joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bd930
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x601a88
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x711ab8]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
push edi
mov eax, dword [0x711ab8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [esp + 0x40]
xor ecx, ecx
mov word [esp + 0x14], cx
mov ecx, eax
mov ebx, edx
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x4bd985
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [esp + 0x14]
call fcn.0040d7f0
mov dword [esp + 0x38], 0
push 1
mov eax, 0x6ca140
mov ecx, esi
call fcn.0040d660
mov ecx, eax
mov eax, ebx
lea esi, [eax + 2]
jmp 0x4bd9c0
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x4bd9c0
sub eax, esi
sar eax, 1
push eax
mov eax, ebx
call fcn.0040d660
cmp dword [esp + 0x28], 8
mov ecx, dword [esp + 0x14]
jae 0x4bd9e6
lea ecx, [esp + 0x14]
test edi, edi
je 0x4bda05
mov eax, edi
lea esi, [eax + 2]
nop
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x4bd9f0
sub eax, esi
sar eax, 1
lea eax, [eax + eax + 2]
jmp 0x4bda07
xor eax, eax
push 1
push eax
xor eax, eax
call fcn.00435d00
add esp, 8
test eax, eax
sete bl
mov dword [esp + 0x38], 0xffffffff
cmp dword [esp + 0x28], 8
jb 0x4bda35
mov edx, dword [esp + 0x14]
push edx
call fcn.005c396f
add esp, 4
xor eax, eax
mov word [esp + 0x14], ax
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov al, bl
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.005c397a
add esp, 0x2c
ret
Function at 0x4c07a0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5f79f9
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x711ab8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
mov ebp, dword [esp + 0x3c]
mov ebx, dword [esp + 0x38]
xor eax, eax
mov dword [esp + 0x30], eax
mov esi, ebx
mov dword [esp + 0x18], eax
call fcn.00443850
mov dword [esp + 0x30], 0
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
push 0
lea edx, [esp + 0x24]
push edx
push eax
push ebp
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x4c085d
mov esi, dword [ebx]
call fcn.004c24f0
mov eax, dword [ebx]
push 0
lea ecx, [esp + 0x44]
push ecx
mov dword [esp + 0x48], edi
mov eax, dword [eax]
push edi
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4c083f
cmp dword [esp + 0x40], edi
je 0x4c085d
mov esi, dword [ebx]
cmp dword [esi + 4], 0
je 0x4c085d
mov eax, dword [esi]
push 0
push eax
call fcn.005c6a69
add esp, 8
mov dword [esi], eax
mov dword [esi + 4], 0
mov eax, ebx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret

Function at 0x4c0880
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
xor esi, esi
xor ebp, ebp
push edi
test ebx, ebx
jb 0x4c08f6
ja 0x4c0899
cmp esi, dword [esp + 0x20]
jae 0x4c08fa
mov ecx, dword [esp + 0x20]
sub ecx, esi
mov eax, ebx
sbb eax, ebp
test eax, eax
ja 0x4c08b5
jb 0x4c08b1
cmp ecx, 0x10000
jae 0x4c08b5
mov edi, ecx
jmp 0x4c08ba
mov edi, 0x10000
mov ecx, dword [esp + 0x1c]
push 0
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x20]
push edi
lea edx, [esi + ecx]
push edx
push eax
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4c08f6
mov eax, dword [esp + 0x10]
cmp eax, edi
jne 0x4c08f6
add esi, eax
adc ebp, 0
cmp ebp, ebx
jb 0x4c0899
ja 0x4c08f6
cmp esi, dword [esp + 0x20]
jb 0x4c0899
cmp esi, dword [esp + 0x20]
jne 0x4c0917
cmp ebp, ebx
jne 0x4c0917
or esi, ebp
je 0x4c090f
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret
Function at 0x4c0920
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x5f9428
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x711ab8]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
push 0
push 0
push 2
push 0
push 1
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x18], 0
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xffffffff
je 0x4c09c5
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push eax
push ecx
push edx
push esi
call fcn.004c0880
add esp, 0x10
test al, al
je 0x4c09ad
mov dword [esp + 0x18], 0xffffffff
push esi
call ebx
mov al, 1
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
cmp byte [esp + 0x2c], 0
je 0x4c09c5
push esi
call ebx
or esi, 0xffffffff
push edi
mov dword [esp + 0x10], esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [esp + 0x18], 0xffffffff
cmp esi, 0xffffffff
je 0x4c09d5
push esi
call ebx
xor al, al
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x4c0a60
Capabilities:
Get file size

Disassembly:
sub esp, 0xc
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
lea eax, [esp]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x4c0a86
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0xc
ret
or eax, 0xffffffff
or edx, 0xffffffff
add esp, 0xc
ret

Function at 0x4c0dc0
Capabilities:
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x5f9401
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x711ab8]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov ebx, ecx
mov ebp, dword [esp + 0x34]
xor edi, edi
mov dword [esp + 0x2c], edi
mov esi, ebp
mov dword [esp + 0x1c], edi
call fcn.00443850
mov dword [esp + 0x2c], edi
lea eax, [esp + 0x14]
push eax
xor esi, esi
mov edi, 1
push ebx
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x4c0e95
mov ecx, dword [esp + 0x14]
mov edx, ecx
and edx, dword [esp + 0x18]
cmp edx, 0xffffffff
je 0x4c0e95
push esi
push esi
lea eax, [esp + 0x1c]
push ebx
push eax
call fcn.004c07a0
add esp, 0x10
mov ebx, eax
mov dword [esp + 0x2c], edi
mov esi, dword [ebp]
add dword [esi + 8], 0xffffffff
jne 0x4c0e5f
xor edi, edi
call fcn.004c24f0
mov edi, 1
mov eax, dword [ebx]
add dword [eax + 8], edi
mov dword [ebp], eax
mov byte [esp + 0x2c], 0
mov eax, dword [esp + 0x14]
dec dword [eax + 8]
mov esi, eax
add eax, 8
cmp dword [eax], 0
jne 0x4c0e95
xor edi, edi
call fcn.004c24f0
mov ecx, dword [esp + 0x14]
push ecx
call fcn.005c396f
add esp, 4
mov dword [esp + 0x14], edi
mov eax, ebp
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x4c25a0
Capabilities:
Get token privileges

Disassembly:
push 0xffffffffffffffff
push 0x5f9380
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x711ab8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
xor esi, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x24], esi
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x4c25e3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x10], esi
lea eax, [esp + 0x10]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4c2687
mov edi, 0x1000
lea ebx, [esp + 0x18]
call fcn.004438c0
mov byte [esp + 0x24], 1
mov esi, dword [esp + 0x18]
mov edi, dword [esi]
mov ecx, dword [esi + 4]
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x18], ecx
mov eax, dword [esi + 4]
push eax
mov eax, dword [esp + 0x18]
push edi
push 3
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x4c2668
xor eax, eax
cmp dword [edi], eax
jbe 0x4c2651
lea ecx, [edi + 0xc]
mov dword [ecx], 2
inc eax
add ecx, 0xc
cmp eax, dword [edi]
jb 0x4c2643
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push 0
push 0
push ecx
push edi
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov byte [esp + 0x24], 0
add dword [esi + 8], 0xffffffff
jne 0x4c2687
xor edi, edi
call fcn.004c24f0
push esi
call fcn.005c396f
add esp, 4
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4c269e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret

Function at 0x4c26c0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x5feba1
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x711ab8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
xor esi, esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], esi
mov eax, dword [esp + 0x2c]
push eax
call fcn.0040b8d0
mov dword [esp + 0x24], esi
mov ebp, 1
mov edi, 0x400
lea ebx, [esp + 0x14]
mov dword [esp + 0x18], ebp
call fcn.004c2450
mov dword [esp + 0x24], ebp
mov ecx, dword [esp + 0x30]
mov esi, dword [esp + 0x14]
mov eax, dword [esi]
push ebp
push ecx
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4c276f
mov edx, dword [esi]
test edx, edx
jne 0x4c274b
mov ebp, dword [esp + 0x2c]
xor eax, eax
mov ebx, eax
push edx
mov eax, ebp
call fcn.0040fac0
jmp 0x4c2773
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4c2750
mov ebp, dword [esp + 0x2c]
sub eax, edi
sar eax, 1
mov ebx, eax
push edx
mov eax, ebp
call fcn.0040fac0
jmp 0x4c2773
mov ebp, dword [esp + 0x2c]
xor ebx, ebx
mov byte [esp + 0x24], bl
add dword [esi + 8], 0xffffffff
jne 0x4c2793
xor edi, edi
call fcn.004c2540
push esi
call fcn.005c396f
add esp, 4
mov dword [esp + 0x14], ebx
mov eax, ebp
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x4c27b0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x5feb61
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x711ab8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x18], ebx
mov edi, dword [esp + 0x2c]
push edi
call fcn.0040b8d0
mov dword [esp + 0x24], ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetTempPathW]
push ebx
mov esi, 1
push ebx
mov dword [esp + 0x20], esi
call ebp
cmp eax, ebx
je 0x4c2862
lea edi, [eax + 1]
lea ebx, [esp + 0x14]
call fcn.004c2450
mov dword [esp + 0x24], esi
mov esi, dword [esp + 0x14]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
push eax
push ecx
call ebp
test eax, eax
jbe 0x4c283f
cmp eax, dword [esi + 4]
jae 0x4c283f
mov ecx, dword [esi]
mov edi, dword [esp + 0x2c]
xor edx, edx
mov word [ecx + eax*2], dx
mov edx, dword [esi]
call fcn.0040bab0
mov byte [esp + 0x24], 0
add dword [esi + 8], 0xffffffff
jne 0x4c285e
xor edi, edi
call fcn.004c2540
push esi
call fcn.005c396f
add esp, 4
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x2c]
mov edx, dword [edi]
mov eax, dword [edx - 0xc]
test eax, eax
je 0x4c2888
lea ecx, [eax - 1]
test ecx, ecx
jl 0x4c289e
cmp ecx, eax
jg 0x4c289e
movzx ecx, word [edx + ecx*2]
cmp cx, 0x5c
jne 0x4c2888
lea esi, [eax - 1]
call fcn.00426960
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
push 0x80070057
call fcn.00403d10
int3

Function at 0x4c2a90
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x601362
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x711ab8]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x28]
lea eax, [esp + 0x28]
push eax
mov ecx, 0x6ca128
mov dword [esp + 0x18], 0
call fcn.0040b990
mov ebx, 1
mov dword [esp + 0x20], ebx
lea edi, [ebp + 0x25c]
lea eax, [esp + 0x28]
call fcn.0040ddb0
mov byte [esp + 0x20], 0
lea ecx, [esp + 0x28]
call fcn.0040ba40
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp byte [ebp + 8], 0
jne 0x4c2b32
mov eax, dword [ebp]
lea ecx, [ebp + 0xc]
push ecx
push eax
mov byte [ebp + 8], bl
call edi
mov esi, eax
mov eax, dword [ebp + 0x260]
cmp esi, eax
je 0x4c2b27
cmp eax, 0xffffffff
je 0x4c2b27
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp + 0x260], esi
cmp esi, 0xffffffff
jmp 0x4c2b4a
mov eax, dword [ebp + 0x260]
cmp eax, 0xffffffff
je 0x4c2b66
lea edx, [ebp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4c2b66
lea esi, [ebp + 0x38]
call fcn.004ccde0
test al, al
jne 0x4c2afc
lea eax, [ebp + 4]
lea edi, [ebp + 0x25c]
call fcn.0040ddb0
mov esi, dword [esp + 0x2c]
add ebp, 0xc
push ebp
push esi
call fcn.004c2ba0
mov dword [esp + 0x20], 0
mov dword [esp + 0x14], ebx
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
Function at 0x4c2c10
Capabilities:
Compare security identifiers

Disassembly:
push 0xffffffffffffffff
push 0x5f9348
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x711ab8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
xor esi, esi
cmp dword [ebx], esi
je 0x4c2cd8
mov dword [esp + 0xc], esi
mov dword [esp + 0x1c], esi
mov eax, dword [esp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esp + 0x10], esi
cmp eax, esi
je 0x4c2c60
push eax
call edi
mov dword [esp + 0xc], esi
mov edx, dword [esp + 0x24]
lea eax, [esp + 0xc]
push eax
push esi
push esi
push esi
lea ecx, [esp + 0x20]
push ecx
push 1
push 1
push edx
call dword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
test eax, eax
jne 0x4c2cc5
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x4c2cc5
cmp dword [esp + 0xc], esi
je 0x4c2cc5
mov ecx, dword [ebx]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x4c2cc5
mov dword [esp + 0x1c], 0xffffffff
mov eax, dword [esp + 0xc]
cmp eax, esi
je 0x4c2caf
push eax
call edi
mov al, 1
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 4
mov dword [esp + 0x1c], 0xffffffff
mov eax, dword [esp + 0xc]
cmp eax, esi
je 0x4c2cd8
push eax
call edi
xor al, al
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 4

Function at 0x4c2ea0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebx
xor ebx, ebx
push ebp
push edi
cmp dword [esi + 0x34], ebx
ja 0x4c2eb4
cmp dword [esi + 0x30], 0x40
jbe 0x4c2fb8
mov edi, dword [esi + 0x28]
mov ebp, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 0x40
push edi
call ebp
test eax, eax
jne 0x4c2fbd
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x4c2fbd
mov byte [esi + 0x38], 1
mov eax, dword [edi + 0x3c]
mov edi, dword [esi + 0x34]
xor ecx, ecx
lea edx, [eax + 0xf8]
cmp edi, ecx
jb 0x4c2fb8
ja 0x4c2eff
mov ecx, dword [esi + 0x30]
cmp ecx, edx
jbe 0x4c2fb8
mov edx, dword [esi + 0x28]
add eax, edx
push 0xf8
push eax
mov dword [esi + 0x24], eax
call ebp
test eax, eax
jne 0x4c2fbd
mov eax, dword [esi + 0x24]
cmp dword [eax], 0x4550
jne 0x4c2fbd
mov ecx, 0x2000
test word [eax + 0x16], cx
jne 0x4c2f35
mov byte [esi + 0x44], 1
mov edx, eax
movzx eax, word [edx + 0x18]
mov ecx, 0x10b
cmp ax, cx
jne 0x4c2f51
mov dword [esi + 0x40], 1
add edx, 0x78
jmp 0x4c2f68
mov ecx, 0x20b
cmp ax, cx
jne 0x4c2f6b
mov dword [esi + 0x40], 2
add edx, 0x88
mov dword [esi + 0x20], edx
cmp dword [esi + 0x20], ebx
je 0x4c2fbd
mov eax, dword [esi + 0x24]
movzx ecx, word [eax + 6]
mov dword [esi + 0x3c], ecx
test ecx, ecx
je 0x4c2fbd
movzx edx, word [eax + 0x14]
mov ebx, dword [esi + 0x34]
lea ecx, [ecx + ecx*4]
add ecx, ecx
add ecx, ecx
add ecx, ecx
sub ecx, dword [esi + 0x28]
add ecx, edx
lea edi, [ecx + eax + 0x18]
xor ecx, ecx
cmp ebx, ecx
jb 0x4c2fb8
ja 0x4c2fa6
mov ecx, dword [esi + 0x30]
cmp ecx, edi
jbe 0x4c2fb8
pop edi
mov ebx, 1
lea edx, [edx + eax + 0x18]
pop ebp
mov eax, ebx
mov dword [esi + 0x1c], edx
pop ebx
ret
mov ebx, 2
pop edi
pop ebp
mov eax, ebx
pop ebx
ret
Function at 0x4c3190
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [ecx + 0x24]
push ebx
mov ebx, dword [eax + 0x28]
mov ecx, eax
movzx eax, word [eax + 0x14]
push esi
lea esi, [eax + ecx + 0x18]
movzx ecx, word [ecx + 6]
xor eax, eax
push edi
test ecx, ecx
jbe 0x4c31c8
lea ecx, [ecx]
mov edx, dword [esi + 0xc]
cmp ebx, edx
jb 0x4c31c0
mov edi, dword [esi + 8]
add edi, edx
cmp ebx, edi
jb 0x4c31d0
inc eax
add esi, 0x28
cmp eax, ecx
jb 0x4c31b0
pop edi
pop esi
xor eax, eax
pop ebx
ret 0x10
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
mov eax, esi
lea edx, [eax + 1]
jmp 0x4c31e0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4c31e0
sub eax, edx
mov edi, eax
mov eax, dword [esp + 0x14]
push esi
call fcn.0040f900
mov eax, dword [esp + 0x18]
mov edx, ebx
sub edx, dword [esi + 0xc]
pop edi
mov dword [eax], edx
mov ecx, dword [esi + 8]
mov edx, dword [esp + 0x18]
sub ecx, ebx
add ecx, dword [esi + 0xc]
mov dword [edx], ecx
mov eax, dword [esi + 0x14]
sub eax, dword [esi + 0xc]
pop esi
add eax, ebx
pop ebx
ret 0x10

Function at 0x4c3220
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [eax + 0x24]
movzx edx, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
lea eax, [edx + ecx + 0x18]
xor edx, edx
test esi, esi
jbe 0x4c324f
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x4c3247
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x4c3251
inc edx
add eax, 0x28
cmp edx, esi
jb 0x4c3237
xor eax, eax
pop esi
pop ebx
ret

Function at 0x4c3260
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [eax + 0x24]
movzx ecx, word [eax + 0x14]
push ebx
push esi
movzx esi, word [eax + 6]
xor edx, edx
lea ecx, [ecx + eax + 0x18]
test esi, esi
jbe 0x4c328f
mov eax, dword [ecx + 0xc]
cmp edi, eax
jb 0x4c3287
mov ebx, dword [ecx + 8]
add ebx, eax
cmp edi, ebx
jb 0x4c3294
inc edx
add ecx, 0x28
cmp edx, esi
jb 0x4c3277
pop esi
xor eax, eax
pop ebx
ret
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
pop esi
add eax, edi
pop ebx
ret

Function at 0x4c32a0
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [ebx + 0x24]
movzx ecx, word [eax + 0x14]
push ebp
push esi
movzx esi, word [eax + 6]
xor edx, edx
lea ecx, [ecx + eax + 0x18]
test esi, esi
jbe 0x4c32cf
mov eax, dword [ecx + 0xc]
cmp edi, eax
jb 0x4c32c7
mov ebp, dword [ecx + 8]
add ebp, eax
cmp edi, ebp
jb 0x4c32d4
inc edx
add ecx, 0x28
cmp edx, esi
jb 0x4c32b7
pop esi
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
pop esi
add eax, dword [ebx + 0x28]
pop ebp
add eax, edi
ret
Function at 0x4c3690
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x60b2c8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x711ab8]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x3c]
mov edi, dword [esp + 0x30]
mov ebx, dword [esp + 0x2c]
mov dword [esp + 0x14], 0
cmp ecx, 0x64
ja 0x4c37bc
mov eax, dword [edx]
cmp eax, 0x4e20
jg 0x4c37bc
inc eax
mov dword [edx], eax
mov eax, dword [ebx + 4]
test eax, eax
jns 0x4c3710
push edx
mov edx, dword [esp + 0x3c]
push ebp
push edx
mov edx, dword [esp + 0x40]
push edx
mov edx, dword [ebx]
push edx
push ecx
mov ecx, dword [esp + 0x40]
and eax, 0x7fffffff
push edi
add eax, edi
push eax
call fcn.004c37e0
jmp 0x4c37be
mov esi, dword [ebx]
push ecx
lea eax, [esp + 0x40]
push eax
call fcn.004c35c0
add esp, 8
mov dword [esp + 0x20], 0
mov esi, dword [ebx + 4]
add esi, edi
je 0x4c37ab
mov edi, dword [esi]
mov ebx, dword [esp + 0x28]
call fcn.004c32a0
lea ecx, [esp + 0x34]
push 0x6d2dd4
push ecx
mov ecx, dword [esp + 0x3c]
mov edi, eax
call fcn.00424670
mov byte [esp + 0x28], 1
lea edx, [esp + 0x44]
push edx
lea ecx, [esp + 0x34]
push ecx
mov ecx, eax
call fcn.004245c0
add esp, 0x10
mov byte [esp + 0x20], 2
mov edx, dword [esi + 4]
push ebp
push edx
push edi
push eax
call dword [esp + 0x48]
mov bl, al
mov byte [esp + 0x20], 1
lea ecx, [esp + 0x28]
call fcn.0040b810
mov byte [esp + 0x20], 0
lea ecx, [esp + 0x34]
call fcn.0040b810
mov dword [esp + 0x20], 0xffffffff
lea ecx, [esp + 0x3c]
call fcn.0040b810
mov al, bl
jmp 0x4c37be
mov dword [esp + 0x20], 0xffffffff
lea ecx, [esp + 0x3c]
call fcn.0040b810
mov al, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x18
Function at 0x4c4bf0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x5f79b9
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x711ab8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, dword [esp + 0x30]
xor ebx, ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x14], ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esp + 0x28], ebx
movzx eax, word [esp + 0x34]
push 0x6d21bc
push eax
push ebx
mov dword [esp + 0x20], 1
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, ebx
je 0x4c4cad
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebp, eax
cmp ebp, ebx
je 0x4c4cad
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
mov dword [esp + 0x34], edi
mov dword [esp + 0x28], 1
cmp edi, ebx
je 0x4c4c9e
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, ebp
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov byte [esp + 0x28], 2
mov dword [esi], eax
mov dword [esi + 4], ecx
mov byte [esp + 0x28], 1
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x28], bl
cmp edi, ebx
je 0x4c4cad
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret

Function at 0x4c4cd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x5f9319
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x711ab8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x14], ebp
call fcn.00443850
mov dword [esp + 0x24], ebp
movzx eax, word [esp + 0x30]
push 0x6d21bc
push eax
mov ebx, 1
push ebp
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, ebp
je 0x4c4d9a
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebp, eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x24], ebx
test ebp, ebp
je 0x4c4d8a
push ebp
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x4c4d8a
push edi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x4c4d8a
lea ecx, [esp + 0x30]
push ebx
push ecx
mov edi, eax
call fcn.004c4dc0
add esp, 8
mov byte [esp + 0x24], 2
push eax
mov ebx, esi
call fcn.004530c0
mov byte [esp + 0x24], 1
lea ebx, [esp + 0x30]
call fcn.004c2420
mov byte [esp + 0x24], 0
test ebp, ebp
je 0x4c4d9a
push ebp
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret