joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49816a
Capabilities:
Create thread

Disassembly:
push 0x14
mov eax, 0x6c2ca4
call fcn.00401167
mov edi, ecx
xor ebx, ebx
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
xor ecx, ecx
mov dword [edi + 0x2c], eax
test eax, eax
setne cl
push ecx
call fcn.004050cb
test eax, eax
js 0x498229
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push edi
push 0x498646
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
jne 0x4981cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00435aec
mov edi, eax
jmp 0x498215
mov eax, dword [edi + 0x2c]
push ebx
push 0xffffffffffffffff
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push ebx
push eax
push 2
mov dword [ebp - 0x1c], esi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjectsEx]
test eax, eax
je 0x498209
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x498202
mov edi, dword [ebp - 0x14]
test edi, edi
js 0x498215
mov edi, 0x80004005
jmp 0x498215
mov eax, esi
mov esi, ebx
mov dword [ebp - 0x10], esi
mov dword [edi + 0x28], eax
mov edi, ebx
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x498227
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], ebx
mov eax, edi
call fcn.004026a3
ret

Function at 0x499458
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, ecx
mov dword [ebp - 8], edx
push ebx
push esi
xor esi, esi
mov dword [ebp - 0xc], eax
movzx ebx, word [eax + 4]
push edi
test ebx, ebx
je 0x4994d0
lea ecx, [ebp - 4]
push ecx
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_GetAce]
push eax
call fcn.004050cb
test eax, eax
js 0x4994d2
mov eax, dword [ebp - 4]
mov cl, byte [eax]
test cl, cl
jne 0x4994ba
cmp dword [eax + 4], 0
je 0x4994bf
push dword [ebp - 8]
lea edi, [eax + 8]
push edi
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x4994bf
push dword [ebp + 8]
push edi
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x4994bf
inc eax
jmp 0x4994d2
cmp cl, 1
jne 0x4994c9
inc esi
cmp esi, ebx
jae 0x4994d0
mov eax, dword [ebp - 0xc]
jmp 0x499473
mov eax, 0x80070538
jmp 0x4994d2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x499d16
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push 4
mov eax, 0x6c30e8
call fcn.00401167
mov edi, ecx
xor esi, esi
push esi
push esi
push 0x1004
push dword [edi + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.004366f5
mov dword [ebp - 4], esi
test ebx, ebx
jle 0x499d97
push 2
push esi
push 0x102c
push dword [edi + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 2
jne 0x499d92
push dword [edi + 0x2c]
lea eax, [ebp - 0x10]
mov ecx, edi
push esi
push eax
call fcn.00499e2b
push 9
lea ecx, [ebp - 0x10]
call fcn.00497099
push dword [edi + 0x30]
lea eax, [ebp - 0x10]
mov ecx, edi
push esi
push eax
call fcn.00499e2b
push 0x47e0e4
lea ecx, [ebp - 0x10]
call fcn.00439500
inc esi
cmp esi, ebx
jl 0x499d47
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax - 0xc]
inc ebx
lea eax, [ebx + ebx]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x499e14
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x499e0d
push dword [ebp - 0x10]
push ebx
push eax
call fcn.00437d78
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ebx, dword [edi + 0xc]
push 0xd
pop edi
jmp 0x499de1
test edi, edi
je 0x499e0d
push 0x10
dec edi
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x499dd4
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x499e07
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.0040119b
xor eax, eax
call fcn.004026a3
ret
Function at 0x49b157
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x6c3458
call fcn.00401167
mov esi, ecx
mov ecx, dword [ebp + 8]
call fcn.00437b82
xor ebx, ebx
lea eax, [ebp - 0x18]
push eax
push ebx
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], ebx
push eax
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x49b196
push eax
call fcn.00435aec
test eax, eax
jne 0x49b33b
cmp dword [ebp - 0x14], 1
je 0x49b1a2
cmp dword [ebp - 0x14], 2
jne 0x49b1a8
test byte [ebp - 0x18], 1
je 0x49b1b2
mov eax, 0x8007000d
jmp 0x49b33b
lea ecx, [ebp - 0x10]
call fcn.004366f5
mov dword [ebp - 4], ebx
mov edi, ebx
mov edx, dword [ebp - 0x18]
shr edx, 1
sub edx, 1
js 0x49b343
mov ebx, dword [ebp - 0x10]
xor ecx, ecx
inc ecx
mov eax, dword [ebx - 8]
sub ecx, dword [ebx - 4]
sub eax, edx
or eax, ecx
jge 0x49b1eb
push edx
lea ecx, [ebp - 0x10]
call fcn.004395fd
mov ebx, dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push eax
push ebx
lea eax, [ebp - 0x14]
push eax
xor eax, eax
push eax
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x49b20f
push eax
call fcn.00435aec
mov esi, eax
xor ecx, ecx
jmp 0x49b213
xor ecx, ecx
mov esi, ecx
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x49b237
test esi, esi
jne 0x49b237
cmp dword [ebp - 0x14], 1
je 0x49b2d9
cmp dword [ebp - 0x14], 2
je 0x49b2d9
mov esi, 0x8007000d
xor ebx, ebx
push edi
lea ecx, [ebp - 0x10]
call fcn.00439c15
test esi, esi
js 0x49b32a
cmp dword [ebp - 0x14], 2
jne 0x49b31c
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
jle 0x49b31c
push ebx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push eax
call ebx
xor ecx, ecx
mov edi, eax
test edi, edi
setne cl
push ecx
call fcn.004050cb
mov esi, eax
test esi, esi
js 0x49b32a
lea ecx, [ebp - 0x1c]
call fcn.004366f5
mov byte [ebp - 4], 3
lea eax, [edi - 1]
push eax
lea ecx, [ebp - 0x1c]
call fcn.004395c1
push edi
push eax
push dword [ebp - 0x10]
call ebx
xor ecx, ecx
mov edi, eax
test edi, edi
setne cl
push ecx
call fcn.004050cb
mov esi, eax
test edi, edi
je 0x49b2ba
dec edi
push edi
lea ecx, [ebp - 0x1c]
call fcn.00439c15
test esi, esi
jns 0x49b2fe
xor ecx, ecx
mov byte [ebp - 4], cl
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.0040119b
jmp 0x49b32a
test al, 1
jne 0x49b232
mov edi, eax
shr edi, 1
dec edi
cmp word [ebx + edi*2], cx
je 0x49b237
xor ebx, ebx
mov esi, 0x8007000d
mov edi, ebx
jmp 0x49b239
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
call fcn.004954ae
xor ebx, ebx
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.0040119b
jmp 0x49b328
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.004954ae
mov esi, ebx
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040119b
mov eax, esi
call fcn.004026a3
ret 4
push 0x80070057
call fcn.0048bd27
int3
Function at 0x49ba48
Capabilities:
Load windows common language runtime

Disassembly:
push 0x1ac
mov eax, 0x6c35d2
call fcn.00432a44
xor edi, edi
lea eax, [ebp - 0xd8]
push edi
push 4
push 0x49bc14
push eax
call fcn.0049c2d6
add esp, 0x10
mov dword [ebp - 0x1b0], eax
cmp eax, 0xffffffff
je 0x49bc09
push 0x47de84
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x49bc09
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x47de9c
push ebx
call esi
push 0x47dec0
push ebx
mov dword [ebp - 0x1a4], eax
call esi
push 0x49bc24
push ebx
mov dword [ebp - 0x1b4], eax
call esi
mov ecx, dword [ebp - 0x1a4]
mov dword [ebp - 0x1b8], eax
test ecx, ecx
je 0x49bc09
mov ebx, dword [ebp - 0x1b4]
test ebx, ebx
je 0x49bc09
test eax, eax
je 0x49bc09
mov esi, dword [ebp - 0x1b0]
lea edx, [ebp - 0xd8]
push esi
call fcn.0049bc32
test eax, eax
jne 0x49bc09
mov dword [ebp - 0x1ac], edi
mov dword [ebp - 4], 1
lea eax, [ebp - 0x1ac]
push eax
push 0x47e004
push 0x47dff4
push edi
push edi
push edi
call ebx
test eax, eax
js 0x49bb5f
lea eax, [ebp - 0x1b0]
push eax
push 0x64
lea eax, [ebp - 0x1a0]
push eax
call dword [ebp - 0x1b8]
test eax, eax
jne 0x49bb5f
push esi
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0x1a0]
push eax
call fcn.00433f17
test eax, eax
je 0x49bbf1
mov dword [ebp - 0x1a8], edi
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1a8]
push eax
push 0xdc
mov ecx, 0x6fe668
call fcn.0060f80b
mov esi, eax
test esi, esi
js 0x49bbdf
lea ecx, [ebp - 0x1a4]
call fcn.004366f5
mov byte [ebp - 4], 4
lea eax, [ebp - 0x1a4]
push 0x766f
push edi
push 4
push dword [ebp - 0x1a8]
push eax
call fcn.0048c9cb
add esp, 0x14
xor ecx, ecx
push dword [ebp - 0x1a4]
push 2
pop edx
call fcn.0049c158
mov esi, eax
cmp esi, 1
jne 0x49bbcd
mov esi, 0x80004004
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x1a4]
lea ecx, [ecx - 0x10]
call fcn.0040119b
mov edi, esi
mov byte [ebp - 4], 1
push dword [ebp - 0x1a8]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1ac]
test ecx, ecx
je 0x49bc05
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov eax, edi
jmp 0x49bc0b
xor eax, eax
call fcn.00402698
ret

Function at 0x49c860
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, ecx
test edx, edx
jne 0x49c873
push 0xd
pop eax
jmp 0x49c8b7
push esi
xor eax, eax
push edi
mov dword [ebp + 0xc], eax
mov esi, eax
mov edi, edx
mov ecx, edi
lea eax, [ecx + 2]
mov dword [ebp - 4], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp + 0xc]
jne 0x49c886
sub ecx, dword [ebp - 4]
sar ecx, 1
inc ecx
lea edi, [edi + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x49c87e
push esi
push edx
push 7
xor eax, eax
push eax
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x49dc00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x42c
mov eax, 0x6c3afa
call fcn.0063c0bf
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x428], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x424], eax
xor ebx, ebx
mov dword [ebp - 0x438], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x420], ebx
mov byte [ebp - 4], 1
push 0x60
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x42c], edi
test edi, edi
jne 0x49dc7d
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x42c], eax
test edi, edi
jne 0x49dc7d
call fcn.0048eb04
mov esi, eax
jmp 0x49dd7b
push dword [ebp - 0x424]
push dword [ebp - 0x428]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x49dca0
call fcn.0048eb04
jmp 0x49dd6e
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x424], eax
test eax, eax
je 0x49dc96
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x428], esi
lea ecx, [esi + 1]
cmp ecx, esi
jae 0x49dcd3
mov esi, 0x8007000e
jmp 0x49dd70
mov byte [ebp - 4], 2
push 2
pop edx
call fcn.0048db84
cmp eax, 0x400
jbe 0x49dcf4
push eax
lea ecx, [ebp - 0x420]
call fcn.0048dba3
jmp 0x49dd00
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x420], eax
mov dword [ebp - 4], 1
jmp 0x49dd24
cmp dword [ebp - 0x420], 0
je 0x49dcc9
push esi
push dword [ebp - 0x420]
push esi
push dword [ebp - 0x424]
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x49dc96
xor edx, edx
mov eax, dword [ebp - 0x420]
mov word [eax + ecx*2], dx
push dword [ebp + 0x14]
push dword [ebp - 0x420]
lea ecx, [ebp - 0x434]
call fcn.0049da49
mov esi, eax
test edi, edi
je 0x49dd7b
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], bl
lea eax, [ebp - 0x41c]
cmp dword [ebp - 0x420], eax
je 0x49dd97
lea ecx, [ebp - 0x420]
call fcn.0048dbf0
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0063c0af
ret 0x10

Function at 0x49e28a
Capabilities:
Suspend thread
Terminate process

Disassembly:
push esi
push 0
mov esi, ecx
push esi
push 0x6fe820
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x49e2e0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x70ffe0]
jne 0x49e2bb
mov byte [0x6fe812], 1
mov byte [0x6fe810], 1
cmp eax, dword [0x70ffd8]
je 0x49e2e0
push dword [0x6fe65c]
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x49e2e0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov eax, dword [esi]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret
Function at 0x4a707a
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
cmp dword [0x70f25c], 0xffffffff
push esi
mov esi, ecx
mov dword [esi], 0
jne 0x4a70ae
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
inc eax
cmp eax, dword [ebp - 0x10]
sbb eax, eax
and eax, 0xfa0
mov dword [0x70f25c], eax
mov eax, esi
pop esi
leave
ret

Function at 0x4a87b7
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x6fe1c0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x721ac0], 0
jne 0x4a8821
call fcn.004a8794
mov dword [0x721ac0], eax
xor ecx, ecx
jmp 0x4a87e4
inc ecx
shr eax, 1
cmp eax, 1
jne 0x4a87e1
lea eax, [ebp - 0x98]
mov dword [0x721ac4], ecx
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4a881a
cmp dword [ebp - 0x94], 5
mov byte [0x721aba], 1
jae 0x4a8821
mov byte [0x721aba], 0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040548e
leave
ret

Function at 0x4a8f29
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 8]
push eax
push 1
push 0
push 0x487408
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4a8f4f
xor eax, eax
leave
ret
and dword [ebp - 4], 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x4a8f98
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4a8f89
mov eax, dword [ebp - 0x10]
sub eax, 4
neg eax
sbb eax, eax
not eax
and dword [ebp - 4], eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
leave
ret

Function at 0x4a8fba
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x814
mov eax, 0x6c6734
call fcn.00432a44
lea eax, [ebp - 0x818]
xor edi, edi
push eax
push 1
push edi
push 0x487408
push SysReAllocString
mov esi, edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4a8fef
xor eax, eax
jmp 0x4a9067
lea eax, [ebp - 0x81c]
mov dword [ebp - 0x81c], 0x800
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x820]
push eax
push edi
push 0x4a9070
push dword [ebp - 0x818]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4a9059
cmp dword [ebp - 0x820], 1
jne 0x4a9059
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x814]
call fcn.0048cc22
mov dword [ebp - 4], edi
mov esi, dword [ebp - 0x814]
mov dword [ebp - 0x814], edi
or dword [ebp - 4], 0xffffffff
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [ebp - 0x818]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.00402698
ret
Function at 0x4a9626
Capabilities:
Query environment variable

Disassembly:
push 0x114
mov eax, 0x6c6801
call fcn.00432a44
mov edi, edx
mov dword [ebp - 0x120], edi
mov ebx, ecx
push 0x104
lea eax, [ebp - 0x114]
push eax
push 0x4a97d8
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor esi, esi
test eax, eax
je 0x4a9697
mov dword [ebp - 0x11c], esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x11c]
call fcn.004a9c17
mov eax, dword [ebp - 0x11c]
mov dword [edi], eax
mov edi, esi
mov dword [ebp - 0x11c], esi
or dword [ebp - 4], 0xffffffff
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x4a9750
mov dword [ebp - 0x118], esi
mov dword [ebp - 4], 1
mov dword [ebp - 0x11c], esi
mov byte [ebp - 4], 2
cmp byte [ebp + 8], 0
je 0x4a96ca
mov eax, dword [ebx]
lea ecx, [ebp - 0x118]
push ecx
push 0x4a9798
mov ecx, ebx
call dword [eax]
test eax, eax
jns 0x4a9722
mov eax, dword [ebx]
lea ecx, [ebp - 0x118]
push ecx
push 0x4a975c
mov ecx, ebx
call dword [eax]
mov edi, eax
test edi, edi
js 0x4a9732
mov eax, dword [ebx]
lea ecx, [ebp - 0x11c]
push ecx
push 0x487448
mov ecx, ebx
call dword [eax]
mov edi, eax
test edi, edi
js 0x4a9732
lea ecx, [ebp - 0x118]
call fcn.004a9105
mov edi, eax
test edi, edi
js 0x4a9732
push dword [ebp - 0x11c]
lea ecx, [ebp - 0x118]
call fcn.0048eeb1
mov edi, dword [ebp - 0x120]
mov eax, dword [ebp - 0x118]
mov dword [edi], eax
mov edi, esi
mov dword [ebp - 0x118], esi
mov byte [ebp - 4], 1
push dword [ebp - 0x11c]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call esi
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x118]
call esi
mov eax, edi
call fcn.00402698
ret 4
Function at 0x4a98ec
Capabilities:
Query environment variable

Disassembly:
push 0x114
mov eax, 0x6c68d5
call fcn.00432a44
mov edi, edx
mov dword [ebp - 0x120], edi
mov ebx, ecx
push 0x104
lea eax, [ebp - 0x114]
push eax
push 0x4a9a18
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
xor esi, esi
mov dword [ebp - 0x11c], esi
test eax, eax
je 0x4a995d
mov dword [ebp - 4], esi
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x11c]
call fcn.004a9c17
mov eax, dword [ebp - 0x11c]
mov dword [edi], eax
mov edi, esi
mov dword [ebp - 0x11c], esi
or dword [ebp - 4], 0xffffffff
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x4a9a0f
mov dword [ebp - 4], 1
mov dword [ebp - 0x118], esi
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x118]
mov eax, dword [ebx]
push ecx
mov ecx, ebx
call dword [eax + 4]
cmp dword [ebp - 0x118], 0
jne 0x4a99a1
lea edx, [ebp - 0x118]
mov ecx, ebx
call fcn.004a97f6
mov edi, eax
test edi, edi
js 0x4a99f1
cmp dword [ebp - 0x118], 0
je 0x4a99f1
lea ecx, [ebp - 0x118]
call fcn.004a9105
mov edi, eax
test edi, edi
js 0x4a99f1
mov eax, dword [ebx]
lea ecx, [ebp - 0x11c]
push ecx
push 0x487448
mov ecx, ebx
call dword [eax]
mov edi, eax
test edi, edi
js 0x4a99f1
push dword [ebp - 0x11c]
lea ecx, [ebp - 0x118]
call fcn.0048eeb1
mov ecx, dword [ebp - 0x120]
mov edi, esi
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x118], esi
mov dword [ecx], eax
mov byte [ebp - 4], 1
push dword [ebp - 0x118]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call esi
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x11c]
call esi
mov eax, edi
call fcn.00402698
ret
Function at 0x4a9a2f
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0x14
mov eax, 0x6c6944
call fcn.00401167
mov dword [ebp - 0x18], edx
xor eax, eax
mov dword [ebp - 0x20], 0x48747c
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], eax
mov esi, eax
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 2
push eax
push eax
push 3
push eax
push 1
push SysReAllocString
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
test edi, edi
je 0x4a9ae5
cmp edi, 0xffffffff
je 0x4a9ae5
mov edx, dword [ebp - 0x20]
lea ecx, [ebp - 0x20]
call dword [edx + 4]
push esi
push edi
mov dword [ebp - 0x1c], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4a9aa6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x4a9b05
movzx edi, di
or edi, 0x80070000
jmp 0x4a9b03
lea edx, [ebp - 0x10]
mov ecx, ebx
call fcn.004d28f3
mov esi, dword [ebp - 0x10]
mov edi, eax
test edi, edi
js 0x4a9b0c
push 0
lea eax, [ebp - 0x14]
push eax
push dword [esi + 8]
push dword [esi + 0xc]
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp ebx, dword [ebp - 0x14]
jne 0x4a9b07
test eax, eax
je 0x4a9a8f
mov ecx, dword [ebp - 0x18]
mov eax, esi
xor esi, esi
mov dword [ebp - 0x10], esi
mov dword [ecx], eax
jmp 0x4a9b0c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x4a9afa
movzx edi, di
or edi, 0x80070000
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x20]
call dword [eax + 4]
test edi, edi
js 0x4a9b0c
mov edi, 0x80004005
mov byte [ebp - 4], 0
test esi, esi
je 0x4a9b1a
mov eax, dword [esi]
push esi
call dword [eax + 8]
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0x48747c
je 0x4a9b38
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x1c], 0
mov eax, edi
call fcn.004026a3
ret
Function at 0x4d7178
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
push esi
mov ecx, dword [ebx + 0x68c]
call fcn.004de81d
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ecx, esi
mov edi, eax
call fcn.004dc471
test al, al
je 0x4d71ba
or dword [edi + 4], 8
mov eax, dword [ebx + 8]
mov eax, dword [eax + 0x108]
mov dword [edi + 8], eax
jmp 0x4d7336
mov edx, dword [esi + 0x3c]
and dword [edi + 4], 0xfffffff7
mov eax, dword [ebx + 8]
mov ecx, dword [edi + 0xc]
mov dword [ebp - 8], ecx
mov eax, dword [eax + 0x108]
mov dword [edi + 8], eax
test edx, edx
je 0x4d720c
and dword [esi + 0x3c], 0
mov ecx, ebx
or byte [esi + 0x9c], 0x10
push edx
call fcn.004d744d
mov ecx, eax
call fcn.004fbe6c
mov edx, dword [ebx]
mov esi, eax
push 4
push esi
mov ecx, ebx
call dword [edx + 0x58]
mov edx, dword [ebx]
mov ecx, ebx
push esi
mov esi, dword [ebp + 8]
push esi
call dword [edx + 0x78]
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x4d7236
cmp dword [ecx + 0x14], 0
jle 0x4d7236
push ecx
mov ecx, ebx
call fcn.004d74d9
mov edx, dword [ebx]
mov esi, eax
push 4
push esi
mov ecx, ebx
call dword [edx + 0x54]
mov edx, dword [ebx]
mov ecx, ebx
push esi
mov esi, dword [ebp + 8]
push esi
call dword [edx + 0x7c]
mov eax, dword [esi + 0x50]
cmp dword [eax + 0x14], 0
jle 0x4d7248
push eax
push esi
mov ecx, ebx
call fcn.004d733d
mov esi, dword [esi + 0x18]
jmp 0x4d731d
movzx eax, byte [esi]
xor ecx, ecx
mov dword [ebp - 8], ecx
sub eax, 7
je 0x4d72c1
dec eax
sub eax, 1
je 0x4d727e
dec eax
sub eax, 1
je 0x4d72a2
sub eax, 1
jne 0x4d731a
mov ecx, esi
call fcn.004db708
add eax, 0x20
jmp 0x4d72cb
mov ecx, esi
call fcn.004db6e8
mov eax, dword [eax + 0x48]
cmp dword [eax + 0x14], 0
jle 0x4d72a2
mov ecx, esi
call fcn.004db6e8
mov ecx, ebx
push dword [eax + 0x48]
push dword [ebp + 8]
call fcn.004d733d
mov ecx, esi
call fcn.004db64c
add eax, 0x3c
mov ecx, esi
mov dword [ebp - 4], eax
call fcn.004db64c
add eax, 0x40
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
jmp 0x4d72ce
mov ecx, esi
call fcn.004db6c8
add eax, 0x18
mov dword [ebp - 4], eax
test eax, eax
je 0x4d72f3
mov ecx, dword [eax]
mov eax, dword [ecx + 0x14]
shr eax, 9
test al, 1
je 0x4d72f3
push ecx
mov ecx, ebx
call fcn.004d744d
mov ecx, dword [ebp - 4]
push eax
mov dword [ecx], eax
mov ecx, edi
call fcn.004de8f5
mov eax, dword [ebp - 8]
test eax, eax
je 0x4d731a
mov ecx, dword [eax]
mov eax, dword [ecx]
shr eax, 9
test al, 1
je 0x4d731a
push ecx
mov ecx, ebx
call fcn.004d74d9
mov ecx, dword [ebp - 8]
push eax
mov dword [ecx], eax
mov ecx, edi
call fcn.004de91c
mov esi, dword [esi + 0xc]
test esi, esi
jne 0x4d7250
mov eax, dword [edi + 4]
shr eax, 3
test al, 1
jne 0x4d7336
mov dword [edi + 8], SysReAllocString
pop edi
pop esi
pop ebx
leave
ret 4