joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e31c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x658d1b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x6dc0b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 8
mov dword [esi + 0x1c], 0
call fcn.00545b74
xor ecx, ecx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 3
mov word [eax], cx
mov dword [ebp - 4], ecx
push 8
mov dword [esi + 0x28], ecx
call fcn.00545b74
mov dword [esi + 0x28], eax
add esp, 8
mov dword [esi + 0x2c], 0
xor ecx, ecx
mov dword [esi + 0x30], 3
mov word [eax], cx
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], ecx
mov word [esi + 0x18], cx
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x20], ecx
mov word [eax], cx
mov eax, dword [esi + 0x28]
mov dword [esi + 0x2c], ecx
mov word [eax], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4e4760
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x6dc0b8]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x19
push 0x6a72d8
lea ecx, [ebp - 0x1c]
call fcn.00509a30
cmp dword [eax + 0x14], 8
jb 0x4e4787
mov eax, dword [eax]
push 1
push 0
push 0
push eax
push 0x6add70
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 8]
cmp eax, 8
jb 0x4e47b0
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00416870
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00545b50
mov esp, ebp
pop ebp
ret
Function at 0x4e47c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x658ec8
mov eax, dword fs:[0]
push eax
sub esp, 0x3f4
mov eax, dword [0x6dc0b8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x3cc], ebx
lea ecx, [ebp - 0x3c8]
call fcn.004d58b0
push 0
lea ecx, [ebp - 0x3c8]
mov dword [ebp - 4], 0
call fcn.0054e4aa
cmp eax, 1
jne 0x4e49da
push 8
call fcn.00545b74
xor ecx, ecx
mov dword [ebp - 0x3e8], eax
add esp, 4
mov dword [ebp - 0x3e4], 0
mov dword [ebp - 0x3e0], 3
mov word [eax], cx
mov byte [ebp - 4], 1
lea edx, [ebp - 0x3d0]
mov ecx, dword [ebx + 0x480]
push 0
push edx
mov eax, dword [ecx]
call dword [eax + 0x3c]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x3dc]
push dword [eax]
call fcn.0049f410
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x3d0]
add ecx, 0xfffffff4
cmp ecx, dword [0x6dc0e0]
je 0x4e489a
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4e489a
push ecx
call fcn.0049fdd0
add esp, 4
mov byte [ebp - 4], 4
xor ecx, ecx
mov eax, dword [ebp - 0x3d8]
mov edx, 2
mov ebx, dword [ebp - 0x3dc]
movzx esi, word [ebx + eax*2 - 2]
mov eax, edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00545b74
mov edi, eax
mov dword [ebp - 0x3f0], 1
add esp, 4
mov dword [ebp - 0x3f4], edi
xor eax, eax
mov dword [ebp - 0x3ec], 1
mov word [edi], si
mov word [edi + 2], ax
mov byte [ebp - 4], 6
mov ecx, 0x6acfb0
mov eax, edi
nop word [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4e4926
test dx, dx
je 0x4e4922
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4e4926
add eax, 4
add ecx, 4
test dx, dx
jne 0x4e4900
xor eax, eax
jmp 0x4e492b
sbb eax, eax
or eax, 1
test eax, eax
je 0x4e4945
push 0x6acfb0
lea ecx, [ebp - 0x3dc]
call fcn.0049f700
mov ebx, dword [ebp - 0x3dc]
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x3dc]
lea ecx, [ebp - 0x400]
call fcn.0049f1c0
add esp, 4
push eax
lea ecx, [ebp - 0x3e8]
mov byte [ebp - 4], 7
call fcn.0049f5a0
mov byte [ebp - 4], 6
push dword [ebp - 0x400]
call fcn.00545b61
mov esi, dword [ebp - 0x3e8]
add esp, 4
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4e4997
mov ecx, esi
call fcn.004a2f40
mov ecx, dword [ebp - 0x3cc]
push 0xffffffffffffffff
push str.cbx_uncompress_path
add ecx, 4
call fcn.00554534
push esi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x40]
mov ecx, dword [ebp - 0x3cc]
call fcn.004e4a10
push edi
call fcn.00545b61
add esp, 4
push ebx
call fcn.00545b61
add esp, 4
push esi
call fcn.00545b61
add esp, 4
push dword [ebp - 0x1c]
call fcn.00545b61
add esp, 4
lea ecx, [ebp - 0x3c8]
call fcn.0054e428
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00545b50
mov esp, ebp
pop ebp
ret
Function at 0x4e4a10
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x658f06
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x6dc0b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, dword [ebx + 0x480]
lea edx, [ebp - 0x14]
push 0
push edx
mov eax, dword [ecx]
call dword [eax + 0x3c]
mov dword [ebp - 4], 0
xor esi, esi
mov edi, dword [eax]
cmp word [edi], si
je 0x4e4a68
nop dword [eax + eax]
inc esi
cmp word [edi + esi*2], 0
jne 0x4e4a60
xor ecx, ecx
lea eax, [esi + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00545b74
add esp, 4
mov dword [ebp - 0x20], eax
lea ecx, [esi*2 + 2]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
push ecx
push edi
push eax
call fcn.005e0850
add esp, 0xc
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff4
cmp ecx, dword [0x6dc0e0]
je 0x4e4ac6
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4e4ac6
push ecx
call fcn.0049fdd0
add esp, 4
mov byte [ebp - 4], 2
push dword [ebx + 0x41c]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call esi
test eax, eax
jne 0x4e4ae7
mov ecx, dword [ebx + 0x41c]
call fcn.004a2f40
mov edi, dword [ebp - 0x20]
push edi
call esi
test eax, eax
je 0x4e4b4d
lea edx, [ebp - 0x10]
mov dword [ebp - 0x10], 0
mov ecx, edi
call fcn.004dff30
test eax, eax
js 0x4e4b4d
push ecx
push dword [ebp - 0x10]
mov ecx, dword [ebx + 0x3f4]
call fcn.004bf420
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4e4b44
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
push 9
push 0x110b
push dword [ebx + 0x3f0]
call esi
push dword [ebp - 0x14]
push 0
push 0x1114
push dword [ebx + 0x3f0]
call esi
push dword [ebp - 0x10]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push edi
call fcn.00545b61
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e58b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x658ffb
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x6dc0b8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 8]
xor ecx, ecx
mov edx, 2
mov eax, dword [edi]
mov dword [ebx], eax
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov eax, dword [edi + 8]
mov dword [ebx + 8], eax
mov eax, dword [edi + 0xc]
mov dword [ebx + 0xc], eax
movzx eax, byte [edi + 0x10]
mov byte [ebx + 0x10], al
movzx eax, byte [edi + 0x11]
mov byte [ebx + 0x11], al
movzx eax, byte [edi + 0x12]
mov byte [ebx + 0x12], al
movzx eax, byte [edi + 0x13]
mov byte [ebx + 0x13], al
movzx eax, byte [edi + 0x14]
mov byte [ebx + 0x14], al
movzx eax, byte [edi + 0x15]
mov byte [ebx + 0x15], al
movzx eax, byte [edi + 0x16]
mov byte [ebx + 0x16], al
movzx eax, byte [edi + 0x17]
mov byte [ebx + 0x17], al
movzx eax, byte [edi + 0x18]
mov byte [ebx + 0x18], al
movzx eax, byte [edi + 0x19]
mov byte [ebx + 0x19], al
mov esi, dword [edi + 0x20]
mov dword [ebx + 0x1c], 0
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00545b74
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x20], esi
mov dword [ebx + 0x24], esi
mov ecx, dword [edi + 0x20]
lea ecx, [ecx*2 + 2]
push ecx
push dword [edi + 0x1c]
push eax
call fcn.005e0850
mov dword [ebp - 4], 0
xor ecx, ecx
mov esi, dword [edi + 0x2c]
mov edx, 2
mov dword [ebx + 0x28], 0
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00545b74
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], esi
mov dword [ebx + 0x30], esi
mov ecx, dword [edi + 0x2c]
lea ecx, [ecx*2 + 2]
push ecx
push dword [edi + 0x28]
push eax
call fcn.005e0850
add esp, 0x20
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4e5b40
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x86c
mov eax, dword [0x6dc0b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push 0xffffffffffffffff
push str.cbx_uncompress_path
mov dword [ebp - 0x830], eax
lea ecx, [esi + 4]
call fcn.00554534
push 0x208
mov ebx, eax
lea eax, [ebp - 0x620]
push 0
push eax
call fcn.005e0dd0
mov esi, dword [esi + 0x3f4]
lea eax, [ebp - 0x86c]
mov ecx, dword [edi + 0x3c]
add esp, 0xc
mov dword [ebp - 0x86c], 0x14
mov dword [ebp - 0x868], ecx
push eax
push 0
push 0x113e
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esi + 0x2c]
mov eax, dword [ebp - 0x848]
push dword [ecx + eax*8]
call dword [sym.imp.SHELL32.dll_ILClone]
mov esi, eax
lea eax, [ebp - 0x620]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x4e5beb
lea ecx, [ebp - 0x620]
jmp 0x4e5cd2
push 0x208
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.005e0dd0
add esp, 0xc
lea eax, [ebp - 0x418]
push 0x208
push 0
push eax
call fcn.005e0dd0
add esp, 0xc
lea edx, [ebp - 0x210]
push 1
push ecx
mov ecx, esi
call fcn.004dffd0
add esp, 8
test eax, eax
js 0x4e5cda
push 0x208
lea eax, [ebp - 0x828]
mov dword [ebp - 0x82c], 0
push 0
push eax
call fcn.005e0dd0
add esp, 0xc
lea eax, [ebp - 0x82c]
push eax
push 0
push 0
push 0x11
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
push 1
push ecx
mov ecx, dword [ebp - 0x82c]
lea edx, [ebp - 0x828]
call fcn.004dffd0
add esp, 8
push dword [ebp - 0x82c]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x4e5cda
push ecx
lea edx, [ebp - 0x418]
lea ecx, [ebp - 0x210]
call fcn.004e01b0
add esp, 4
test eax, eax
js 0x4e5cda
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4e5cda
lea ecx, [ebp - 0x418]
mov eax, dword [ebx]
push ecx
mov ecx, ebx
call dword [eax + 0x40]
mov eax, dword [ebp - 0x830]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov dword [eax], 1
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00545b50
mov esp, ebp
pop ebp
ret 8
Function at 0x4eab20
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [esi + 0xc]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [esi + 0x18]
mov esi, dword [esi + 4]
and ecx, eax
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov ebx, dword [edx + ecx*4]
lea edx, [edx + ecx*4]
cmp ebx, esi
jne 0x4eab7b
mov ecx, esi
jmp 0x4eab80
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x4eaba5
mov ecx, dword [eax + 8]
cmp ecx, dword [edi]
je 0x4eab8f
mov eax, dword [eax]
jmp 0x4eab73
mov ecx, dword [edi]
cmp ecx, dword [eax + 8]
mov ecx, dword [ebp + 8]
cmovne eax, esi
pop edi
pop esi
mov dword [ecx], eax
mov eax, ecx
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4eaf00
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
mov esi, dword [ebx + 4]
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
mov dword [ebp + 0xc], edx
mov eax, dword [ecx + edx]
cmp esi, eax
je 0x4eaf71
mov esi, dword [ecx + edx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x4eaf71
mov ecx, dword [edi]
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 8]
je 0x4eafb5
cmp esi, eax
jne 0x4eaf65
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
cmp esi, eax
je 0x4eaf9e
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x4eafeb
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [edx + eax + 4], edi
jmp 0x4eb00d
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 0xc]
dec dword [ebx + 8]
call fcn.004163e0
push edi
call fcn.005e3637
mov eax, dword [ebp + 8]
add esp, 4
pop edi
mov dword [eax], esi
pop esi
mov byte [eax + 4], 0
pop ebx
pop ebp
ret 0xc
cmp eax, esi
jne 0x4eaff3
mov dword [ecx], edi
jmp 0x4eb00d
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x4eb00d
mov ecx, dword [ebx + 0xc]
mov eax, dword [ecx + edx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + edx + 4], eax
mov ecx, ebx
call fcn.004eb030
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
mov byte [eax + 4], 1
pop ebx
pop ebp
ret 0xc

Function at 0x4ebc70
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x6dc0b8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x6f5c84], 0
je 0x4ebc99
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00545b50
mov esp, ebp
pop ebp
ret
push 0x20
call fcn.005e74a6
add esp, 4
test eax, eax
je 0x4ebcea
push ecx
mov ecx, eax
call fcn.004eb9e0
mov dword [0x6f5c84], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00416b10
mov ecx, dword [0x6f5c84]
lea eax, [ebp - 0x1c]
push eax
call fcn.004ec3c0
lea ecx, [ebp - 0x1c]
call fcn.004163e0
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
call fcn.00545b50
mov esp, ebp
pop ebp
ret
push 0x6d8324
lea eax, [ebp - 0x1d]
push eax
call fcn.005e0fac
int3
Function at 0x4ec3c0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6dc0b8]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x20]
call fcn.0040e610
mov ecx, 0x6b909c
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4ec3f0
sub ecx, edx
lea eax, [ebp - 0x20]
sar ecx, 1
push ecx
push 0x6b909c
push eax
mov ecx, esi
call fcn.004f5dc0
add esp, 0xc
cmp dword [ebp - 0x10], 0
je 0x4ec44a
cmp dword [ebp - 0xc], 8
lea ecx, [ebp - 0x24]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], 0
cmovae eax, dword [ebp - 0x20]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov ecx, edi
push esi
push dword [ebp - 0x24]
call fcn.004ebd00
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [ebp - 0x20]
call fcn.004163e0
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.00545b50
mov esp, ebp
pop ebp
ret 4
Function at 0x4eea90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x6dc0b8]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
mov dword [ebp - 0x54], 0
push edi
sub esp, 8
mov edi, ecx
mov edx, esp
mov eax, dword [esi]
cmp dword [eax + 0x14], 8
jb 0x4eeac5
mov ecx, dword [eax]
jmp 0x4eeac7
mov ecx, eax
mov dword [edx], ecx
lea ecx, [ebp - 0x50]
mov eax, dword [eax + 0x10]
mov dword [edx + 4], eax
call fcn.004e91d0
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x38]
call fcn.004dff00
lea ecx, [ebp - 0x50]
call fcn.004163e0
push ecx
lea eax, [ebp - 0x20]
mov ecx, esi
push eax
call fcn.004ec550
cmp dword [ebx + 0x14], 0
jne 0x4eeb01
xor esi, esi
jmp 0x4eeb0c
cmp dword [ebx + 0x18], 8
lea esi, [ebx + 4]
jb 0x4eeb0c
mov esi, dword [esi]
push 0x3c
lea eax, [ebp - 0x90]
push 0
push eax
call fcn.005e0dd0
add esp, 0xc
mov dword [ebp - 0x90], 0x3c
mov dword [ebp - 0x8c], 0x40
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp dword [ebp - 0x24], 8
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x38]
cmovae eax, dword [ebp - 0x38]
cmp dword [ebp - 0xc], 8
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x20]
cmovae eax, dword [ebp - 0x20]
xor ecx, ecx
cmp byte [ebx + 0x1c], cl
mov dword [ebp - 0x7c], eax
mov eax, 5
cmovne eax, ecx
mov dword [ebp - 0x84], 0x6b8d40
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x90]
push eax
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x70], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x4eebae
lea ecx, [edi + 4]
mov byte [edi], al
push eax
mov dword [ecx], eax
call fcn.004eec80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test eax, eax
jne 0x4eebde
cmp byte [0x6f5d2c], 0
je 0x4eebdd
jmp 0x4eec01
cmp byte [ebx], 0
je 0x4eebbe
push 0xffffffffffffffff
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, dword [ebp - 0x58]
lea ecx, [edi + 4]
mov byte [edi], 0
push esi
mov dword [ecx], 0
call fcn.004eec80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp esi, eax
jmp 0x4eeba1
int3
lea ecx, [ebp - 0x20]
call fcn.004163e0
lea ecx, [ebp - 0x38]
call fcn.004163e0
mov ecx, dword [ebp - 8]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00545b50
mov esp, ebp
pop ebp
ret
push 1
call fcn.005f375c
int3

Function at 0x4eee60
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], 0
cmp byte [esi], 0
je 0x4eee7e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x4eee81
mov eax, dword [esi + 4]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
setne bl
test bl, bl
je 0x4eeeb5
cmp byte [ebp + 0xc], 0
je 0x4eeeb5
cmp byte [esi], 0
je 0x4eeea6
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x4eeea9
mov eax, dword [esi + 4]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4ef2c0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1010
call fcn.005468f0
mov eax, dword [0x6dc0b8]
xor eax, esp
mov dword [esp + 0x100c], eax
mov eax, dword [ebp + 8]
lea edx, [esp]
push esi
push edi
mov edi, dword [ebp + 0xc]
push edx
lea edx, [esp + 0x14]
mov dword [esp + 0xc], 0
push edx
lea edx, [esp + 0x14]
mov dword [esp + 0x14], 1
push edx
push 0
push eax
push dword [ecx]
mov dword [esp + 0x20], 0x800
call dword [0x661fdc]
mov esi, eax
test esi, esi
jne 0x4ef407
mov ecx, dword [esp + 0xc]
cmp ecx, 1
jne 0x4ef394
cmp word [esp + 0x10], ax
jne 0x4ef358
xor ecx, ecx
lea eax, [esp + 0x10]
push ecx
push eax
mov ecx, edi
call fcn.004169e0
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.00545b50
mov esp, ebp
pop ebp
ret 8
lea ecx, [esp + 0x10]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4ef360
sub ecx, edx
lea eax, [esp + 0x10]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.004169e0
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.00545b50
mov esp, ebp
pop ebp
ret 8
cmp ecx, 2
jne 0x4ef402
push 0x400
lea eax, [esp + 0x814]
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [esp + 8], eax
test eax, eax
je 0x4ef3e7
cmp eax, 0x400
ja 0x4ef3e7
lea eax, [esp + 0x810]
mov ecx, edi
push eax
call fcn.004ea350
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.00545b50
mov esp, ebp
pop ebp
ret 8
mov eax, 0xea
pop edi
pop esi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.00545b50
mov esp, ebp
pop ebp
ret 8
mov eax, 0x3f4
mov ecx, dword [esp + 0x1014]
pop edi
pop esi
xor ecx, esp
call fcn.00545b50
mov esp, ebp
pop ebp
ret 8
Function at 0x4ef6d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x43c
mov eax, dword [0x6dc0b8]
xor eax, esp
mov dword [esp + 0x438], eax
push ebx
mov ebx, ecx
push esi
push edi
lea esi, [ebx + 8]
push esi
call fcn.004eecf0
add esp, 4
lea eax, [esp + 0x10]
mov ecx, esi
push eax
call fcn.004c15a0
mov eax, dword [0x6f5c88]
test eax, eax
je 0x4ef736
lea ecx, [esp + 0x10]
push ecx
push dword [ebx + 0xa0]
push dword [ebx + 0xa8]
push dword [ebx + 0xa4]
push dword [ebx]
call eax
add esp, 0x14
test al, al
jne 0x4ef81b
cmp dword [ebx], 2
jl 0x4ef777
cmp dword [esp + 0x24], 0x10
lea edi, [esp + 0x10]
mov esi, dword [esp + 0x20]
cmovae edi, dword [esp + 0x10]
push 2
call fcn.005e3bf0
add esp, 4
push eax
push 1
push esi
push edi
call fcn.005f05c3
push 2
call fcn.005e3bf0
add esp, 0x14
push eax
call fcn.005f12f7
add esp, 4
lea esi, [ebx + 8]
call fcn.004ef590
test al, al
je 0x4ef7a6
cmp dword [esp + 0x24], 0x10
lea ecx, [esp + 0xc]
push 0
push ecx
push dword [esp + 0x28]
lea eax, [esp + 0x1c]
cmovae eax, dword [esp + 0x1c]
push eax
push dword [0x6f5c8c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebx], 3
jne 0x4ef81b
mov ecx, 0x400
lea eax, [esp + 0x10]
cmp dword [esp + 0x20], ecx
cmovb ecx, dword [esp + 0x20]
cmp dword [esp + 0x24], 0x10
cmovae eax, dword [esp + 0x10]
test ecx, ecx
je 0x4ef7da
push ecx
push eax
lea eax, [esp + 0x48]
push eax
call fcn.005e0850
add esp, 0xc
lea eax, [esp + 0x40]
push eax
call fcn.004f9600
add esp, 4
cmp dword [0x6f5c94], 0
je 0x4ef811
lea eax, [esp + 0x28]
mov ecx, esi
push eax
call fcn.004c15a0
push eax
call dword [0x6f5c94]
add esp, 4
lea ecx, [esp + 0x28]
call fcn.00414d60
jmp 0x4ef81b
cmp byte [0x6f5d2c], 0
jne 0x4ef855
int3
lea ecx, [esp + 0x10]
call fcn.00414d60
push dword [ebx + 0xac]
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [esi + 0x50]
call fcn.004c4660
lea ecx, [esi + 0x50]
call fcn.004c4740
mov ecx, dword [esp + 0x444]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00545b50
mov esp, ebp
pop ebp
ret
push 1
call fcn.005f375c
int3