joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41fdc0
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4fac77
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0
mov dword [esp + 0x14], esi
call fcn.0041f610
lea ebp, [esi + 8]
push 0
mov ecx, ebp
mov dword [esp + 0x30], 0
call fcn.0041f610
lea edi, [esi + 0x10]
push 0
mov ecx, edi
mov byte [esp + 0x30], 1
call fcn.0041f610
lea ebx, [esi + 0x18]
push 0
mov ecx, ebx
mov byte [esp + 0x30], 2
call fcn.0041f610
push 0
lea ecx, [esi + 0x20]
mov byte [esp + 0x30], 3
call fcn.0041f610
push 0
lea ecx, [esi + 0x28]
mov byte [esp + 0x30], 4
call fcn.0041f610
mov eax, dword [esp + 0x34]
mov ecx, edi
push eax
mov byte [esp + 0x30], 5
call fcn.0041f670
push 1
lea ecx, [esp + 0x18]
mov dword [esi + 0x30], 0
call fcn.0041f610
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 6
push ecx
mov ecx, esi
call fcn.0041f670
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 5
call fcn.0041f6c0
mov edx, dword [esp + 0x34]
sub esp, 8
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call fcn.0041f650
mov ecx, esi
call fcn.0041f530
test eax, eax
jge 0x41feaa
push esi
mov ecx, esi
call fcn.0041f6f0
inc dword [esi + 0x30]
jmp 0x41fe7f
push edi
lea eax, [esp + 0x20]
push esi
push eax
call fcn.0041f860
push edi
lea ecx, [esp + 0x24]
push eax
push ecx
mov byte [esp + 0x44], 7
call fcn.0041faf0
add esp, 0x18
push eax
mov ecx, ebp
mov byte [esp + 0x30], 8
call fcn.0041f670
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 7
call fcn.0041f6c0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], 5
call fcn.0041f6c0
push esi
lea edx, [esp + 0x18]
push edi
push edx
call fcn.0041faf0
push eax
lea eax, [esp + 0x2c]
push esi
push eax
mov byte [esp + 0x44], 9
call fcn.0041f860
add esp, 0x18
push eax
mov ecx, ebx
mov byte [esp + 0x30], 0xa
call fcn.0041f670
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], 9
call fcn.0041f6c0
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 5
call fcn.0041f6c0
mov ecx, dword [esp + 0x24]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret 4

Function at 0x420140
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4fad27
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov eax, dword [esp + 0x54]
push esi
push eax
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call fcn.0041fdc0
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x50]
mov esi, dword [esp + 0x4c]
push ecx
push edx
push esi
lea ecx, [esp + 0x14]
mov dword [esp + 0x50], 1
call fcn.00420010
mov dword [esp + 4], 1
lea ecx, [esp + 0x30]
mov dword [esp + 0x44], 6
call fcn.0041f6c0
lea ecx, [esp + 0x28]
mov byte [esp + 0x44], 5
call fcn.0041f6c0
lea ecx, [esp + 0x20]
mov byte [esp + 0x44], 4
call fcn.0041f6c0
lea ecx, [esp + 0x18]
mov byte [esp + 0x44], 3
call fcn.0041f6c0
lea ecx, [esp + 0x10]
mov byte [esp + 0x44], 2
call fcn.0041f6c0
lea ecx, [esp + 8]
mov byte [esp + 0x44], 0
call fcn.0041f6c0
mov ecx, dword [esp + 0x3c]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x44
ret
Function at 0x422670
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4fb01e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x13c
push ebx
xor ebx, ebx
push esi
mov dword [esp + 0x18], ebx
lea eax, [esp + 0x15c]
mov ecx, 0x55eb68
push eax
mov dword [esp + 0x150], 1
call fcn.004dc9bb
mov eax, dword [0x55a6f0]
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
push 0x55f23c
lea ecx, [esp + 0x14]
mov byte [esp + 0x150], 4
call fcn.004dc9bb
push 0x105
lea ecx, [esp + 0x14]
call fcn.004dccb2
lea ecx, [esp + 0x14]
mov esi, eax
push ecx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jne 0x42280b
push edi
mov ecx, 7
lea edi, [esp + 0x28]
mov byte [esp + 0x44], bl
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x45]
rep stosd dword es:[edi], eax
mov edx, dword [esp + 0x15c]
lea ecx, [esp + 0x24]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x44]
push ecx
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], 9
mov dword [esp + 0x3c], 0x422640
mov dword [esp + 0x40], ebx
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderA]
mov edi, eax
cmp edi, ebx
je 0x422800
lea edx, [esp + 0x44]
push edx
push edi
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x4227f5
lea eax, [esp + 0x44]
lea ecx, [esp + 0xc]
push eax
call fcn.004dca0b
mov eax, dword [esp + 0xc]
mov ecx, dword [eax - 8]
cmp byte [ecx + eax - 1], 0x5c
jne 0x4227cc
cmp byte [ecx + eax - 2], 0x3a
je 0x4227cc
mov eax, ecx
lea ecx, [esp + 0x20]
dec eax
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.004d500a
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x154], 5
call fcn.004dc9bb
lea ecx, [esp + 0x20]
mov byte [esp + 0x150], 4
call fcn.004dc882
mov eax, dword [esp + 0xc]
push ebx
push 0x105
lea ecx, [esp + 0x18]
mov esi, eax
call fcn.004dccb2
push eax
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
call fcn.004dcd01
mov eax, dword [esp + 0x18]
push edi
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
mov eax, dword [esp + 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
pop edi
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
call fcn.004dcd01
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x422847
test al, 0x10
je 0x422847
mov esi, dword [esp + 0x154]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.004dc5f7
mov dword [esp + 0x18], 1
jmp 0x422862
mov esi, dword [esp + 0x154]
push 0x55eb24
mov ecx, esi
call fcn.004dc8f0
mov dword [esp + 0x18], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x14c], 3
call fcn.004dc882
lea ecx, [esp + 0xc]
mov byte [esp + 0x14c], 2
call fcn.004dc882
lea ecx, [esp + 8]
mov byte [esp + 0x14c], 1
call fcn.004dc882
lea ecx, [esp + 0x15c]
mov byte [esp + 0x14c], bl
call fcn.004dc882
mov ecx, dword [esp + 0x144]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x148
ret
Function at 0x426ac6
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4fb433
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.004269d0
xor eax, eax
mov dword [esi + 0x28], 0x507df0
mov dword [esp + 0x10], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], eax
push eax
lea ecx, [esi + 0x10]
mov byte [esp + 0x14], 1
mov dword [esi], 0x507db4
mov dword [esi + 4], 0x64
call fcn.0041ec60
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x426ba0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4fb473
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.004269d0
xor eax, eax
mov dword [esi + 0x28], 0x507df0
mov dword [esp + 0x10], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], eax
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esi + 0x18], ecx
mov ecx, dword [esp + 0x20]
mov dword [esi + 8], edx
mov edx, dword [esp + 0x24]
mov dword [esi + 0xc], ecx
push eax
lea ecx, [esi + 0x10]
mov byte [esp + 0x14], 1
mov dword [esi], 0x507db4
mov dword [esi + 0x1c], edx
call fcn.0041ec60
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10

Function at 0x428d10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4fb863
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.004269d0
xor eax, eax
mov dword [esi + 0x24], 0x507df0
mov dword [esp + 0x10], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x2c], eax
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [esi + 8], ecx
push eax
lea ecx, [esi + 0x10]
mov byte [esp + 0x14], 1
mov dword [esi], 0x507e74
mov dword [esi + 0xc], edx
call fcn.0041ec60
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x42dc20
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4fbe78
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
push edi
mov dword [esi + 0xe8], 1
call fcn.004ddf39
test eax, eax
je 0x42dc58
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x42dc5a
xor eax, eax
push eax
lea ecx, [esp + 0xc]
call fcn.004e02c8
mov eax, dword [esp + 0x2c]
mov edi, dword [esp + 0xc]
mov dword [esi + 0x2a4], eax
mov ecx, dword [esp + 0x30]
lea eax, [esp + 8]
mov dword [esp + 0x24], 0
neg eax
sbb eax, eax
mov dword [esi + 0x2a8], ecx
and eax, edi
mov edi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
call edi
push eax
lea ecx, [esi + 0xec]
call fcn.004dfab4
mov ecx, dword [esp + 0xc]
lea eax, [esp + 8]
neg eax
sbb eax, eax
and eax, ecx
push eax
call edi
push eax
lea ecx, [esi + 0x11c]
call fcn.004dfab4
mov ecx, dword [esp + 0xc]
lea eax, [esp + 8]
neg eax
sbb eax, eax
and eax, ecx
push eax
call edi
push eax
lea ecx, [esi + 0x14c]
call fcn.004dfab4
mov ecx, dword [esp + 0xc]
lea eax, [esp + 8]
neg eax
sbb eax, eax
and eax, ecx
push eax
call edi
push eax
lea ecx, [esi + 0x17c]
call fcn.004dfab4
lea ecx, [esp + 8]
mov dword [esp + 0x24], 0xffffffff
call fcn.004e033a
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 8

Function at 0x4318a0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4fc193
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.00430500
mov eax, dword [0x55a6f0]
lea ecx, [esi + 0x4c]
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [ecx], eax
push 0x55eb24
mov byte [esp + 0x18], 1
mov dword [esi], 0x508314
mov dword [esi + 4], 0xa
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
call fcn.004dca0b
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x48], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x44], 0x64
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4318b6
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4fc193
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.00430500
mov eax, dword [0x55a6f0]
lea ecx, [esi + 0x4c]
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [ecx], eax
push 0x55eb24
mov byte [esp + 0x18], 1
mov dword [esi], 0x508314
mov dword [esi + 4], 0xa
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
call fcn.004dca0b
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x48], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x44], 0x64
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x43f870
Capabilities:
Get file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4fdf28
push eax
mov dword fs:[0], esp
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
or ecx, 0xffffffff
cmp eax, ecx
je 0x43f8bc
test al, 0x10
je 0x43f8bc
mov dword [esp + 8], ecx
lea ecx, [esp + 0x10]
call fcn.004dc882
mov eax, 1
mov ecx, dword [esp]
mov dword fs:[0], ecx
add esp, 0xc
ret
mov dword [esp + 8], ecx
lea ecx, [esp + 0x10]
call fcn.004dc882
mov ecx, dword [esp]
xor eax, eax
mov dword fs:[0], ecx
add esp, 0xc
ret
Function at 0x43f8e0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x4fdf48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10c
push ebx
push ebp
push esi
push edi
push ecx
lea eax, [esp + 0x130]
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
mov dword [esp + 0x12c], 0
call fcn.004dc5f7
call fcn.0043f870
add esp, 4
test eax, eax
je 0x43f94b
lea ecx, [esp + 0x12c]
mov dword [esp + 0x124], 0xffffffff
call fcn.004dc882
mov eax, 1
jmp 0x43fa44
mov ecx, dword [esp + 0x12c]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
push ecx
call ebp
mov esi, eax
test esi, esi
je 0x43f973
mov dword [esp + 0x124], 0xffffffff
jmp 0x43fa36
mov edx, dword [esp + 0x12c]
or ebx, 0xffffffff
mov edi, edx
mov ecx, ebx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x104
ja 0x43fa0a
mov edi, edx
mov ecx, ebx
repne scasb al, byte es:[edi]
lea esi, [esp + 0x14]
not ecx
sub edi, ecx
mov eax, esi
mov edx, ecx
mov esi, edi
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14]
mov ecx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 0x13], 0x5c
jne 0x43f9d7
lea edi, [esp + 0x14]
mov ecx, ebx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + ecx + 0x13], al
lea ecx, [esp + 0x14]
push 0x5c
push ecx
call fcn.004c2d50
add esp, 8
test eax, eax
je 0x43fa0a
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
mov byte [eax], 0
call fcn.004dc8f0
call fcn.0043f8e0
add esp, 4
test eax, eax
jne 0x43fa21
lea ecx, [esp + 0x12c]
mov dword [esp + 0x124], ebx
call fcn.004dc882
xor eax, eax
jmp 0x43fa44
mov eax, dword [esp + 0x12c]
push 0
push eax
call ebp
mov esi, eax
mov dword [esp + 0x124], ebx
lea ecx, [esp + 0x12c]
call fcn.004dc882
mov eax, esi
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x118
ret
Function at 0x43fa60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4fdf68
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov eax, dword [esi]
push eax
call edi
cmp eax, 0xffffffff
je 0x43faa6
test al, 0x10
je 0x43faa6
mov eax, 1
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x10
ret
mov eax, dword [0x55a6f0]
mov dword [esp + 0x1c], eax
mov ecx, dword [esi]
mov edx, dword [0x55f594]
push ecx
lea eax, [esp + 0x20]
push edx
push eax
mov dword [esp + 0x20], 0
call fcn.004d5408
mov ecx, dword [esp + 0x28]
add esp, 0xc
push 0
push 0x21
push ecx
call fcn.004e3f9c
cmp eax, 1
jne 0x43fb3b
push ecx
mov ecx, esp
mov dword [esp + 0xc], esp
push esi
call fcn.004dc5f7
call fcn.0043f8e0
mov esi, dword [esi]
add esp, 4
push esi
call edi
cmp eax, 0xffffffff
je 0x43fb2b
test al, 0x10
je 0x43fb2b
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.004dc882
mov eax, 1
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x10
ret
mov edx, dword [0x55f578]
push 0
push 0x30
push edx
call fcn.004e3f9c
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.004dc882
mov ecx, dword [esp + 0xc]
pop edi
xor eax, eax
mov dword fs:[0], ecx
pop esi
add esp, 0x10
ret
Function at 0x446a20
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [0x55edbc]
mov edx, dword [esp + 4]
sub esp, 0x104
lea ecx, [esp]
push eax
push 0x104
push ecx
push 0x55eb24
push edx
push str.Batch_Wizard
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x446a5b
mov eax, 1
add esp, 0x104
ret
lea eax, [esp]
push eax
call fcn.004c1e6b
mov ecx, dword [esp + 0x110]
add esp, 4
mov dword [ecx], eax
xor eax, eax
add esp, 0x104
ret

Function at 0x446a80
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [0x55edbc]
mov edx, dword [esp + 4]
sub esp, 0x104
lea ecx, [esp]
push eax
push 0x104
push ecx
push 0x55eb24
push edx
push str.Batch_Wizard
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x446acc
mov ecx, dword [esp + 0x10c]
push 0x55eb24
call fcn.004dca0b
mov eax, 1
add esp, 0x104
ret
mov ecx, dword [esp + 0x10c]
lea eax, [esp]
push eax
call fcn.004dca0b
xor eax, eax
add esp, 0x104
ret
Function at 0x44ef70
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x4feb16
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3f0
mov eax, dword [0x55a6f0]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], eax
xor edi, edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x408], edi
push 0x55efb0
lea ecx, [esp + 0x18]
mov byte [esp + 0x40c], 1
call fcn.004dc9bb
mov eax, dword [esp + 0x410]
lea ecx, [esp + 0x14]
push eax
call fcn.004dcc9a
mov ecx, dword [esp + 0x14]
push 0x54f1b0
push ecx
call fcn.004c1b6b
mov ebp, eax
add esp, 8
cmp ebp, edi
jne 0x44eff8
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push edx
push str.Failed_to_open__s.
push eax
jmp 0x44f1a8
mov al, byte [ebp + 0xc]
mov bl, 0x10
test bl, al
jne 0x44f0a5
cmp edi, 0x24d
jge 0x44f0ee
push ebp
lea ecx, [esp + 0x1c]
push 0x3e7
push ecx
call fcn.004c1d7e
add esp, 0xc
test eax, eax
je 0x44f0b9
lea esi, [edi*4 + 0x55f008]
lea edx, [esp + 0x18]
push edx
mov ecx, esi
call fcn.004dca0b
mov ecx, esi
call fcn.004d5464
push 0x552118
push 0x552114
mov ecx, esi
call fcn.004d4d72
push 0x552110
push 0x55210c
mov ecx, esi
call fcn.004d4d72
push 0x552108
push 0x552104
mov ecx, esi
call fcn.004d4d72
test edi, edi
jne 0x44f091
lea eax, [esp + 0x18]
push eax
call fcn.004c1e6b
add esp, 4
cmp eax, 0x24d
jne 0x44f0cd
mov al, byte [ebp + 0xc]
inc edi
test bl, al
je 0x44f005
cmp edi, 0x24d
jge 0x44f0ee
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push edx
push str._s_has_too_few_lines.
push eax
jmp 0x44f1a8
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
push str._s_has_too_few_lines.
push edx
jmp 0x44f1a8
mov eax, dword [esp + 0x14]
push 0x24d
push eax
lea ecx, [esp + 0x18]
push str._s_does_not_start_with__d.
push ecx
call fcn.004d5408
add esp, 0x10
jmp 0x44f1b0
push ebp
lea ecx, [esp + 0x1c]
push 0x3e7
push ecx
call fcn.004c1d7e
add esp, 0xc
test eax, eax
je 0x44f15b
lea edx, [esp + 0x18]
lea ecx, [esp + 0x10]
push edx
call fcn.004dca0b
lea ecx, [esp + 0x10]
call fcn.004d5464
test byte [ebp + 0xc], bl
je 0x44f199
mov eax, dword [esp + 0x10]
mov esi, 0x55eb24
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x44f152
test cl, cl
je 0x44f14e
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x44f152
add eax, 2
add esi, 2
test cl, cl
jne 0x44f12a
xor eax, eax
jmp 0x44f157
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x44f199
lea ecx, [esp + 0x14]
mov byte [esp + 0x408], 0
call fcn.004dc882
lea ecx, [esp + 0x10]
mov dword [esp + 0x408], 0xffffffff
call fcn.004dc882
mov ecx, dword [esp + 0x400]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x3fc
ret
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
push str._s_has_too_many_lines.
push ecx
call fcn.004d5408
add esp, 0xc
push str._n_nPlease_re_install_Image_Optimizer
lea ecx, [esp + 0x14]
call fcn.004dcc5e
mov edx, dword [esp + 0x10]
push 0
push 0x30
push edx
call fcn.004e3f9c
push 1
call fcn.004c30c2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x4579b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4ffbf6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x24], edi
mov eax, dword [0x55a6f0]
lea ebp, [esi + 0x38]
mov dword [ebp], eax
mov ecx, dword [0x55a6f0]
mov dword [esp + 0x18], edi
mov dword [esi + 0x3c], ecx
mov ecx, esi
mov byte [esp + 0x18], 1
mov dword [esi], 0x50b68c
mov dword [esi + 0x18], edi
mov dword [esi + 8], edi
mov dword [esi + 4], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x20], 0xffffffff
call fcn.0045e4f0
push 0x55eb24
mov ecx, ebp
mov dword [esi + 0x4c], 1
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x58], 1
mov dword [esi + 0x5c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
call fcn.004dca0b
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x2c], edi
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x462180
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x50015a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
push edi
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + 4]
mov eax, dword [eax + 8]
imul eax, ecx
push eax
call fcn.004c35da
mov ebx, eax
mov eax, dword [esi + 0xc]
mov dword [esp + 0x1c], ebx
mov eax, dword [eax + 8]
lea ecx, [eax*4]
push ecx
call fcn.004c35da
mov ebp, eax
mov eax, dword [esi + 0xc]
xor edi, edi
add esp, 8
mov edx, dword [eax + 8]
xor ecx, ecx
cmp edx, edi
mov dword [esp + 0x20], ebp
jle 0x4621fb
mov edx, ebp
mov eax, dword [eax + 4]
add edx, 4
imul eax, ecx
add eax, ebx
inc ecx
mov dword [edx - 4], eax
mov eax, dword [esi + 0xc]
cmp ecx, dword [eax + 8]
jl 0x4621e4
push 0x88
call fcn.004dc5c3
add esp, 4
mov dword [esp + 0x34], eax
cmp eax, edi
mov dword [esp + 0x2c], edi
je 0x462222
mov edx, dword [esp + 0x38]
mov ecx, eax
push edx
call fcn.00456ce0
mov edi, eax
mov eax, dword [edi + 0xc]
mov dword [esp + 0x34], edi
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x38], 0
mov ecx, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [ecx + 8]
test eax, eax
jle 0x4622ac
add edx, 2
mov dword [esp + 0x10], edx
xor eax, eax
cmp dword [ecx + 4], eax
jle 0x462286
mov edi, dword [esp + 0x14]
mov ecx, edx
sar edi, 3
mov edx, dword [ebp]
mov bl, byte [ecx]
add ecx, edi
mov byte [eax + edx], bl
mov edx, dword [esi + 0xc]
inc eax
cmp eax, dword [edx + 4]
jl 0x46226b
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x34]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x38]
add edx, ecx
mov ecx, dword [esi + 0xc]
inc eax
add ebp, 4
mov dword [esp + 0x38], eax
cmp eax, dword [ecx + 8]
mov dword [esp + 0x10], edx
jl 0x46225b
mov ebp, dword [esp + 0x20]
push ebp
push esi
call fcn.0045fae0
add esp, 8
mov esi, eax
test edi, edi
je 0x4622c5
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax + 4]
push ebx
call fcn.004c335b
push ebp
call fcn.004c335b
mov ecx, dword [esp + 0x2c]
add esp, 8
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret