joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4adfe0
Capabilities:
Connect socket

Disassembly:
sub esp, 0x20c
mov eax, dword [0x5b7b5c]
xor eax, esp
mov dword [esp + 0x208], eax
mov eax, dword [esp + 0x210]
push ebp
push esi
mov esi, ecx
mov ecx, dword [esp + 0x21c]
mov dword [esp + 8], eax
mov eax, ecx
push edi
mov edi, dword [esp + 0x224]
lea ebp, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x4ae017
push 0
push 0
push 0x1f3
sub eax, ebp
lea edx, [esp + 0x2c]
push edx
sar eax, 1
push eax
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov byte [esp + eax + 0x20], 0
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x228]
push eax
push edi
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x1c]
push edx
mov ecx, esi
call fcn.004adec0
test eax, eax
jne 0x4ae079
xor eax, eax
jmp 0x4ae0b9
cmp dword [esi + 0x2c], 0
jne 0x4ae075
mov ecx, dword [esp + 0xc]
push 0x10
lea eax, [esp + 0x14]
mov dword [esi + 0x2c], 1
mov edx, dword [ecx]
push eax
push edx
call dword [sym.imp.WSOCK32.dll_connect]
mov edi, eax
mov dword [esi + 0x2c], 0
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
mov ecx, esi
call fcn.004adc20
xor eax, eax
cmp edi, 0xffffffff
setne al
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0053f73f
add esp, 0x20c
ret 0x10

Function at 0x4ae0e0
Capabilities:
Create tcp socket

Disassembly:
push esi
mov esi, ecx
call fcn.004adb10
mov ecx, esi
call fcn.004ade30
test eax, eax
jne 0x4ae0f7
pop esi
ret 0xc
push edi
push 6
push 1
push 2
lea edi, [esi + 0x1c]
call dword [sym.imp.WSOCK32.dll_socket]
mov dword [edi], eax
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
mov ecx, esi
call fcn.004adc20
mov eax, dword [edi]
cmp eax, 0xffffffff
je 0x4ae151
push eax
mov ecx, esi
call fcn.004ad920
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push eax
push ecx
push edx
push edi
mov ecx, esi
call fcn.004adfe0
mov edi, eax
test edi, edi
jne 0x4ae14a
mov ecx, esi
call fcn.004adb10
mov eax, edi
pop edi
pop esi
ret 0xc
pop edi
xor eax, eax
pop esi
ret 0xc

Function at 0x4ae160
Capabilities:
Create tcp socket

Disassembly:
push esi
push edi
mov edi, ecx
call fcn.004ad9b0
push 6
push 1
push 2
lea esi, [edi + 0x24]
call dword [sym.imp.WSOCK32.dll_socket]
mov dword [esi], eax
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
mov ecx, edi
call fcn.004adc20
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x4ae1d1
push eax
mov ecx, edi
call fcn.004ad920
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push eax
push ecx
push edx
push esi
mov ecx, edi
call fcn.004adfe0
test eax, eax
jne 0x4ae1d8
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x4ae1d1
push 2
push eax
call dword [sym.imp.WSOCK32.dll_shutdown]
mov eax, dword [esi]
push eax
call dword [sym.imp.WSOCK32.dll_closesocket]
mov dword [esi], 0xffffffff
pop edi
xor eax, eax
pop esi
ret 0xc
pop edi
mov eax, 1
pop esi
ret 0xc
Function at 0x4ae1f0
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
cmp dword [esp + 0x10], 0
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], ecx
je 0x4ae205
mov ebx, dword [ecx + 0x24]
jmp 0x4ae208
mov ebx, dword [ecx + 0x1c]
mov esi, dword [esp + 0x1c]
test esi, esi
jle 0x4ae263
mov ebp, dword [sym.imp.WSOCK32.dll_send]
mov edi, dword [esp + 0x18]
lea ebx, [ebx]
push 0
push esi
push edi
push ebx
call ebp
cmp eax, 0xffffffff
je 0x4ae245
test eax, eax
je 0x4ae25f
sub esi, eax
add edi, eax
test esi, esi
jg 0x4ae220
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret 0xc
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov ecx, dword [esp + 0x10]
push eax
call fcn.004adc20
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 0xc
test esi, esi
jg 0x4ae255
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret 0xc

Function at 0x4ae270
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push 0xffffffffffffffff
push 0x563f2b
mov eax, dword fs:[0]
push eax
sub esp, 0x18c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5b7b5c]
xor eax, esp
push eax
lea eax, [esp + 0x1a0]
mov dword fs:[0], eax
mov ebp, ecx
mov dword [esp + 0x20], ebp
xor edi, edi
cmp dword [esp + 0x1bc], edi
je 0x4ae2b7
mov eax, dword [ebp + 0x24]
mov dword [esp + 0x14], eax
jmp 0x4ae2be
mov ecx, dword [ebp + 0x1c]
mov dword [esp + 0x14], ecx
cmp dword [0x5ed78c], edi
je 0x4ae37f
mov edx, dword [esp + 0x14]
mov ebx, dword [sym.imp.WSOCK32.dll_select]
lea eax, [esp + 0x18]
push eax
push edi
push edi
lea ecx, [esp + 0xa8]
push ecx
push 1
mov dword [esp + 0xb4], edx
mov dword [esp + 0xb0], 1
mov dword [esp + 0x2c], 0x1e
mov dword [esp + 0x30], edi
call ebx
mov esi, eax
cmp esi, edi
jne 0x4ae37d
mov ebp, vtable.CMyDialog.0
push edi
lea ecx, [esp + 0x28]
call fcn.00456320
lea ecx, [esp + 0x24]
mov dword [esp + 0x1a8], edi
call fcn.0044c630
cmp eax, 1
jne 0x4ae3bf
cmp dword [esp + 0x98], edi
je 0x4ae346
mov dword [0x5ed78c], edi
mov esi, eax
jmp 0x4ae35b
lea edx, [esp + 0x18]
push edx
push edi
push edi
lea eax, [esp + 0xa8]
push eax
push 1
call ebx
mov esi, eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x1a8], 0xffffffff
mov dword [esp + 0x24], ebp
call fcn.004ff9d7
cmp esi, edi
je 0x4ae310
mov ebp, dword [esp + 0x20]
cmp esi, edi
jl 0x4ae3d7
mov eax, dword [esp + 0x1b4]
cmp eax, edi
mov esi, dword [esp + 0x1b8]
jle 0x4ae3a8
mov ecx, dword [esp + 0x1b0]
mov edx, dword [esp + 0x14]
push edi
push eax
push ecx
push edx
call dword [sym.imp.WSOCK32.dll_recv]
add dword [esi], eax
cmp dword [esi], 0xffffffff
jne 0x4ae3db
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
mov ecx, ebp
call fcn.004adc20
xor eax, eax
jmp 0x4ae3e0
lea ecx, [esp + 0x24]
mov dword [esp + 0x1a8], 0xffffffff
mov dword [esp + 0x24], ebp
call fcn.004ff9d7
xor eax, eax
jmp 0x4ae3e0
mov eax, 1
mov ecx, dword [esp + 0x1a0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x198
ret 0x10
Function at 0x4ae400
Capabilities:
Create tcp socket
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x30
mov eax, dword [0x5b7b5c]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x34]
push ebx
push esi
push edi
push 6
mov esi, ecx
mov ecx, dword [esp + 0x48]
push 1
push 2
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
lea edi, [esi + 0x20]
call dword [sym.imp.WSOCK32.dll_socket]
mov ebx, dword [sym.imp.WSOCK32.dll_WSAGetLastError]
mov dword [edi], eax
call ebx
push eax
mov ecx, esi
call fcn.004adc20
mov eax, dword [edi]
cmp eax, 0xffffffff
jne 0x4ae461
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0053f73f
add esp, 0x30
ret 8
push ebp
push eax
mov ecx, esi
call fcn.004ad920
xor eax, eax
push eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
call dword [sym.imp.WSOCK32.dll_htons]
mov ecx, dword [edi]
mov word [esp + 0x1e], ax
push 0x10
lea eax, [esp + 0x20]
push eax
mov edx, 2
push ecx
mov word [esp + 0x28], dx
mov dword [esp + 0x2c], 0
call dword [sym.imp.WSOCK32.dll_bind]
mov ebp, eax
call ebx
push eax
mov ecx, esi
call fcn.004adc20
cmp ebp, 0xffffffff
jne 0x4ae4ec
mov eax, dword [edi]
cmp eax, ebp
je 0x4ae532
push 2
push eax
call dword [sym.imp.WSOCK32.dll_shutdown]
mov edx, dword [edi]
push edx
call dword [sym.imp.WSOCK32.dll_closesocket]
mov dword [edi], ebp
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0053f73f
add esp, 0x30
ret 8
mov edx, dword [edi]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x20]
push ecx
push edx
mov dword [esp + 0x1c], 0x10
call dword [sym.imp.WSOCK32.dll_getsockname]
mov ebp, eax
call ebx
push eax
mov ecx, esi
call fcn.004adc20
cmp ebp, 0xffffffff
jne 0x4ae549
mov eax, dword [edi]
cmp eax, ebp
je 0x4ae532
push 2
push eax
call dword [sym.imp.WSOCK32.dll_shutdown]
mov eax, dword [edi]
push eax
call dword [sym.imp.WSOCK32.dll_closesocket]
mov dword [edi], ebp
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0053f73f
add esp, 0x30
ret 8
mov ecx, dword [edi]
push 1
push ecx
call dword [sym.imp.WSOCK32.dll_listen]
mov ebp, eax
call ebx
push eax
mov ecx, esi
call fcn.004adc20
cmp ebp, 0xffffffff
je 0x4ae595
mov ecx, dword [esi + 0x1c]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x30]
lea edi, [esi + 0x1c]
push eax
push ecx
mov dword [esp + 0x1c], 0x10
call dword [sym.imp.WSOCK32.dll_getsockname]
mov ebp, eax
call ebx
push eax
mov ecx, esi
call fcn.004adc20
cmp ebp, 0xffffffff
jne 0x4ae5b4
push edi
mov ecx, esi
call fcn.004ad980
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.0053f73f
add esp, 0x30
ret 8
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x18]
mov cx, word [esp + 0x1e]
pop ebp
mov dword [eax], edx
mov edx, dword [esp + 0x10]
pop edi
mov word [edx], cx
mov ecx, dword [esp + 0x34]
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0053f73f
add esp, 0x30
ret 8
Function at 0x4ae900
Capabilities:
Encrypt data via sspi
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x64
push edi
xor edi, edi
mov dword [esp + 0xc], ecx
cmp dword [esp + 0x74], edi
je 0x4ae915
add ecx, 0x50
jmp 0x4ae918
add ecx, 0x48
lea eax, [esp + 0x24]
push eax
push 4
push ecx
mov dword [esp + 0x14], ecx
call dword [sym.imp.Secur32.dll_QueryContextAttributesW]
test eax, eax
jge 0x4ae937
xor eax, eax
pop edi
add esp, 0x64
ret 0xc
push 0x2c
lea edx, [esp + 0x40]
push edi
push edx
mov dword [esp + 0x44], edi
call fcn.0053ff80
add esp, 0xc
push ebx
push ebp
mov dword [esp + 0xc], edi
mov dword [esp + 0x1c], edi
push esi
mov esi, dword [esp + 0x7c]
sub esi, dword [esp + 0x10]
xor ebp, ebp
cmp esi, edi
mov dword [esp + 0x1c], edi
jg 0x4ae975
mov dword [esp + 0x20], 1
jmp 0x4aea96
mov ebx, dword [esp + 0x38]
add ebx, ebx
push ebx
call fcn.004ff95f
mov edi, eax
mov eax, dword [esp + 0x34]
lea ecx, [eax + eax]
push ecx
call fcn.004ff95f
mov edx, dword [esp + 0x3c]
mov ebp, eax
lea eax, [edx + edx]
push eax
call fcn.004ff95f
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x44]
add esp, 0xc
cmp esi, eax
jbe 0x4ae9b0
mov esi, eax
mov edx, dword [esp + 0x78]
mov ecx, dword [esp + 0x10]
push esi
add ecx, edx
push ecx
push ebx
push edi
call fcn.0053f74e
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x2c]
add dword [esp + 0x20], esi
add esp, 0x10
mov dword [esp + 0x44], eax
xor eax, eax
push eax
mov dword [esp + 0x60], edx
lea edx, [esp + 0x28]
push edx
push eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x70], ecx
lea ecx, [esp + 0x50]
push eax
mov dword [esp + 0x5c], ebp
mov dword [esp + 0x58], 7
mov dword [esp + 0x68], edi
mov dword [esp + 0x60], esi
mov dword [esp + 0x64], 1
mov dword [esp + 0x70], 6
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x38], 4
call sub.Secur32.dll_EncryptMessage
test eax, eax
jl 0x4aea96
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x4c]
push ecx
mov ecx, dword [esp + 0x1c]
push edx
push eax
call fcn.004ae1f0
test eax, eax
je 0x4aea96
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x1c]
push edx
push eax
call fcn.004ae1f0
test eax, eax
je 0x4aea96
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x5c]
mov eax, dword [esp + 0x64]
push ecx
mov ecx, dword [esp + 0x1c]
push edx
push eax
call fcn.004ae1f0
push ebp
call fcn.004ff96a
push edi
call fcn.004ff96a
mov ecx, dword [esp + 0x24]
push ecx
call fcn.004ff96a
xor edi, edi
add esp, 0xc
cmp dword [esp + 0x20], edi
je 0x4ae956
mov eax, dword [esp + 0x20]
pop esi
pop ebp
pop ebx
pop edi
add esp, 0x64
ret 0xc
Function at 0x4b0b60
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x828
mov eax, dword [0x5b7b5c]
xor eax, esp
mov dword [esp + 0x824], eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x41c]
push edx
push str.SoftwareMicrosoftInternet_ExplorerView_Source_EditorEditor_Name
xor eax, eax
push reloc.WSOCK32.dll_bind
mov word [esp + 0x428], ax
mov dword [esp + 0x14], 0x208
call esi
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x41c]
push ecx
push str.SoftwareMicrosoftInternet_ExplorerView_Source_EditorEditor_Name
push reloc.WSOCK32.dll_accept
call esi
mov eax, dword [0x5ba378]
mov ecx, dword [eax + 0xdc]
push 0x208
lea edx, [esp + 0xc]
push edx
push ecx
call fcn.0044cca0
push str.eppie.exe
lea edx, [esp + 0x18]
push 0x208
push edx
call fcn.0053fd9f
add esp, 0x18
lea ecx, [esp + 8]
lea eax, [esp + 0x418]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4b0c26
test dx, dx
je 0x4b0c22
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4b0c26
add eax, 4
add ecx, 4
test dx, dx
jne 0x4b0c00
xor eax, eax
jmp 0x4b0c2b
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
sete cl
cmp dword [esp + 0x834], 0
mov esi, ecx
jne 0x4b0cb0
cmp dword [esp + 0x830], 0
je 0x4b0c8c
test esi, esi
jne 0x4b0cb0
lea edx, [esp + 8]
push edx
push str.SoftwareMicrosoftInternet_ExplorerView_Source_EditorEditor_Name
push reloc.WSOCK32.dll_bind
call fcn.00416790
lea eax, [esp + 8]
push eax
push str.SoftwareMicrosoftInternet_ExplorerView_Source_EditorEditor_Name
push reloc.WSOCK32.dll_accept
call fcn.00416790
mov eax, esi
pop esi
mov ecx, dword [esp + 0x824]
xor ecx, esp
call fcn.0053f73f
add esp, 0x828
ret
test esi, esi
je 0x4b0cb0
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.SoftwareMicrosoftInternet_ExplorerView_Source_EditorEditor_Name
push reloc.WSOCK32.dll_bind
call edi
push str.SoftwareMicrosoftInternet_ExplorerView_Source_EditorEditor_Name
push reloc.WSOCK32.dll_accept
call edi
pop edi
mov ecx, dword [esp + 0x828]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0053f73f
add esp, 0x828
ret

Function at 0x4b2c10
Capabilities:
Get file system object information

Disassembly:
mov eax, dword [esp + 4]
push 0x2000
push 0
push 0
push 0
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, eax
shr ecx, 0x10
cmp al, 0x4e
jne 0x4b2c34
cmp ah, 0x45
je 0x4b2c3d
cmp al, 0x50
jne 0x4b2c48
cmp ah, 0x45
jne 0x4b2c48
test cx, cx
je 0x4b2c48
mov eax, 1
ret
xor eax, eax
ret
Function at 0x4b63b0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x56450b
mov eax, dword fs:[0]
push eax
sub esp, 0x828
mov eax, dword [0x5b7b5c]
xor eax, esp
mov dword [esp + 0x824], eax
push edi
mov eax, dword [0x5b7b5c]
xor eax, esp
push eax
lea eax, [esp + 0x830]
mov dword fs:[0], eax
mov eax, dword [esi]
push 0
push eax
mov edi, ecx
call fcn.00403240
add esp, 8
test eax, eax
jne 0x4b65f3
test edi, edi
je 0x4b641d
cmp word [edi], ax
je 0x4b641d
push edi
lea eax, [esp + 0x10]
push 0x208
push eax
call fcn.0053fe1c
add esp, 0xc
jmp 0x4b6434
push 0
push 0x208
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [0x5ba378]
call fcn.00412560
call fcn.005089db
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4b644e
push 0x80004005
call fcn.00401340
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 8], eax
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
mov dword [esp + 0x838], 0
test ecx, ecx
jge 0x4b647c
push 0x80070057
call fcn.00401340
movzx edx, word [eax]
mov edi, 0x5c
cmp di, dx
jne 0x4b652a
cmp ecx, 1
jge 0x4b649c
push 0x80070057
call fcn.00401340
movzx eax, word [eax + 2]
mov ecx, edi
cmp cx, ax
je 0x4b65c8
mov edx, dword [esp + 0xc]
push edx
lea ecx, [esp + 0xc]
call fcn.004b50d0
mov eax, dword [esp + 0xe]
push eax
lea ecx, [esp + 0xc]
call fcn.00405c40
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x10]
call fcn.00401fb0
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4b65bc
mov ecx, dword [0x5ba378]
push eax
push 0x208
lea edx, [esp + 0x424]
push edx
call fcn.00412560
mov eax, dword [esp + 0x41c]
push eax
lea ecx, [esp + 0xc]
call fcn.004b50d0
mov ecx, dword [esp + 0x41e]
push ecx
lea ecx, [esp + 0xc]
call fcn.00405c40
jmp 0x4b65ac
cmp ecx, 1
jge 0x4b6539
push 0x80070057
call fcn.00401340
movzx eax, word [eax + 2]
cmp ax, 0x3a
je 0x4b65c8
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
call fcn.00402230
lea ecx, [esp + 8]
push ecx
call fcn.00414280
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
add esp, 4
push ecx
push eax
lea ecx, [esp + 0x10]
call fcn.00401fb0
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4b65bc
mov ecx, dword [0x5ba378]
push 1
push 0x208
lea eax, [esp + 0x424]
push eax
call fcn.00412560
lea ecx, [esp + 0x41c]
push ecx
lea ecx, [esp + 0xc]
call fcn.00402230
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x10]
call fcn.00401fb0
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.004060b0
mov eax, dword [esp + 8]
add eax, 0xfffffff0
mov dword [esp + 0x838], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b65f3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x830]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x824]
xor ecx, esp
call fcn.0053f73f
add esp, 0x834
ret
Function at 0x4b7650
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1394
call fcn.00540b00
mov eax, dword [0x5b7b5c]
xor eax, esp
mov dword [esp + 0x1390], eax
mov ecx, dword [0x5ba378]
push edi
mov edi, dword [esp + 0x139c]
call fcn.00411a80
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [edi + 0xbc], eax
mov ecx, dword [edi + 0xb8]
mov cl, byte [ecx + 1]
xor eax, eax
cmp cl, 0xf6
je 0x4b769f
add eax, 5
cmp eax, 0x32
jl 0x4b7692
mov ecx, dword [edi + 0x5d8]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea edx, [esp + 0x14]
push edx
push 1
lea eax, [esp + 0x1b]
push eax
push ecx
call ebp
mov ecx, dword [esp + 0x10]
xor ebx, ebx
cmp ecx, 1
jne 0x4b77ff
mov al, byte [esp + 0xf]
push esi
test al, al
je 0x4b77ea
xor ebx, ebx
xor esi, esi
mov byte [esp + 0x18], 0
cmp ecx, 1
jne 0x4b772c
test al, al
je 0x4b7728
cmp al, 0xd
je 0x4b7728
cmp al, 0xa
je 0x4b7728
cmp esi, 0x1000
jge 0x4b7728
mov ecx, dword [edi + 0x5d8]
push 0
lea edx, [esp + 0x18]
push edx
mov byte [esp + esi + 0x20], al
push 1
lea eax, [esp + 0x1f]
push eax
inc esi
push ecx
mov byte [esp + esi + 0x2c], 0
call ebp
cmp dword [esp + 0x14], 1
mov al, byte [esp + 0x13]
je 0x4b76e8
test esi, esi
jg 0x4b7734
cmp al, 0xd
je 0x4b7734
cmp al, 0xa
jne 0x4b7747
push 1
push esi
lea edx, [esp + 0x20]
push edx
mov ecx, edi
call fcn.004b4100
mov al, byte [esp + 0x13]
cmp al, 0xd
jne 0x4b77b9
mov edx, dword [edi + 0x5d8]
push 0
lea eax, [esp + 0x18]
push eax
push 1
lea ecx, [esp + 0x1f]
push ecx
push edx
call ebp
mov ebx, 1
cmp dword [esp + 0x14], ebx
jne 0x4b77d9
mov al, byte [esp + 0x13]
test al, al
je 0x4b77dd
cmp al, 0xd
jne 0x4b7799
mov edx, dword [edi + 0x5d8]
push 0
lea eax, [esp + 0x18]
push eax
push ebx
lea ecx, [esp + 0x1f]
push ecx
push edx
call ebp
cmp dword [esp + 0x14], ebx
jne 0x4b77d9
mov al, byte [esp + 0x13]
test al, al
je 0x4b77dd
cmp al, 0xa
jne 0x4b77dd
mov edx, dword [edi + 0x5d8]
push 0
lea eax, [esp + 0x18]
push eax
push ebx
lea ecx, [esp + 0x1f]
push ecx
push edx
call ebp
jmp 0x4b77d9
cmp al, 0xa
jne 0x4b77dd
mov edx, dword [edi + 0x5d8]
push 0
lea eax, [esp + 0x18]
push eax
push 1
lea ecx, [esp + 0x1f]
push ecx
push edx
call ebp
mov ebx, 1
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x14]
cmp ecx, 1
je 0x4b76d2
pop esi
test ebx, ebx
je 0x4b77ff
push 1
push 0
push 0x57bc10
mov ecx, edi
call fcn.004b30a0
mov ecx, edi
call fcn.004b71e0
cmp dword [edi + 0x5ac], 0
pop ebp
pop ebx
push 0
mov dword [edi + 0xbc], 0
push 0
je 0x4b7854
mov eax, dword [0x5ed0d0]
mov ecx, dword [edi + 0x5e4]
push eax
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [edi + 0x5ac], 0
xor eax, eax
pop edi
mov ecx, dword [esp + 0x1390]
xor ecx, esp
call fcn.0053f73f
add esp, 0x1394
ret
mov edx, dword [0x5ed0c4]
mov eax, dword [edi + 0x5e4]
push edx
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [esp + 0x1394]
pop edi
xor ecx, esp
xor eax, eax
call fcn.0053f73f
add esp, 0x1394
ret
Function at 0x4b8ed0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x824
mov eax, dword [0x5b7b5c]
xor eax, esp
mov dword [esp + 0x820], eax
push ebx
mov ebx, ecx
mov dword [ebx + 0xa8], 1
cmp dword [0x5c3148], 0
push esi
je 0x4b8f0c
mov ecx, dword [0x5ed0c0]
push 1
push 1
push 0
call fcn.00460220
cmp dword [0x5c3140], 0
je 0x4b8f80
lea esi, [ebx + 0x150]
mov ecx, esi
call fcn.0044b4d0
lea eax, [esp + 8]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [esp + 0x418]
push ecx
push 0
lea edx, [esp + 0x10]
push 0x57e810
push edx
call fcn.0044f000
add esp, 0x10
push 1
push 1
push 0xc0000000
lea eax, [esp + 0x424]
push eax
mov ecx, esi
call fcn.0044f040
test eax, eax
je 0x4b9074
push 1
push 2
push 0x5830cc
mov ecx, esi
call fcn.0044f330
jmp 0x4b8f9d
push 0
push 1
push ebx
mov ecx, ebx
call fcn.00504314
mov ecx, eax
call fcn.0050ea2e
mov ecx, dword [ebx + 0x20]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [0x5c313c]
cmp eax, 1
je 0x4b906b
cmp eax, 2
je 0x4b906b
cmp eax, 4
jne 0x4b8fc4
push ebx
call fcn.00435350
jmp 0x4b9071
cmp eax, 3
jne 0x4b903b
mov ecx, dword [0x5ed0c0]
push 0
call fcn.0050c645
mov esi, eax
test esi, esi
je 0x4b903b
push 0x570a0c
mov ecx, esi
call fcn.0050b51f
test eax, eax
je 0x4b903b
mov edx, dword [esi]
mov eax, dword [edx + 0x144]
mov ecx, esi
call eax
mov esi, dword [eax + 0x24]
test esi, esi
je 0x4b903b
cmp word [esi], 0
je 0x4b903b
push edi
push 0x5c
push esi
call fcn.00540922
mov edi, eax
add esp, 8
test edi, edi
je 0x4b903a
mov ecx, 0x5c3160
call fcn.00401b60
cmp esi, edi
ja 0x4b903a
movzx ecx, word [esi]
push ecx
mov ecx, 0x5c3160
call fcn.00405c40
add esi, 2
cmp esi, edi
jbe 0x4b9025
pop edi
push 0
push 0
push 0
push 0
push ebx
push 0x4b7d80
call fcn.00513233
pop esi
mov dword [ebx + 0x5d4], eax
pop ebx
mov ecx, dword [esp + 0x820]
xor ecx, esp
call fcn.0053f73f
add esp, 0x824
ret
push ebx
call fcn.004339d0
add esp, 4
mov ecx, dword [esp + 0x828]
pop esi
pop ebx
xor ecx, esp
call fcn.0053f73f
add esp, 0x824
ret
Function at 0x4c58e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x565169
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x5b7b5c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
xor edx, edx
mov dword [esp + 0xc], edx
xor edi, edi
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edx
mov dword [esp + 0x10], esi
mov word [esi + 4], di
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x30]
push edx
push eax
push esi
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x1c], 1
call fcn.004c5050
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret 0xc