joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b0205
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.004122f0
mov eax, dword [0x5092e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0xffc
lea eax, [ebp - 0x1000]
mov edi, edx
push ebx
push eax
mov esi, ecx
mov dword [ebp - 0x100c], edi
mov dword [ebp - 0x1004], ebx
call fcn.00401f80
add esp, 0xc
mov dword [ebp - 0x1010], ebx
cmp edi, ebx
jne 0x4b0257
xor eax, eax
jmp 0x4b02f9
shr esi, 2
mov eax, 0x40000
mov dword [ebp - 0x1008], esi
cmp esi, eax
jbe 0x4b026f
mov dword [ebp - 0x1008], eax
shr dword [ebp - 0x1008], 2
mov edi, 0x400
cmp dword [ebp - 0x1008], edi
jbe 0x4b0298
push 4
push dword [ebp - 0x1008]
call fcn.00401a3a
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
jne 0x4b02a4
mov dword [ebp - 0x1008], edi
lea esi, [ebp - 0x1004]
xor edi, edi
push dword [ebp - 0x100c]
push dword [ebp - 0x1008]
push 4
push esi
call fcn.00402244
add esp, 0x10
mov dword [ebp - 0x1010], eax
test eax, eax
je 0x4b02d9
xor ebx, ebx
test eax, eax
je 0x4b02d5
add edi, dword [esi + ebx*4]
inc ebx
cmp ebx, eax
jb 0x4b02cd
add edi, eax
jmp 0x4b02a6
test edi, edi
jne 0x4b02e2
test ebx, ebx
je 0x4b02e2
inc edi
test esi, esi
je 0x4b02f7
lea eax, [ebp - 0x1004]
cmp esi, eax
je 0x4b02f7
push esi
call fcn.00401a00
pop ecx
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401317
leave
ret

Function at 0x4b03dd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x5092e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push 0x4d
lea eax, [ebp - 0x53]
push ebx
push eax
mov byte [ebp - 0x54], bl
call fcn.00401f80
add esp, 0xc
cmp esi, ebx
jne 0x4b040e
or eax, 0xffffffff
jmp 0x4b04b9
lea eax, [ebp - 0x54]
push eax
mov edx, str.____This_is_the_beginning_of_a_PAULA_Arkive_self_extracting_compilation.____
call fcn.00444f2f
push esi
call fcn.00401e22
push esi
mov dword [ebp - 0x58], ebx
call fcn.00401e7e
add esp, 0xc
cmp eax, 0xffffffff
je 0x4b0455
push 1
push eax
lea eax, [ebp - 0x58]
lea ebx, [ebp - 0x54]
call fcn.00499034
pop ecx
pop ecx
test eax, eax
jne 0x4b04b2
push esi
call fcn.00401e7e
pop ecx
cmp eax, 0xffffffff
jne 0x4b0433
xor ebx, ebx
push edi
push 2
push ebx
push esi
call fcn.0040287c
add esp, 0xc
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.00401a80
pop ecx
push eax
lea eax, [ebp - 0x54]
push 1
push eax
call fcn.0040257f
mov edi, eax
lea eax, [ebp - 0x54]
push eax
call fcn.00401a80
add esp, 0x14
cmp edi, eax
pop edi
jne 0x4b0406
push esi
call fcn.00401e22
push 2
push 0xffffffffffffffff
push esi
call fcn.0040287c
push esi
call fcn.00401e7e
push 2
push ebx
push esi
call fcn.0040287c
add esp, 0x20
push esi
call fcn.0040278d
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00401317
leave
ret
Function at 0x4b1a3f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x5092e4]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x3c], eax
push 8
pop ecx
xor eax, eax
mov byte [ebp - 0x2c], bl
lea edi, [ebp - 0x2b]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x30], ebx
stosb byte es:[edi], al
call fcn.00445b2f
test eax, eax
jne 0x4b1bc6
cmp esi, ebx
je 0x4b1a8c
mov dword [esi], ebx
mov eax, dword [ebp - 0x3c]
cmp eax, ebx
je 0x4b1a95
mov dword [eax], ebx
push dword [ebp - 0x34]
mov esi, 0x4cc93c
call fcn.0044486a
pop ecx
test eax, eax
jne 0x4b1acb
mov esi, dword [ebp - 0x34]
push str..exe
mov dword [ebp - 0x44], 0x4e20
call fcn.0044675d
push eax
call fcn.00401811
pop ecx
pop ecx
test eax, eax
je 0x4b1ace
xor edi, edi
jmp 0x4b1ad8
mov dword [ebp - 0x44], ebx
mov ecx, dword [ebp - 0x34]
call fcn.004b198c
mov edi, eax
push dword [ebp - 0x44]
mov eax, dword [ebp - 0x34]
push 0x80000020
push 3
push 1
call fcn.004a1899
mov esi, eax
add esp, 0x10
cmp esi, 0xffffffff
jne 0x4b1b01
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4b1bc6
push ebx
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
lea eax, [ebp - 0x30]
push eax
push 4
lea eax, [ebp - 0x38]
push eax
push esi
call edi
test eax, eax
je 0x4b1bb6
cmp dword [ebp - 0x30], 4
jb 0x4b1bb6
push ebx
lea eax, [ebp - 0x30]
push eax
push 4
lea eax, [ebp - 0x40]
push eax
push esi
call edi
test eax, eax
je 0x4b1b69
cmp dword [ebp - 0x30], 4
jb 0x4b1b69
push ebx
lea eax, [ebp - 0x30]
push eax
push 8
lea eax, [ebp - 0x48]
push eax
push esi
call edi
push ebx
lea eax, [ebp - 0x30]
push eax
push 0x20
lea eax, [ebp - 0x2c]
push eax
push esi
call edi
test eax, eax
jne 0x4b1b70
call fcn.0049ff62
jmp 0x4b1bc6
call fcn.0049ff62
mov eax, dword [ebp - 0x30]
cmp eax, 0x22
jae 0x4b1bc6
mov byte [ebp + eax - 0x2c], bl
lea eax, [ebp - 0x2c]
push str.222PAULAARCHIVE222JesusIAdoreYou
push eax
call fcn.004023a0
pop ecx
pop ecx
test eax, eax
jne 0x4b1bc6
mov ecx, dword [ebp - 0x38]
cmp ecx, ebx
je 0x4b1bc6
mov eax, dword [ebp - 0x4c]
cmp eax, ebx
je 0x4b1ba8
mov edx, dword [ebp - 0x40]
mov dword [eax], edx
mov eax, dword [ebp - 0x3c]
cmp eax, ebx
je 0x4b1bb1
mov dword [eax], ecx
xor eax, eax
inc eax
jmp 0x4b1bc8
call fcn.0049ff62
mov edx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x34]
call fcn.004a1b95
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401317
leave
ret
Function at 0x4b360f
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, eax
test esi, esi
jne 0x4b362e
mov esi, dword [0x6152dc]
test esi, esi
je 0x4b3691
call fcn.004504ee
and dword [0x6152dc], 0
jmp 0x4b3691
mov eax, dword [0x6152dc]
test eax, eax
jne 0x4b3647
call fcn.0045052b
mov dword [0x6152dc], eax
test eax, eax
jne 0x4b3647
pop esi
ret
push ebx
mov ebx, dword [esi + 0x130]
push edi
mov edi, eax
call fcn.004506bd
test eax, eax
jne 0x4b366c
push dword [esi + 0x130]
mov ebx, dword [0x6152dc]
call fcn.004504da
pop ecx
xor ebx, ebx
cmp dword [esi], ebx
jle 0x4b368f
lea edi, [esi + 4]
mov eax, dword [edi]
call fcn.004b33a7
test eax, eax
je 0x4b3687
mov ecx, dword [edi]
call fcn.004b3488
inc ebx
add edi, 4
cmp ebx, dword [esi]
jl 0x4b3675
pop edi
pop ebx
xor eax, eax
inc eax
pop esi
ret
Function at 0x4b4849
Capabilities:
Contain obfuscated stackstrings
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x154
mov eax, dword [0x5092e4]
xor eax, esp
mov dword [esp + 0x150], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [esp + 0x10], eax
call fcn.00461deb
test eax, eax
je 0x4b487d
xor eax, eax
jmp 0x4b4a54
xor ebx, ebx
mov esi, str.Sound.c
cmp dword [0x6152d8], ebx
jne 0x4b49af
cmp dword [0x6153ec], ebx
jne 0x4b49af
push 0x103
lea eax, [esp + 0x55]
push ebx
push eax
mov dword [esp + 0x20], 0x46464952
mov dword [esp + 0x24], 0x32
mov dword [esp + 0x28], 0x45564157
mov dword [esp + 0x2c], 0x20746d66
mov dword [esp + 0x30], 0x10
mov dword [esp + 0x34], 0x10001
mov dword [esp + 0x38], 0x5622
mov dword [esp + 0x3c], 0xac44
mov dword [esp + 0x40], 0x100002
mov dword [esp + 0x44], 0x61746164
mov dword [esp + 0x48], 0xe
mov dword [esp + 0x4c], 0xfe00fe01
mov dword [esp + 0x50], 0xff00
mov dword [esp + 0x54], 0xffff
mov word [esp + 0x58], 1
mov byte [esp + 0x5c], bl
call fcn.00401f80
add esp, 0xc
lea edi, [esp + 0x50]
mov dword [0x6153ec], 1
call fcn.0049f7b7
test eax, eax
jne 0x4b4950
mov eax, edi
push str.TempDummySound.wav
push eax
call fcn.00401ba0
pop ecx
pop ecx
push 0x52
push esi
mov edx, 0x4cc8b8
lea ecx, [esp + 0x58]
call fcn.004a0001
mov edi, eax
pop ecx
pop ecx
cmp edi, ebx
je 0x4b4982
push edi
push 0x3a
lea eax, [esp + 0x1c]
push 1
push eax
call fcn.0040257f
add esp, 0x10
mov ecx, edi
call fcn.004a2aec
lea eax, [esp + 0x50]
push eax
call fcn.004b4849
pop ecx
test eax, eax
jne 0x4b49a9
lea eax, [esp + 0x50]
push str.SoundsNotifyWinIllegalKey.wav
push eax
call fcn.0046209e
push eax
call fcn.004b4849
add esp, 0xc
mov dword [0x6153ec], ebx
push 1
push 0x724
call fcn.00401a3a
mov edi, eax
pop ecx
pop ecx
cmp edi, ebx
je 0x4b4876
cmp dword [0x6152d8], ebx
jne 0x4b49d9
call fcn.0045052b
mov dword [0x6152d8], eax
mov ebx, dword [0x6152d8]
push edi
call fcn.004504da
cmp dword [0x6152d8], 0
pop ecx
jne 0x4b49fb
push edi
call fcn.00401a00
pop ecx
jmp 0x4b4876
lea ebx, [edi + 0x564]
push esi
push ebx
call fcn.0049d62a
pop ecx
pop ecx
mov esi, str.A_Sound_handle_had_to_be_forced_to_unlock___
mov eax, ebx
call fcn.0049d4b5
mov eax, 0xdac
mov ecx, ebx
call fcn.0049d4a2
mov eax, edi
call fcn.004b306f
mov edx, dword [esp + 0x10]
call fcn.00445b2f
test eax, eax
jne 0x4b4a52
push dword [esp + 0x10]
mov ecx, edi
call fcn.004b42ba
pop ecx
test eax, eax
jne 0x4b4a52
mov eax, edi
call fcn.004b3b82
jmp 0x4b4876
mov eax, edi
mov ecx, dword [esp + 0x15c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401317
mov esp, ebp
pop ebp
ret
Function at 0x4b4ed2
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x5092e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10c], eax
test esi, esi
jg 0x4b4efb
mov esi, 0x200
push 1
push 0x1f0
call fcn.00401a3a
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x4b4f16
xor eax, eax
jmp 0x4b5012
lea eax, [esi + 0xa]
push eax
push 1
call fcn.00401a3a
pop ecx
pop ecx
mov dword [edi], eax
test eax, eax
jne 0x4b4f32
push edi
call fcn.00401a00
pop ecx
jmp 0x4b4f0f
and dword [edi + 4], 0
and dword [edi + 0xc], 0
inc dword [0x5ffd00]
mov eax, dword [0x5ffd00]
push ebx
mov ebx, dword [0x5ffcfc]
mov dword [edi + 0x2c], eax
mov dword [edi + 8], esi
test ebx, ebx
jne 0x4b4f63
call fcn.0045052b
mov ebx, eax
mov dword [0x5ffcfc], ebx
push edi
call fcn.004504da
cmp dword [0x5ffcfc], 0
pop ecx
jne 0x4b4f89
push dword [edi]
call fcn.00401a00
push edi
call fcn.00401a00
pop ecx
pop ecx
xor eax, eax
jmp 0x4b5011
lea ebx, [edi + 0x30]
push str.Message.c
push ebx
call fcn.0049d62a
pop ecx
pop ecx
mov esi, str.A_Message_handle_had_to_be_forced_to_unlock___
mov eax, ebx
call fcn.0049d4b5
mov eax, 0x7d0
mov ecx, ebx
call fcn.0049d4a2
cmp dword [ebp - 0x10c], 0
mov eax, dword [ebp + 8]
mov dword [edi + 0x10], eax
je 0x4b5008
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.00401f80
push dword [ebp - 0x10c]
mov ecx, 0x104
lea eax, [ebp - 0x108]
call fcn.00444961
mov esi, eax
call fcn.00444789
mov eax, esi
push eax
push 0x16
lea eax, [edi + 0x14]
pop ecx
call fcn.00444961
add esp, 0x14
mov eax, edi
call fcn.004b4eaf
mov eax, edi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00401317
leave
ret

Function at 0x4b5b2a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ecx
push ebx
push edi
mov ebx, eax
xor edi, edi
cmp ebx, edi
je 0x4b5b9a
cmp byte [ebx], 0
je 0x4b5b9a
mov eax, esi
call fcn.004b503e
test eax, eax
je 0x4b5b9a
mov eax, esi
call fcn.004b4ebc
test eax, eax
je 0x4b5b9a
mov dword [esp + 0xc], 1
mov ecx, ebx
cmp dword [ebp + 8], edi
je 0x4b5ba2
xor edx, edx
call fcn.004a1b95
test eax, eax
je 0x4b5b75
mov dword [esp + 0xc], edi
push 0x4ad
mov edx, 0x4d1030
mov ecx, ebx
push str.Message.c
call fcn.004a0001
mov ebx, eax
pop ecx
pop ecx
cmp ebx, edi
jne 0x4b5bae
mov eax, esi
call fcn.004b4eaf
xor eax, eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x4b2
mov edx, 0x4cf3e4
jmp 0x4b5b81
cmp dword [esi + 4], edi
jle 0x4b5bfc
cmp dword [ebp + 8], edi
je 0x4b5bcb
cmp dword [esp + 0xc], edi
jne 0x4b5bcb
push ebx
push 0xa
call fcn.00401858
pop ecx
xor edi, edi
pop ecx
inc edi
push ebx
push dword [esi + 4]
push 1
push dword [esi]
call fcn.0040257f
add edi, eax
add esp, 0x10
cmp edi, dword [esi + 4]
jge 0x4b5bfc
mov eax, dword [esi]
call fcn.004449a1
test eax, eax
jne 0x4b5bfc
inc dword [0x5ffd04]
mov ecx, ebx
call fcn.004a2aec
jmp 0x4b5b93
mov ecx, ebx
call fcn.004a2aec
mov eax, esi
call fcn.004b4eaf
xor eax, eax
inc eax
jmp 0x4b5b9c
Function at 0x4b5c0f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, 0x100000
mov edi, eax
mov dword [esp + 0x10], esi
call fcn.00445b2f
test eax, eax
je 0x4b5c3b
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
call fcn.004b503e
test eax, eax
je 0x4b5c32
mov ecx, dword [ebp + 8]
xor edx, edx
call fcn.004a1b95
cmp eax, esi
jae 0x4b5c64
mov dword [esp + 0x10], eax
test eax, eax
jg 0x4b5c64
mov dword [esp + 0x10], 0x400
mov eax, edi
call fcn.004b4ebc
test eax, eax
je 0x4b5c32
mov ecx, dword [ebp + 8]
push 0x435
push str.Message.c
mov edx, 0x4d18d0
call fcn.004a0001
pop ecx
pop ecx
mov dword [esp + 0x14], eax
test eax, eax
jne 0x4b5c99
mov eax, edi
call fcn.004b4eaf
jmp 0x4b5c32
mov ebx, dword [esp + 0x10]
lea eax, [ebx + 0x400]
push 1
push eax
call fcn.00401a3a
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4b5c90
push dword [esp + 0x14]
push ebx
jmp 0x4b5d04
and dword [esp + 0xc], 0
test ebx, ebx
jle 0x4b5cfc
mov eax, dword [edi + 0xc]
inc eax
cmp eax, dword [edi + 8]
jl 0x4b5cd5
call fcn.004b50c4
test eax, eax
je 0x4b5d1a
mov eax, dword [edi + 0xc]
mov edx, dword [esp + 0xc]
mov dl, byte [edx + esi]
mov ecx, dword [edi]
mov byte [eax + ecx], dl
inc dword [edi + 0xc]
mov eax, dword [edi + 0xc]
cmp eax, dword [edi + 4]
jle 0x4b5cf2
mov dword [edi + 4], eax
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ebx
jl 0x4b5cc3
push dword [esp + 0x14]
push dword [esp + 0x14]
push 1
push esi
call fcn.00402244
mov ebx, eax
add esp, 0x10
test ebx, ebx
jg 0x4b5cba
xor ebx, ebx
inc ebx
jmp 0x4b5d1c
xor ebx, ebx
mov ecx, dword [esp + 0x14]
call fcn.004a2aec
mov eax, edi
call fcn.004b4eaf
push esi
call fcn.00401a00
pop ecx
mov eax, ebx
jmp 0x4b5c34
Function at 0x4c1d81
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
mov eax, dword [0x5092e4]
xor eax, esp
mov dword [esp + 0x130], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x103
mov dword [esp + 0x10], eax
xor esi, esi
lea eax, [esp + 0x35]
push esi
push eax
mov ebx, ecx
mov byte [esp + 0x3c], 0
call fcn.00401f80
xor eax, eax
lea edi, [esp + 0x28]
mov dword [esp + 0x24], esi
stosd dword es:[edi], eax
lea edi, [esp + 0x38]
mov dword [esp + 0x34], esi
stosd dword es:[edi], eax
lea edi, [esp + 0x30]
add esp, 0xc
mov dword [esp + 0x20], esi
mov edx, ebx
stosd dword es:[edi], eax
mov dword [esp + 0x14], esi
call fcn.00445b2f
test eax, eax
jne 0x4c1ef5
mov edx, dword [esp + 0xc]
call fcn.00445b2f
test eax, eax
jne 0x4c1ef5
push esi
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x24]
push eax
push ebx
call fcn.004a1a8e
add esp, 0x14
test eax, eax
jne 0x4c1e3e
mov edi, ebx
call fcn.004a142a
test eax, eax
je 0x4c1ef5
cmp dword [0x50a390], esi
je 0x4c1e46
mov dword [0x50a390], esi
jmp 0x4c1e46
mov dword [esp + 0x14], 1
push 0x4cc77c
push ebx
call fcn.004c1d65
pop ecx
pop ecx
mov dword [esp + 0x10], eax
cmp eax, esi
je 0x4c1ef5
push dword [esp + 0xc]
mov edi, 0x104
mov ecx, edi
lea eax, [esp + 0x34]
call fcn.00444961
pop ecx
mov esi, eax
call fcn.00445630
mov edx, esi
call fcn.00445b2f
test eax, eax
jne 0x4c1eaf
mov eax, esi
push eax
call fcn.00401a80
pop ecx
mov ecx, esi
cmp byte [eax + ecx - 1], 0x5c
jne 0x4c1eaf
push ebx
mov ecx, edi
mov eax, esi
call fcn.00444961
pop ecx
push dword [esp + 0xc]
call fcn.00446ced
pop ecx
jmp 0x4c1ec0
lea eax, [esp + 0x30]
push ebx
push eax
call fcn.00401811
pop ecx
pop ecx
test eax, eax
jne 0x4c1ec9
lea esi, [esp + 0x30]
call fcn.004468b6
push 0x169
push str.zLib.c
mov edx, 0x4cc8b8
lea ecx, [esp + 0x38]
call fcn.004a0001
mov edi, eax
xor ebx, ebx
pop ecx
pop ecx
cmp edi, ebx
jne 0x4c1f0c
push dword [esp + 0x10]
call fcn.004c1cc1
pop ecx
xor eax, eax
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401317
mov esp, ebp
pop ebp
ret
push 0x100002
call fcn.004028f8
mov esi, eax
pop ecx
mov dword [esp + 0xc], ebx
test esi, esi
je 0x4c1f5f
push 0x100000
push esi
push dword [esp + 0x18]
call fcn.004c1d28
add esp, 0xc
test eax, eax
jle 0x4c1f56
push edi
push 1
push eax
push esi
add ebx, eax
call fcn.0040257f
add esp, 0x10
test eax, eax
jg 0x4c1f21
inc dword [0x61d60c]
inc dword [esp + 0xc]
jmp 0x4c1f21
push esi
call fcn.00401a00
pop ecx
jmp 0x4c1f67
mov dword [esp + 0xc], 1
mov ecx, edi
call fcn.004a2aec
push dword [esp + 0x10]
call fcn.004c1cc1
cmp dword [esp + 0x18], 0
pop ecx
je 0x4c1f98
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x30]
lea ecx, [esp + 0x28]
call fcn.004a1a06
pop ecx
pop ecx
test ebx, ebx
je 0x4c1ef5
cmp dword [esp + 0xc], 0
jne 0x4c1ef5
xor eax, eax
inc eax
jmp 0x4c1ef7

Function at 0x4c1fb3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c1d81
Function at 0x4c5a78
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x5092e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x10f]
push ebx
push eax
mov esi, ecx
mov byte [ebp - 0x110], bl
call fcn.00401f80
add esp, 0xc
mov edx, esi
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x118], ebx
call fcn.00445b2f
test eax, eax
je 0x4c5acb
xor eax, eax
jmp 0x4c5b8f
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x11c]
mov edx, esi
call fcn.004b1a3f
pop ecx
test eax, eax
je 0x4c5ac4
call fcn.0041df75
push ebx
push ebx
mov edi, eax
call fcn.004623aa
push eax
lea eax, [ebp - 0x110]
push str._sLUA.DAT
push eax
call fcn.00401954
add esp, 0x14
mov dword [ebp - 0x114], ebx
push 0x327
push str.UpdatePAULA2.c
mov edx, 0x4cc8b8
lea ecx, [ebp - 0x110]
call fcn.004a0001
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
jne 0x4c5b60
push 0x96
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0041df75
sub eax, edi
cmp eax, 0x157c
ja 0x4c5ac4
inc dword [ebp - 0x114]
cmp dword [ebp - 0x114], 0xf
jl 0x4c5b0d
jmp 0x4c5ac4
push esi
push 1
lea eax, [ebp - 0x118]
push 4
push eax
call fcn.0040257f
push esi
push 1
lea eax, [ebp - 0x11c]
push 4
push eax
call fcn.0040257f
add esp, 0x20
mov ecx, esi
call fcn.004a2aec
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401317
leave
ret

Function at 0x4c5b9e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x5092e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push edi
push 0x103
lea eax, [ebp - 0x10f]
push ebx
push eax
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x11c], ebx
mov byte [ebp - 0x110], bl
call fcn.00401f80
lea eax, [ebp - 0x118]
add esp, 0xc
push eax
lea ecx, [ebp - 0x124]
lea edx, [ebp - 0x110]
call fcn.004b1a3f
pop ecx
test eax, eax
jne 0x4c5c0d
xor eax, eax
jmp 0x4c5ce8
call fcn.0041df75
push ebx
push ebx
mov dword [ebp - 0x128], eax
call fcn.004623aa
push eax
lea eax, [ebp - 0x110]
push str._sLUA.DAT
push eax
call fcn.00401954
add esp, 0x14
mov dword [ebp - 0x114], ebx
push 0x2e6
push str.UpdatePAULA2.c
mov edx, 0x4cc77c
lea ecx, [ebp - 0x110]
call fcn.004a0001
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
jne 0x4c5c99
lea edi, [ebp - 0x110]
call fcn.004a142a
test eax, eax
je 0x4c5ce5
push 0x96
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0041df75
sub eax, dword [ebp - 0x128]
cmp eax, 0x157c
ja 0x4c5ce5
inc dword [ebp - 0x114]
cmp dword [ebp - 0x114], 0xf
jl 0x4c5c3a
jmp 0x4c5ce5
push esi
push 1
lea eax, [ebp - 0x11c]
push 4
push eax
call fcn.00402244
push esi
push 1
lea eax, [ebp - 0x120]
push 4
push eax
call fcn.00402244
add esp, 0x20
mov ecx, esi
call fcn.004a2aec
mov eax, dword [ebp - 0x124]
cmp eax, dword [ebp - 0x120]
jne 0x4c5ce5
mov eax, dword [ebp - 0x118]
cmp eax, dword [ebp - 0x11c]
je 0x4c5c06
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401317
leave
ret
Function at 0x4afbe8
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4afc27
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4afc27
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4afc27
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4afc27
cmp dword [ecx + 0x74], 0xe
jbe 0x4afc27
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4b93bc
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4b9459
push ebx
push esi
call fcn.004b9385
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004b9319
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4b9406
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4b9458
push edi
push eax
call fcn.004b7e89
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4b9426
call fcn.004b78d6
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4b9457
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004b9319
add esp, 0x20
test eax, eax
jne 0x4b9445
push edi
call fcn.004b78d6
jmp 0x4b944d
push ebx
call fcn.004b78d6
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4ba80d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4c3a10
push 0x4c3a08
push str.FlsAlloc
push 0x1f
call fcn.004ba6cc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4ba841
push dword [ebp + 8]
mov ecx, esi
call dword [0x4c112c]
call esi
jmp 0x4ba847
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4ba88b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4c3a20
push 0x4c3a18
push str.FlsGetValue
push 0x21
call fcn.004ba6cc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4ba8c2
push dword [ebp + 8]
mov ecx, esi
call dword [0x4c112c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4ba8ca
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4c3a28
push 0x4c3a20
push str.FlsSetValue
push 0x22
call fcn.004ba6cc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4ba904
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x4c112c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]