joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49c4a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
mov esi, ecx
mov word [ebx], ax
mov eax, dword [esi]
test eax, eax
je 0x49c4c1
cmp word [eax], 0
jne 0x49c4e4
mov eax, dword [str.http:__conemu_maximus5.googlecode.com_svn_trunk_ConEmu_version.ini]
cmp word [eax], 0
jne 0x49c4e4
push str.Update.VerLocation_is_empty
push ebx
call fcn.00438c90
add esp, 8
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
mov al, byte [esi + 7]
cmp al, 1
je 0x49c50b
cmp al, 2
je 0x49c50b
cmp al, 3
je 0x49c50b
push str.Update.UseBuilds_is_not_specified
push ebx
call fcn.00438c90
add esp, 8
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.0049c330
movzx eax, al
sub eax, 1
je 0x49c683
sub eax, 1
je 0x49c539
push str.Update.DownloadSetup_is_not_specified
push ebx
call fcn.00438c90
add esp, 8
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
test eax, eax
je 0x49c546
cmp word [eax], 0
jne 0x49c552
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x49c552
mov eax, 0x4c1318
mov dword [ebp + 8], eax
cmp word [eax], 0
jne 0x49c573
push str.Update.ArcCmdLine_is_not_specified
push ebx
call fcn.00438c90
add esp, 8
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x20a
lea ecx, [ebp - 0x218]
push 0
push ecx
call fcn.004b03e0
push 0
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp + 8]
push eax
call fcn.004044b0
lea ecx, [ebp - 0x218]
push ecx
call fcn.004ad2c0
add esp, 0x1c
mov dword [ebp + 8], eax
test eax, eax
je 0x49c66b
cmp word [eax], 0
je 0x49c66b
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.WinRar.exe
push eax
call esi
test eax, eax
je 0x49c5f0
mov edx, dword [ebp + 8]
push str.Rar.exe
push edx
call esi
test eax, eax
je 0x49c5f0
mov eax, dword [ebp + 8]
push str.UnRar.exe
push eax
call esi
test eax, eax
jne 0x49c6b7
lea ecx, [ebp - 8]
push ecx
push 0x20019
push 0
push str.SoftwareWinRARExtractionProfile
push SysReAllocString
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49c64d
mov ecx, dword [ebp - 8]
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 4]
push eax
push 0
push 0
push str.UnpToSubfolders
push ecx
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x49c643
mov dword [ebp - 4], 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 0
je 0x49c6b7
push str.Update.ArcCmdLine:_Unwanted_option_n_HKCUSoftwareWinRARExtractionProfile__n_UnpToSubfolders_1
push ebx
call fcn.00438c90
add esp, 8
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.Update.ArcCmdLine_is_invalid
push ebx
call fcn.00438c90
add esp, 8
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x18]
test eax, eax
je 0x49c690
cmp word [eax], 0
jne 0x49c6b7
mov esi, dword [esi + 0x1c]
test esi, esi
je 0x49c69f
mov eax, esi
cmp word [eax], 0
jne 0x49c6b7
push str.Update.ExeCmdLine_is_not_specified
push ebx
call fcn.00438c90
add esp, 8
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 4
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x49c6d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf786
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x50]
mov dword [ebp - 0x10], esi
mov dword [esi], 0x4e431c
call fcn.004ade80
xor ebx, ebx
lea ecx, [esi + 0x74]
mov dword [ebp - 4], ebx
call fcn.004ade80
lea ecx, [esi + 0x84]
mov byte [ebp - 4], 1
call fcn.004ade80
mov edi, dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push str.ConEmuTabsChanged
call edi
push str.CConEmuChild::PostFullPaint
mov dword [esi + 0x10], eax
call edi
push str.CConEmuChild::SavePaneSnapshoot
mov dword [esi + 0x14], eax
call edi
push str.CConEmuChild::Detach
mov dword [esi + 0x18], eax
call edi
push str.ConEmu::RestoreChildFocus
mov dword [esi + 0x1c], eax
call edi
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
xor eax, eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x28], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0xa0], eax
mov dword [esi + 0xa4], eax
mov dword [esi + 0xa8], eax
mov dword [esi + 0xac], eax
mov dword [esi + 0xb0], eax
mov dword [esi + 0x60], ebx
mov dword [esi + 0x98], 0x1c
mov dword [esi + 0x9c], 7
mov eax, dword [0x50b3a0]
mov cl, byte [eax + 0x113f8]
mov byte [esi + 0x94], cl
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0xb4], bl
xor eax, eax
mov dword [esi + 0xb8], eax
mov dword [esi + 0xbc], eax
mov dword [esi + 0xc0], eax
mov dword [esi + 0xc4], eax
mov dword [esi + 0xc8], eax
mov dword [esi + 0xcc], eax
mov dword [esi + 0xd0], eax
mov dword [esi + 0xd4], eax
mov dword [esi + 0xd8], eax
mov dword [esi + 0xdc], eax
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x49d150
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x49d1af
cmp dword [esi + 0x28], 0
jne 0x49d1af
mov ecx, dword [0x50b39c]
call fcn.004068a0
test al, al
jne 0x49d1bb
cmp dword [esi + 0x4c], 0
push edi
jne 0x49d1b1
cmp dword [esi + 0x44], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
je 0x49d189
call edi
sub eax, dword [esi + 0x44]
cmp eax, 5
jb 0x49d1b1
call edi
mov ecx, dword [esi + 4]
push 0
mov dword [esi + 0x44], eax
mov eax, dword [esi + 0x14]
push 0
push eax
push ecx
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 1
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
ret
pop edi
mov dword [esi + 0x48], 1
pop esi
ret
mov edx, dword [esi + 4]
push 0
push 0
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov dword [esi + 0x4c], 0
pop esi
ret
Function at 0x49d2e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4bf7a0
push eax
mov dword fs:[0], esp
sub esp, 0x2c
cmp byte [ebp + 8], 0
push esi
mov esi, ecx
je 0x49d330
mov eax, dword [0x50b3a0]
mov al, byte [eax + 0x113f8]
test al, al
jne 0x49d326
xor eax, eax
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
cmp al, 1
je 0x49d330
cmp dword [esi + 0x64], 0
je 0x49d313
push ebx
xor ebx, ebx
cmp esi, ebx
je 0x49d33c
lea eax, [esi - 8]
jmp 0x49d33e
xor eax, eax
push eax
lea ecx, [ebp - 0x10]
call fcn.004a4840
lea ecx, [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.004a4720
push ebx
lea ecx, [ebp + 8]
push ecx
mov ecx, dword [0x50b39c]
mov byte [ebp - 4], 1
call fcn.004065f0
test eax, eax
jl 0x49d483
push edi
lea ecx, [ebp + 8]
call fcn.004a4800
mov ecx, eax
call fcn.004a4a70
mov edi, eax
test edi, edi
je 0x49d482
mov ecx, edi
call fcn.00476e20
test eax, eax
je 0x49d482
mov ecx, edi
call fcn.0049ca00
test eax, eax
jne 0x49d482
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
cmp dword [esi + 0x70], eax
je 0x49d3d5
push 1
call edi
mov edx, 0x8000
and ax, dx
mov ecx, edx
cmp ax, cx
je 0x49d3cb
mov dword [esi + 0x70], 0
cmp dword [esi + 0x70], 0
jne 0x49d47d
lea edx, [ebp - 0x18]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [esi + 8]
lea eax, [ebp - 0x38]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x28], edx
mov edx, dword [ebp - 0x2c]
push 2
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], edx
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x14]
sub ecx, eax
mov eax, dword [ebp - 0x18]
push edx
mov dword [ebp - 0x28], ecx
push eax
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x49d482
cmp dword [esi + 0x64], 0
jne 0x49d47d
push 0x10
call edi
mov edx, 0x8000
and ax, dx
mov ecx, edx
cmp ax, cx
je 0x49d482
push 0x11
call edi
mov edx, 0x8000
and ax, dx
mov ecx, edx
cmp ax, cx
je 0x49d482
push 0x12
call edi
mov edx, 0x8000
and ax, dx
mov ecx, edx
cmp ax, cx
je 0x49d482
push 1
call edi
mov edx, 0x8000
and ax, dx
mov ecx, edx
cmp ax, cx
je 0x49d482
mov ebx, 1
pop edi
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0
call fcn.004a4770
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.004a4770
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x49e050
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x49e080
cmp dword [esi + 0x48], 0
je 0x49e080
cmp dword [esi + 0x44], 0
je 0x49e080
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x44]
cmp eax, 5
jb 0x49e080
mov dword [esi + 0x48], 0
mov ecx, esi
pop esi
jmp fcn.0049d150
pop esi
ret
Function at 0x4a4c80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
push esi
mov esi, ecx
test esi, esi
je 0x4a4e47
cmp dword [esi + 0xe8], 0
je 0x4a4e47
mov eax, dword [esi + 0x17c]
mov ecx, dword [esi + 0x178]
mov edx, dword [esi + 0x16c]
push edi
mov edi, dword [ebp + 8]
push edi
push eax
push ecx
push 0
push edx
call fcn.0048e6a0
add esp, 0x14
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4a4d04
push 0
push 0
push 0
push 0
push str.Cant_create_file_
call fcn.004200b0
add esp, 0x14
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [0x50b39c]
push ebx
push 1
call fcn.004065c0
mov ecx, eax
lea ebx, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x4a4d17
sub ecx, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
sar ecx, 1
lea edx, [ebp + 8]
push edx
add ecx, ecx
push ecx
push eax
push edi
call ebx
movsx edx, word [esi + 0x116]
movsx eax, word [esi + 0x114]
mov ecx, dword [esi + 0xf8]
push edx
mov edx, dword [esi + 0xf4]
push eax
push ecx
push edx
lea eax, [ebp - 0xc8]
push str._r_nSize:__ix_i___Cursor:__ix_i_r_n
push eax
call fcn.0049e9c0
lea eax, [ebp - 0xc8]
add esp, 0x18
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4a4d74
sub eax, edx
push 0
sar eax, 1
lea ecx, [ebp + 8]
push ecx
lea edx, [eax + eax]
push edx
lea eax, [ebp - 0xc8]
push eax
push edi
call ebx
mov edx, dword [esi + 0xf4]
imul edx, dword [esi + 0xf8]
mov eax, dword [esi + 0x268]
push 0
lea ecx, [ebp + 8]
push ecx
add edx, edx
push edx
push eax
push edi
call ebx
mov eax, dword [esi + 0xf4]
imul eax, dword [esi + 0xf8]
lea edx, [eax + eax*2]
mov eax, dword [esi + 0x270]
push 0
add edx, edx
lea ecx, [ebp + 8]
push ecx
add edx, edx
add edx, edx
push edx
push eax
push edi
call ebx
mov edx, dword [esi + 0xf4]
imul edx, dword [esi + 0xf8]
mov eax, dword [esi + 0x26c]
push 0
lea ecx, [ebp + 8]
push ecx
add edx, edx
push edx
push eax
push edi
call ebx
mov eax, dword [esi + 0xf4]
imul eax, dword [esi + 0xf8]
lea edx, [eax + eax*2]
mov eax, dword [esi + 0x274]
push 0
add edx, edx
lea ecx, [ebp + 8]
push ecx
add edx, edx
add edx, edx
push edx
push eax
push edi
call ebx
mov ecx, dword [esi + 0xe8]
pop ebx
test ecx, ecx
je 0x4a4e36
push edi
call fcn.00476a50
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4a63a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov ecx, dword [esi + 0xe8]
test ecx, ecx
je 0x4a63d6
call fcn.0049ca00
test eax, eax
je 0x4a63d6
mov ecx, dword [esi + 0xe8]
call fcn.00476e20
test eax, eax
jne 0x4a63d6
mov eax, dword [ebp + 8]
mov byte [eax], 0
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [esi + 0xe8]
push ebx
push edi
push 0
call fcn.0047dfd0
mov ecx, dword [0x50b3a0]
push eax
call fcn.004430b0
cmp dword [esi + 0x1520], 0
push 1
setne cl
mov dword [esi + 0x14e4], eax
mov byte [esi + 0x112], cl
mov ecx, dword [0x50b39c]
xor edi, edi
push edi
call fcn.004068c0
push edi
push esi
mov byte [ebp - 3], al
call fcn.0049fc10
mov bl, al
add esp, 8
test bl, bl
jne 0x4a643d
mov ecx, dword [0x50b39c]
push esi
call fcn.00406a80
mov byte [ebp - 2], bl
test al, al
je 0x4a6441
mov byte [ebp - 2], 1
mov ecx, dword [esi + 0xe8]
test ecx, ecx
je 0x4a646b
call fcn.00479180
test al, al
jne 0x4a6465
mov ecx, dword [esi + 0xe8]
push 1
call fcn.00478e80
test al, al
jne 0x4a646b
mov byte [ebp - 1], 1
jmp 0x4a646f
mov byte [ebp - 1], 0
cmp dword [esi + 0x1520], edi
je 0x4a6590
cmp byte [esi + 0x1530], 0
je 0x4a6590
test bl, bl
mov bl, byte [ebp - 3]
je 0x4a6497
test bl, bl
je 0x4a6497
mov al, 1
jmp 0x4a6499
xor al, al
mov ecx, dword [esi + 0x14e4]
push eax
call fcn.00476960
test al, al
jne 0x4a64c7
mov byte [esi + 0x110], 1
cmp byte [esi + 0x113], bl
jne 0x4a659a
mov edx, dword [ebp + 8]
mov byte [edx], 1
jmp 0x4a659a
mov ax, word [esi + 0x114]
cmp ax, word [esi + 0x1504]
jne 0x4a6576
mov cx, word [esi + 0x116]
cmp cx, word [esi + 0x1506]
jne 0x4a6576
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x128]
cmp eax, dword [esi + 0x124]
jbe 0x4a659a
mov ecx, dword [0x50b39c]
call fcn.00406400
test al, al
je 0x4a6524
mov byte [esi + 0x110], 0
mov edi, 1
jmp 0x4a659a
cmp byte [esi + 0x113], 0
je 0x4a6545
test bl, bl
je 0x4a6545
mov edx, dword [ebp + 8]
mov byte [esi + 0x110], 1
mov byte [edx], 1
mov edi, 1
jmp 0x4a659a
cmp byte [ebp - 2], 0
je 0x4a6569
cmp byte [esi + 0x110], 0
je 0x4a655a
cmp byte [ebp - 1], 0
jne 0x4a6569
mov eax, 1
mov byte [esi + 0x110], al
mov edi, eax
jmp 0x4a659a
xor eax, eax
mov byte [esi + 0x110], al
lea edi, [eax + 1]
jmp 0x4a659a
mov al, byte [ebp - 2]
mov byte [esi + 0x110], al
test al, al
je 0x4a6589
mov eax, dword [ebp + 8]
mov byte [eax], 1
mov edi, 1
jmp 0x4a659a
mov bl, byte [ebp - 3]
mov byte [esi + 0x110], 0
mov cl, byte [esi + 0x110]
cmp cl, byte [esi + 0x111]
je 0x4a65c2
mov ecx, dword [0x50b39c]
call fcn.00406400
test al, al
jne 0x4a65c2
mov edx, dword [ebp + 8]
mov byte [edx], 1
mov edi, 1
mov al, byte [esi + 0x110]
test al, al
je 0x4a65d7
test bl, bl
sete cl
mov byte [esi + 0x113], cl
test edi, edi
pop edi
mov byte [esi + 0x111], al
pop ebx
je 0x4a65ef
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x128], eax
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4ab460
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi], ebx
je 0x4ab4a3
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x4ab47f
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esi + 4], ebx
mov eax, dword [esi]
cmp eax, ebx
je 0x4ab48e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
mov dword [esi], ebx
mov dword [esi + 8], ebx
mov dword [esi + 4], ebx
mov dword [esi + 0xc], 0xffffffff
mov dword [esi + 0x110], ebx
xor ecx, ecx
lea edi, [esi + 0x10]
lea eax, [esi + 0x114]
mov dword [esi + 0x110], ebx
mov word [eax], cx
cmp word [edi], bx
jne 0x4ab4d3
push str.Internal_error._Mapping_file_name_was_not_specified.
push eax
call fcn.0040f030
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
cmp eax, ebx
jg 0x4ab4df
mov eax, 0xf8
mov edx, dword [ebp + 8]
mov dword [esi + 0xc], eax
cmp edx, ebx
jne 0x4ab4f2
cmp dword [ebp + 0xc], ebx
jne 0x4ab4f2
xor ecx, ecx
jmp 0x4ab4f7
mov ecx, 1
mov dword [esi + 8], ecx
push edi
cmp edx, ebx
je 0x4ab513
push eax
push ebx
push 4
call fcn.00441aa0
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
jmp 0x4ab51c
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ecx, eax
mov dword [esi], eax
cmp ecx, ebx
jne 0x4ab549
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x110], eax
mov ecx, str.create
cmp dword [ebp + 8], ebx
jne 0x4ab53f
mov ecx, str.open
push edi
push eax
push ecx
push str.Cant__s_console_data_file_mapping._ErrCode0x_08X_n_s
jmp 0x4ab58d
mov eax, dword [esi + 8]
neg eax
push ebx
sbb eax, eax
push ebx
and eax, 0xf001b
push ebx
add eax, 4
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 4], eax
cmp eax, ebx
jne 0x4ab5a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x110], eax
mov ecx, str.ReadWrite
cmp dword [esi + 8], ebx
jne 0x4ab585
mov ecx, str.Read
push edi
push eax
push ecx
push str.Cant_map_console_info___s_._ErrCode0x_08X_n_s
lea eax, [esi + 0x114]
push 0x208
push eax
call fcn.00441b50
add esp, 0x18
mov eax, dword [esi + 4]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4acca0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x284
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
je 0x4acdeb
cmp word [esi], bx
je 0x4acdeb
push edi
push 0x24c
lea eax, [ebp - 0x280]
push ebx
push eax
mov dword [ebp - 0x284], ebx
call fcn.004b03e0
add esp, 0xc
lea ecx, [ebp - 0x284]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4acd7c
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4acd73
push ebx
push ebx
push 3
push ebx
push 1
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, ebx
je 0x4acd6c
push 0x30
lea edx, [ebp - 0x30]
push ebx
push edx
mov dword [ebp - 0x34], ebx
call fcn.004b03e0
add esp, 0xc
lea eax, [ebp - 0x34]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x4acd6c
test byte [ebp - 0x34], 0x10
jne 0x4acd6c
mov ecx, dword [ebp + 0xc]
lea edi, [ebx + 1]
cmp ecx, ebx
je 0x4acd6c
cmp dword [ebp - 0x14], ebx
je 0x4acd67
or eax, 0xffffffff
push esi
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov dword [ecx], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
test byte [ebp - 0x284], 0x10
je 0x4acda9
lea ecx, [ebp - 0x284]
push ecx
push edi
call esi
test eax, eax
jne 0x4acd82
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
mov ebx, 1
test ecx, ecx
je 0x4acddb
cmp dword [ebp - 0x268], 0
je 0x4acdd3
or eax, 0xffffffff
push edi
mov dword [ecx], eax
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x264]
mov dword [ecx], eax
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4acee0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4acf9f
cmp word [edi], 0
je 0x4acf9f
push ebx
push esi
push 0x5c
push edi
mov dword [ebp + 8], 0
call fcn.004b03ac
push 0x5c
push edi
mov ebx, eax
call fcn.004b135e
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4acf23
cmp esi, ebx
jne 0x4acf46
xor esi, esi
push edi
call fcn.004ace00
add esp, 4
test eax, eax
jne 0x4acf66
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4acf70
mov dword [ebp + 8], 1
jmp 0x4acf8b
xor eax, eax
mov word [esi], ax
cmp word [esi + 2], ax
jne 0x4acf30
push edi
call fcn.004ace00
add esp, 4
test eax, eax
je 0x4acf30
mov ecx, 0x5c
mov word [esi], cx
pop esi
pop ebx
mov eax, 1
pop edi
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x4acf97
cmp eax, 5
je 0x4acf8b
push edi
call fcn.004acee0
add esp, 4
mov dword [ebp + 8], eax
test esi, esi
je 0x4acf97
mov edx, 0x5c
mov word [esi], dx
mov eax, dword [ebp + 8]
pop esi
pop ebx
pop edi
pop ebp
ret
xor eax, eax
pop edi
pop ebp
ret

Function at 0x4acfb0
Capabilities:
Check os version
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push ebx
push 0x110
xor ebx, ebx
lea eax, [ebp - 0x120]
push ebx
push eax
mov dword [ebp - 0x124], 0x114
call fcn.004b03e0
add esp, 0xc
lea ecx, [ebp - 0x124]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x120], 6
jae 0x4acff8
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x10]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 8]
push eax
mov byte [ebp - 8], bl
mov byte [ebp - 7], bl
mov byte [ebp - 6], bl
mov byte [ebp - 5], bl
mov byte [ebp - 4], bl
mov byte [ebp - 3], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x4ad052
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 0xc]
push ecx
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x4ad045
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0xc]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ad060
Capabilities:
Check if process is running under wine

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareWine
push SysReAllocString
xor bl, bl
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
call esi
test eax, eax
jne 0x4ad0b5
lea ecx, [ebp - 8]
push ecx
push 0x20019
push eax
push str.SoftwareWine
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x4ad0b5
mov bl, 1
mov eax, dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4ad0c5
push eax
call esi
mov eax, dword [ebp - 8]
test eax, eax
je 0x4ad0cf
push eax
call esi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret