi + 8], 0
jne 0x464ec5
mov ecx, dword [eax + 8]
push 0x57ce20
push ecx
call fcn.00545eee
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x464ec5
or eax, 0xffffffff
pop edi
ret
mov edx, dword [esi + 8]
push edx
push edi
push 1
push ebx
call fcn.0054610d
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x464ef4
mov eax, dword [esi + 8]
test eax, eax
je 0x464eee
push eax
call fcn.00545d43
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, edi
pop edi
ret
Function at 0x492610
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [0x5d0370]
mov edi, eax
add esp, 4
test edi, edi
jne 0x49263b
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
add edx, eax
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], edx
cmp ebx, dword [esi + 0x10]
jbe 0x492682
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebx
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov eax, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], eax
jmp 0x492685
mov ebx, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
mov edx, dword [esi]
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi]
push eax
call ecx
mov eax, dword [ebp + 0x10]
add esp, 8
mov dword [ebp - 4], 0
test eax, eax
je 0x4926e6
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
lea esp, [esp]
mov dl, byte [ebx]
xor dl, 0x36
mov byte [ebp + 0xb], dl
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
lea eax, [ebp + 0xb]
push eax
push ecx
call edx
mov al, byte [ebx]
xor al, 0x5c
mov byte [ebp + 0xb], al
mov edx, dword [edi + 8]
mov eax, dword [esi + 4]
push 1
lea ecx, [ebp + 0xb]
push ecx
push edx
inc ebx
call eax
add esp, 0x18
dec dword [ebp - 8]
jne 0x4926b0
mov ecx, dword [ebp - 4]
pop ebx
cmp ecx, dword [esi + 0x10]
jae 0x49271f
nop
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push 1
push 0x5a51fc
push edx
call eax
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
push 0x5a51fd
push ecx
call edx
mov eax, dword [ebp - 4]
inc eax
add esp, 0x18
mov dword [ebp - 4], eax
cmp eax, dword [esi + 0x10]
jb 0x4926f0
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x499a00
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.005458d0
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi]
inc ebp
cmp eax, 0x302
jge 0x499a36
cmp eax, 0x100
je 0x499a36
mov esi, dword [esp + 0x18]
cmp ebp, dword [esi + 4]
jbe 0x499a55
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [eax + 4]
lea esi, [edx + ebp]
cmp esi, ecx
ja 0x499a2f
add dword [eax + 0xc], edx
add dword [eax + 0x10], edx
sub ecx, edx
mov dword [eax + 4], ecx
mov esi, eax
test dword [edi + 0x100], 0x200
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 4]
push ebx
movzx ebx, byte [eax + ecx - 1]
je 0x499aa8
cmp dword [edi + 0x88], 0
jne 0x499aa8
mov edx, dword [edi + 0x58]
push 8
add edx, 8
push 0x5a5b58
push edx
call fcn.00407250
add esp, 0xc
test eax, eax
jne 0x499a9b
test bl, 1
jne 0x499a9b
mov eax, dword [edi + 0x58]
or dword [eax], 8
mov eax, dword [edi + 0x58]
test byte [eax], 8
je 0x499aa8
test ebx, ebx
je 0x499aa8
dec ebx
mov ecx, dword [edi + 0x80]
mov edx, dword [ecx]
push edx
call fcn.00474bd0
add esp, 4
test eax, 0x200000
je 0x499ad3
or eax, 0xffffffff
sub eax, ebx
add dword [esi + 4], eax
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
pop ecx
ret
mov edi, dword [esi + 4]
lea eax, [ebx + ebp]
mov esi, edi
sub esi, eax
xor esi, eax
mov ecx, edi
xor ecx, eax
or esi, ecx
xor esi, edi
shr esi, 0x1f
mov ecx, 0xff
lea eax, [edi - 1]
dec esi
mov dword [esp + 0x18], ecx
cmp eax, ecx
jae 0x499b01
mov ecx, eax
mov dword [esp + 0x18], eax
xor ebp, ebp
test ecx, ecx
je 0x499b57
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 0xc]
mov ecx, ebx
shr ecx, 0x1f
lea edx, [eax + edi - 1]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x24], edx
nop
mov edx, ebx
sub edx, ebp
shr edx, 0x1f
mov eax, ebp
shr eax, 0x1f
xor dl, al
xor cl, al
or dl, cl
mov ecx, dword [esp + 0x10]
xor dl, cl
dec dl
movzx eax, dl
mov edx, dword [esp + 0x24]
movzx edx, byte [edx]
dec dword [esp + 0x24]
xor edx, ebx
and eax, edx
not eax
inc ebp
and esi, eax
cmp ebp, dword [esp + 0x18]
jb 0x499b20
mov edx, dword [esp + 0x1c]
not esi
and esi, 0xff
lea ecx, [esi - 1]
shr ecx, 0x1f
not esi
shr esi, 0x1f
and ecx, esi
neg ecx
lea eax, [ebx + 1]
and eax, ecx
sub edi, eax
shl eax, 8
or dword [edx], eax
pop ebx
mov dword [edx + 4], edi
mov eax, ecx
pop edi
and eax, 1
not ecx
pop esi
or eax, ecx
pop ebp
pop ecx
ret
Function at 0x4a2340
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
mov byte [edi], 0
cmp eax, 0x80
jle 0x4a235a
mov eax, 0x80
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jle 0x4a236a
cmp ecx, 0x400
jle 0x4a236f
mov ecx, 0x400
test eax, eax
jle 0x4a238a
mov esi, dword [esp + 0x18]
push ebp
mov edx, edi
sub esi, edi
mov ebp, eax
mov edi, edi
mov bl, byte [esi + edx]
mov byte [edx], bl
inc edx
dec ebp
jne 0x4a2380
pop ebp
movzx edx, byte [edi + eax - 1]
cmp eax, 0x80
jge 0x4a23be
mov esi, edi
sub esi, eax
lea ebx, [ebx]
movzx ebx, byte [esi + eax]
add ebx, edx
and ebx, 0xff
movzx edx, byte [ebx + 0x5a7bd8]
mov byte [eax + edi], dl
inc eax
cmp eax, 0x80
jl 0x4a23a0
lea edx, [ecx + 7]
neg ecx
sar edx, 3
mov eax, 0x80
and ecx, 7
sub eax, edx
lea esi, [eax + edi]
mov ebx, 0xff
sar ebx, cl
movzx ecx, byte [esi]
and ebx, ecx
movzx ecx, byte [ebx + 0x5a7bd8]
mov byte [esi], cl
test eax, eax
je 0x4a2404
lea esp, [esp]
movzx ebx, byte [esi + edx - 1]
dec esi
xor ebx, ecx
dec eax
movzx ecx, byte [ebx + 0x5a7bd8]
mov byte [esi], cl
jne 0x4a23f0
lea ecx, [edi + 0xfc]
lea eax, [edi + 0x7e]
mov edx, 0x40
movzx esi, byte [eax + 1]
movzx edi, byte [eax]
shl esi, 8
or esi, edi
and esi, 0xffff
mov dword [ecx], esi
sub ecx, 4
sub eax, 2
dec edx
jne 0x4a2412
pop edi
pop esi
pop ebx
ret
Function at 0x4aeff0
Capabilities:
Resolve dns

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push edi
push esi
mov ecx, ebp
mov ebx, 1
call fcn.004aeec0
mov edi, eax
add esp, 4
test edi, edi
jns 0x4af02c
push 0x7b
push str..crypto_bio_b_sock.c
push 0x6c
push 0x6a
push 0x20
call fcn.004039b0
add esp, 0x14
jmp 0x4af0ea
call fcn.004aee40
cmp eax, 1
jne 0x4af0fa
test edi, edi
jle 0x4af045
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret
push 0x8e
push str..crypto_bio_b_sock.c
push 0x16
push 9
call fcn.00407280
add esp, 0x10
push ebp
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x4af080
push 0x92
push str..crypto_bio_b_sock.c
push 0x66
push 0x6a
push 0x20
call fcn.004039b0
add esp, 0x14
jmp 0x4af0d0
cmp word [eax + 8], 2
je 0x4af0a1
push 0x99
push str..crypto_bio_b_sock.c
push 0x6b
push 0x6a
push 0x20
call fcn.004039b0
add esp, 0x14
jmp 0x4af0d0
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
movzx ecx, byte [edx]
mov byte [esi], cl
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
mov dl, byte [ecx + 1]
mov byte [esi + 1], dl
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
movzx ecx, byte [edx + 2]
mov byte [esi + 2], cl
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
movzx ecx, byte [eax + 3]
mov byte [esi + 3], cl
xor ebx, ebx
push 0xa2
push str..crypto_bio_b_sock.c
push 0x16
push 0xa
call fcn.00407280
add esp, 0x10
test ebx, ebx
je 0x4af101
push ebp
push 0x59f410
push 2
call fcn.00403c70
add esp, 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x4ba1e0
Capabilities:
Encrypt data using blowfish

Disassembly:
mov eax, 8
call fcn.005458d0
push ebx
mov ebx, dword [esp + 0x10]
push esi
push 0x1048
push 0x5b5d70
push ebx
call fcn.00543d00
mov ecx, dword [esp + 0x24]
add esp, 0xc
cmp ecx, 0x48
jle 0x4ba211
mov ecx, 0x48
push edi
mov edi, dword [esp + 0x20]
mov eax, edi
add ecx, edi
lea esi, [ebx + 8]
mov dword [esp + 0x18], 6
push ebp
movzx edx, byte [eax]
inc eax
cmp eax, ecx
jb 0x4ba230
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x4ba23f
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x4ba24e
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x4ba25d
mov eax, edi
xor dword [esi - 8], edx
movzx edx, byte [eax]
inc eax
cmp eax, ecx
jb 0x4ba26a
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x4ba279
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x4ba288
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x4ba297
mov eax, edi
xor dword [esi - 4], edx
movzx edx, byte [eax]
inc eax
cmp eax, ecx
jb 0x4ba2a4
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x4ba2b3
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x4ba2c2
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x4ba2d1
mov eax, edi
xor dword [esi], edx
add esi, 0xc
dec dword [esp + 0x1c]
jne 0x4ba226
xor edi, edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
xor esi, esi
pop ebp
lea ecx, [ecx]
lea eax, [esp + 0xc]
push ebx
push eax
call fcn.004dbe00
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [ebx + esi*4], ecx
mov dword [ebx + esi*4 + 4], edx
add esi, 2
add esp, 8
cmp esi, 0x12
jl 0x4ba2f0
xor esi, esi
pop edi
lea eax, [esp + 8]
push ebx
push eax
call fcn.004dbe00
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [ebx + esi*4 + 0x48], ecx
mov dword [ebx + esi*4 + 0x4c], edx
add esi, 2
add esp, 8
cmp esi, 0x400
jl 0x4ba318
pop esi
pop ebx
add esp, 8
ret
Function at 0x4e0410
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x567eaa
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x5d86f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x18], esi
call fcn.00541745
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x4e04b6
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], str.bad_locale_name
push eax
lea ecx, [ebp - 0x24]
call fcn.00546eff
push 0x5cd924
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], vtable.std::runtime_error.0
push eax
call fcn.0054547a
push edi
push esi
call fcn.00541c4a
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054546b
mov esp, ebp
pop ebp
ret 4

Function at 0x4e0a50
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x567f38
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x5d86f0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
sub esp, 0x18
mov ecx, esp
push 0xffffffffffffffff
push 0
push dword [ebp + 0x10]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
mov byte [ecx], 0
call fcn.004e9e50
push dword [ebp + 0xc]
lea eax, [esp + 0x28]
push dword [ebp + 8]
push eax
call fcn.004e0980
add esp, 0x24
mov dword [esp + 0x30], 0
cmp dword [eax + 0x14], 0x10
jb 0x4e0ac1
mov eax, dword [eax]
mov dword [esp + 8], eax
mov ecx, esi
lea eax, [esp + 8]
push eax
call fcn.00546eff
cmp dword [esp + 0x20], 0x10
mov dword [esi], vtable.std::runtime_error.0
jb 0x4e0aea
push dword [esp + 0xc]
call fcn.00541faa
add esp, 4
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
mov eax, esi
mov dword [esi], vtable.std::_System_error.0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4e2ec0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5681db
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x5d86f0]
xor eax, esp
mov dword [esp + 0x244], eax
push esi
push edi
mov eax, dword [0x5d86f0]
xor eax, esp
push eax
lea eax, [esp + 0x258]
mov dword fs:[0], eax
mov eax, dword [0x5de230]
mov esi, dword [ebp + 8]
mov dword [esp + 0x10], 0
test al, 1
jne 0x4e2f44
or eax, 1
mov dword [0x5de1f8], 7
mov dword [0x5de230], eax
xor eax, eax
push 0x56fb10
mov dword [0x5de1f4], 0
mov word [0x5de1e4], ax
call fcn.0054221a
add esp, 4
push 0
push 0x5c057c
push dword [0x5de1f4]
mov ecx, 0x5de1e4
push 0
call fcn.004eace0
test eax, eax
jne 0x4e3059
push 0x104
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], 0
mov word [esp + 0x2c], ax
cmp word [esp + 0x44], ax
jne 0x4e2f97
xor ecx, ecx
jmp 0x4e2faf
lea ecx, [esp + 0x44]
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4e2fa0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x34]
call fcn.004e8990
push 0x5c0598
lea eax, [esp + 0x30]
mov dword [esp + 0x264], 0
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.004ed2e0
mov edi, eax
add esp, 0xc
cmp edi, 0x5de1e4
je 0x4e3028
cmp dword [0x5de1f8], 8
jb 0x4e3001
push dword [0x5de1e4]
call fcn.00541faa
add esp, 4
xor eax, eax
mov dword [0x5de1f8], 7
push edi
mov ecx, 0x5de1e4
mov dword [0x5de1f4], 0
mov word [0x5de1e4], ax
call fcn.004ea8f0
cmp dword [esp + 0x28], 8
jb 0x4e303b
push dword [esp + 0x14]
call fcn.00541faa
add esp, 4
mov dword [esp + 0x260], 0xffffffff
cmp dword [esp + 0x40], 8
jb 0x4e3059
push dword [esp + 0x2c]
call fcn.00541faa
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
push 0xffffffffffffffff
push eax
mov dword [esi + 0x10], 0
mov ecx, esi
push 0x5de1e4
mov word [esi], ax
call fcn.004eaa20
mov eax, esi
mov ecx, dword [esp + 0x258]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x244]
xor ecx, esp
call fcn.0054546b
mov esp, ebp
pop ebp
ret
Function at 0x4e30a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5681db
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x5d86f0]
xor eax, esp
mov dword [esp + 0x244], eax
push esi
push edi
mov eax, dword [0x5d86f0]
xor eax, esp
push eax
lea eax, [esp + 0x258]
mov dword fs:[0], eax
mov eax, dword [0x5de23c]
mov esi, dword [ebp + 8]
mov dword [esp + 0x10], 0
test al, 1
jne 0x4e3124
or eax, 1
mov dword [0x5de180], 7
mov dword [0x5de23c], eax
xor eax, eax
push 0x56fb70
mov dword [0x5de17c], 0
mov word [0x5de16c], ax
call fcn.0054221a
add esp, 4
push 0
push 0x5c057c
push dword [0x5de17c]
mov ecx, 0x5de16c
push 0
call fcn.004eace0
test eax, eax
jne 0x4e3239
push 0x104
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor eax, eax
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], 0
mov word [esp + 0x2c], ax
cmp word [esp + 0x44], ax
jne 0x4e3177
xor ecx, ecx
jmp 0x4e318f
lea ecx, [esp + 0x44]
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4e3180
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x34]
call fcn.004e8990
push str._sysnative_
lea eax, [esp + 0x30]
mov dword [esp + 0x264], 0
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.004ed2e0
mov edi, eax
add esp, 0xc
cmp edi, 0x5de16c
je 0x4e3208
cmp dword [0x5de180], 8
jb 0x4e31e1
push dword [0x5de16c]
call fcn.00541faa
add esp, 4
xor eax, eax
mov dword [0x5de180], 7
push edi
mov ecx, 0x5de16c
mov dword [0x5de17c], 0
mov word [0x5de16c], ax
call fcn.004ea8f0
cmp dword [esp + 0x28], 8
jb 0x4e321b
push dword [esp + 0x14]
call fcn.00541faa
add esp, 4
mov dword [esp + 0x260], 0xffffffff
cmp dword [esp + 0x40], 8
jb 0x4e3239
push dword [esp + 0x2c]
call fcn.00541faa
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
push 0xffffffffffffffff
push eax
mov dword [esi + 0x10], 0
mov ecx, esi
push 0x5de16c
mov word [esi], ax
call fcn.004eaa20
mov eax, esi
mov ecx, dword [esp + 0x258]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x244]
xor ecx, esp
call fcn.0054546b
mov esp, ebp
pop ebp
ret