joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45a860
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4e385b
mov eax, dword fs:[0]
push eax
sub esp, 0x220
push esi
mov eax, dword [0x64a000]
xor eax, esp
push eax
lea eax, [esp + 0x228]
mov dword fs:[0], eax
lea eax, [esp + 0x20]
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 0x104
push 0x104
push eax
mov dword [esp + 0x238], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, eax
cmp esi, 0x104
jbe 0x45a8f7
cmp esi, dword [esp + 0x10]
lea eax, [esp + 8]
lea ecx, [esp + 0x10]
mov dword [esp + 8], esi
cmovge ecx, eax
push dword [ecx]
lea ecx, [esp + 0x14]
push esi
call fcn.0045a940
push esi
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, eax
push esi
push dword [esp + 0x1c]
mov esi, dword [esp + 0x240]
push esi
call fcn.00407d20
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x2c]
add esp, 0xc
cmp eax, ecx
je 0x45a921
push eax
call fcn.004c27d0
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x228]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x22c
ret
Function at 0x45ffa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e3e11
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x64a000]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 0
call fcn.0042d4e0
mov ecx, dword [esi]
lea edx, [esp + 8]
push esi
mov esi, dword [esp + 0x28]
push edx
push dword [esp + 0x30]
mov dword [esp + 0x28], 1
push eax
push dword [esp + 0x3c]
mov dword [esp + 0x1c], 0xffffffff
push esi
call fcn.0045c400
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 1
mov byte [esp + 0x1c], 0
call fcn.0042d7e0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x18
ret 0xc

Function at 0x4603c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4e3e51
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x64a000]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esp + 0xc]
mov dword [esp + 8], 0
call fcn.0042d4e0
mov ecx, dword [esi]
lea edx, [esp + 0x10]
push esi
push dword [esp + 0x30]
mov esi, dword [esp + 0x30]
push edx
push eax
push dword [esp + 0x40]
mov dword [esp + 0x34], 1
push esi
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0x80000000
call fcn.0045c400
lea ecx, [esp + 0xc]
mov dword [esp + 8], 1
mov byte [esp + 0x20], 0
call fcn.0042d7e0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret 0xc

Function at 0x461b70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e3f29
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x64a000]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov dword [esp + 0x14], 0
mov esi, dword [esp + 0x30]
mov ebx, dword [esp + 0x28]
mov ecx, ebx
push 0
mov dword [esp + 0x24], 0
lea eax, [esi + esi*2]
push eax
call fcn.004138b0
mov eax, dword [ebx]
mov dword [esp + 0x20], 0
mov dword [esp + 0x14], 1
mov edx, dword [eax + 0xc]
add edx, eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x30], edx
mov dword [esp + 0x2c], eax
lea esi, [eax + esi*2]
cmp eax, esi
je 0x461c50
push esi
lea eax, [esp + 0x30]
mov dword [esp + 0x14], esi
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.00462ab0
add esp, 0x10
test al, al
jne 0x461c4c
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x2c]
lea ecx, [ecx]
movzx eax, word [ecx]
add ecx, 2
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0x2c]
push esi
push ecx
lea ecx, [esp + 0x38]
push ecx
push eax
call fcn.00461630
mov edx, dword [esp + 0x40]
add esp, 0x10
test eax, eax
jns 0x461c3e
mov byte [edx], 0x3f
inc edx
mov dword [esp + 0x30], edx
mov ecx, dword [esp + 0x2c]
cmp ecx, edi
jb 0x461c10
cmp ecx, esi
jne 0x461be5
jmp 0x461c50
mov edx, dword [esp + 0x30]
mov ecx, dword [ebx]
sub edx, dword [ecx + 0xc]
sub edx, ecx
mov ecx, ebx
push edx
call fcn.00415c10
mov eax, ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x462350
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4e3fa9
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x64a000]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov dword [esp + 0x18], 0
mov esi, dword [esp + 0x38]
mov ebx, dword [esp + 0x30]
mov ecx, ebx
push 0
push esi
mov dword [esp + 0x30], 0
call fcn.00417710
mov eax, dword [ebx]
mov edi, dword [esp + 0x34]
add esi, edi
push esi
mov dword [esp + 0x2c], 0
mov ecx, dword [eax + 0xc]
add ecx, eax
mov dword [esp + 0x1c], 1
lea eax, [esp + 0x3c]
mov dword [esp + 0x18], ecx
push eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x40], edi
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00462a10
add esp, 0x10
test al, al
jne 0x46247a
mov ecx, dword [esp + 0x38]
cmp ecx, edi
jne 0x462407
mov eax, esi
sub eax, ecx
cmp eax, 3
jl 0x462407
cmp byte [ecx], 0xef
jne 0x462407
cmp byte [ecx + 1], 0xbb
jne 0x462407
cmp byte [ecx + 2], 0xbf
jne 0x462407
add ecx, 3
mov dword [esp + 0x38], ecx
cmp ecx, esi
jae 0x46247a
mov ebp, 0xfffd
push esi
lea eax, [esp + 0x3c]
mov dword [esp + 0x38], esi
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00462a10
add esp, 0x10
test al, al
jne 0x46247a
mov edi, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov al, byte [ecx]
inc ecx
mov byte [esp + 0x1c], al
lea eax, [esp + 0x38]
push esi
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x40], ecx
push eax
push dword [esp + 0x28]
call fcn.004614c0
add esp, 0x10
test eax, eax
mov eax, dword [esp + 0x14]
jns 0x46246c
mov word [eax], bp
add eax, 2
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x38]
cmp ecx, edi
jb 0x462438
cmp ecx, esi
jb 0x462410
jmp 0x46247e
mov eax, dword [esp + 0x14]
mov ecx, dword [ebx]
sub eax, dword [ecx + 0xc]
sub eax, ecx
mov ecx, ebx
sar eax, 1
push eax
call fcn.0041db40
mov eax, ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x4642c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e89d8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x64a000]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
lea eax, [esp + 0x10]
mov dword [esp + 0xc], 0
push eax
call fcn.0047ede0
add esp, 4
mov esi, dword [esp + 0x30]
mov ecx, eax
push esi
mov dword [esp + 0x2c], 0
call fcn.0047c610
mov ecx, dword [esp + 0x14]
or edi, 0xffffffff
mov eax, dword [ecx]
test eax, eax
je 0x464330
cmp eax, edi
je 0x46433d
mov eax, edi
lock xadd dword [ecx], eax
setne al
test al, al
jne 0x46433d
mov ecx, dword [esp + 0x14]
push 4
push 2
push ecx
call fcn.00413640
add esp, 0xc
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
test ecx, ecx
je 0x46435c
cmp ecx, 0xffffffff
je 0x464369
lock xadd dword [eax], edi
dec edi
setne al
test al, al
jne 0x464369
mov eax, dword [esp + 0x10]
push 4
push 2
push eax
call fcn.00413640
add esp, 0xc
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret

Function at 0x465a10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e42e3
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x64a000]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
push 0x50
call fcn.004c0c97
mov esi, eax
add esp, 4
mov dword [esp + 0x10], esi
mov dword [esp + 0x30], 0
test esi, esi
je 0x465a84
push 0x50501
mov ecx, esi
call fcn.00409b10
mov dword [esi], vtable.QEventLoopPrivate.0
mov dword [esi + 0x40], 0
mov byte [esi + 0x4c], 0
mov dword [esi + 0x48], 0xffffffff
mov dword [esi + 0x44], 1
jmp 0x465a86
xor esi, esi
push dword [esp + 0x38]
mov ecx, edi
mov dword [esp + 0x34], 0xffffffff
push esi
call fcn.004098a0
mov eax, dword [edi + 4]
mov dword [edi], vtable.QEventLoop.0
cmp dword [0x64c5d8], 0
mov dword [esp + 0x30], 1
jne 0x465ade
movdqa xmm0, xmmword [0x4eba40]
lea eax, [esp + 0x14]
push str.QEventLoop:_Cannot_be_used_without_QApplication
push eax
movdqu xmmword [esp + 0x1c], xmm0
mov dword [esp + 0x2c], 0x4eb49c
call fcn.00413320
add esp, 8
jmp 0x465af0
mov eax, dword [eax + 0x20]
cmp dword [eax + 0x28], 0
jne 0x465af0
push eax
call fcn.00429b80
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret 4
Function at 0x465dd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e4349
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x64a000]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, ecx
mov dword [esp + 0x14], 0
mov eax, dword [ebp]
mov ebx, dword [esp + 0x30]
mov ecx, ebx
push 0
mov dword [esp + 0x2c], 0
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 4]
mov eax, dword [eax]
mov eax, dword [eax + 4]
add eax, edx
push eax
call fcn.00417710
mov eax, dword [ebx]
mov dword [esp + 0x28], 0
mov dword [esp + 0x14], 1
mov edi, dword [eax + 0xc]
add edi, eax
mov eax, dword [ebp]
push edi
mov esi, dword [eax]
push esi
push dword [eax + 4]
call fcn.00418070
mov eax, dword [ebp + 4]
mov edx, dword [eax]
mov ecx, dword [edx + 4]
add ecx, ecx
push ecx
mov ecx, dword [edx + 0xc]
add ecx, edx
push ecx
lea ecx, [edi + esi*2]
push ecx
call fcn.004c1c30
add esp, 0x18
mov eax, ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4

Function at 0x46b560
Capabilities:
Set global application hook

Disassembly:
push 0xffffffffffffffff
push 0x4e6388
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x64a000]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, dword [ecx + 4]
cmp dword [esi + 0x50], 0
jne 0x46b668
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push fcn.0046bee0
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [esi + 0x50], eax
test eax, eax
jne 0x46b668
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea eax, [esp + 0xc]
push esi
push eax
call fcn.00410680
add esp, 8
lea ecx, [esp + 8]
mov dword [esp + 0x2c], 0
push ecx
mov ecx, eax
call fcn.0041e8d0
movdqa xmm0, xmmword [0x4eba40]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
add ecx, eax
mov dword [esp + 0x20], 0x4eb49c
push ecx
push esi
lea eax, [esp + 0x18]
push str.Qt:_INTERNAL_ERROR:_failed_to_install_GetMessage_hook:__d___s
push eax
movdqu xmmword [esp + 0x20], xmm0
call fcn.00411490
mov eax, dword [esp + 0x18]
add esp, 0x10
or esi, 0xffffffff
mov ecx, dword [eax]
test ecx, ecx
je 0x46b62f
cmp ecx, esi
je 0x46b63c
mov ecx, esi
lock xadd dword [eax], ecx
setne al
test al, al
jne 0x46b63c
mov eax, dword [esp + 8]
push 4
push 1
push eax
call fcn.00413640
add esp, 0xc
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
test ecx, ecx
je 0x46b65b
cmp ecx, 0xffffffff
je 0x46b668
lock xadd dword [eax], esi
dec esi
setne al
test al, al
jne 0x46b668
mov eax, dword [esp + 0xc]
push 4
push 2
push eax
call fcn.00413640
add esp, 0xc
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x28
ret
Function at 0x46f380
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e2859
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x64a000]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], 0
mov eax, dword [edi]
mov ebp, dword [esp + 0x34]
mov ecx, ebp
push 0
mov dword [esp + 0x30], 0
mov eax, dword [eax]
mov esi, dword [eax + 4]
mov eax, dword [edi + 4]
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x24], eax
lea eax, [edx + esi]
push eax
call fcn.00417710
mov eax, dword [ebp]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x14], 1
mov ebx, dword [eax + 0xc]
add ebx, eax
mov eax, dword [edi]
mov ecx, dword [eax]
mov eax, dword [ecx + 4]
lea edi, [eax + eax]
mov eax, dword [ecx + 0xc]
push edi
add eax, ecx
push eax
push ebx
call fcn.004c1c30
mov ecx, dword [esp + 0x24]
mov ecx, dword [ecx + 4]
mov esi, dword [ecx]
mov edx, dword [ecx + 4]
lea ecx, [edi + ebx]
push ecx
push esi
push edx
call fcn.00418070
add esp, 0x18
mov eax, ebp
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 4
Function at 0x47bd30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e61a1
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x64a000]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov dword [esp + 0x14], 0
mov esi, dword [esp + 0x28]
mov dword [esi], 0x51a640
mov eax, dword [ecx]
lea edx, [esp + 0xc]
push 0
push edx
mov dword [esp + 0x28], 0
mov dword [esp + 0x1c], 1
call dword [eax + 0x58]
mov ecx, eax
push ecx
mov eax, esp
mov dword [esp + 0x24], 1
mov dword [eax], 0
push dword [esp + 0x30]
push dword [esp + 0x38]
push ecx
lea ecx, [esp + 0x18]
call fcn.0049bd00
mov eax, dword [esp + 0xc]
mov byte [esp + 0x20], 3
mov ecx, dword [eax]
test ecx, ecx
je 0x47bdcd
cmp ecx, 0xffffffff
je 0x47bdda
or ecx, 0xffffffff
lock xadd dword [eax], ecx
setne al
test al, al
jne 0x47bdda
mov eax, dword [esp + 0xc]
push 4
push 2
push eax
call fcn.00413640
add esp, 0xc
lea ecx, [esp + 8]
call fcn.0049ce10
test al, al
je 0x47be8b
jmp 0x47bdf0
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0xc]
call fcn.0049d090
mov eax, dword [esp + 0x30]
mov ecx, dword [eax]
test ecx, ecx
je 0x47be1f
cmp ecx, 0xffffffff
je 0x47be2c
or ecx, 0xffffffff
lock xadd dword [eax], ecx
setne al
test al, al
jne 0x47be2c
mov eax, dword [esp + 0x30]
push 4
push 2
push eax
call fcn.00413640
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0xc]
call fcn.0049cd80
push eax
mov ecx, esi
mov byte [esp + 0x24], 4
call fcn.00401af0
mov eax, dword [esp + 0x10]
mov byte [esp + 0x20], 3
mov ecx, dword [eax]
test ecx, ecx
je 0x47be6d
cmp ecx, 0xffffffff
je 0x47be7a
or ecx, 0xffffffff
lock xadd dword [eax], ecx
setne al
test al, al
jne 0x47be7a
mov eax, dword [esp + 0x10]
push 4
push 2
push eax
call fcn.00413640
add esp, 0xc
lea ecx, [esp + 8]
call fcn.0049ce10
test al, al
jne 0x47bdf0
lea ecx, [esp + 8]
mov byte [esp + 0x20], 0
call fcn.0049c470
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret 0xc

Function at 0x47d190
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e62f8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x64a000]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], 8
mov dword [esi + 8], 0x4ed20c
lea ecx, [esi + 0x10]
mov dword [esp + 0x14], 0
mov dword [esi], vtable.QFSFileEnginePrivate.0
call fcn.0047c4c0
mov dword [esi + 0x20], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0xffffffff
mov dword [esi + 0x34], 0xffffffff
mov dword [esi + 0x64], 0x55f18c
mov eax, dword [esi + 0x7c]
and eax, 0xffffffd4
mov dword [esi + 0x20], 0
or eax, 0x10
mov dword [esi + 0x70], 0xffffffff
mov dword [esi + 0x7c], eax
mov eax, esi
mov dword [esi + 0x58], 0
mov dword [esi + 0x74], 0
mov word [esi + 0x78], 0
mov dword [esi + 0x6c], 0xffffffff
mov dword [esi + 0x5c], 0xffffffff
mov dword [esi + 0x60], 0
mov dword [esi + 0x68], 0xffffffff
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x47da40
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4e63c0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x64a000]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x18], ebx
mov eax, dword [esp + 0x40]
mov esi, dword [ebx + 0xc]
mov dword [esp + 0x1c], esi
test eax, eax
jl 0x47dc0f
mov ebp, dword [esp + 0x3c]
jg 0x47da8e
test ebp, ebp
jb 0x47dc0f
cmp ebp, ebp
jne 0x47dc0f
test eax, eax
jne 0x47dc0f
xorps xmm0, xmm0
movlpd qword [esp + 0x20], xmm0
cmp dword [ebx + 0x58], eax
je 0x47db6e
mov edi, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
mov byte [esp + 0x16], 1
lea ecx, [ecx]
push dword [ebx + 0x58]
mov eax, ebp
sub eax, esi
push eax
mov eax, dword [esp + 0x40]
add eax, esi
push 1
push eax
call fcn.004c62b7
mov ebx, eax
mov eax, dword [esp + 0x28]
push dword [eax + 0x58]
call fcn.004c5f8d
add esp, 0x14
test eax, eax
setne al
cmp byte [esp + 0x16], 0
mov byte [esp + 0x17], al
je 0x47db2a
test al, al
je 0x47db2a
test ebx, ebx
jne 0x47db2a
mov eax, dword [esp + 0x18]
push ebx
push dword [eax + 0x58]
call fcn.004c507d
add esp, 4
push edx
push eax
mov eax, dword [esp + 0x24]
push dword [eax + 0x58]
call fcn.004c6363
mov al, byte [esp + 0x27]
add esp, 0x10
mov byte [esp + 0x16], bl
jmp 0x47db2f
add esi, ebx
adc edi, 0
test al, al
jne 0x47dc09
test ebx, ebx
jne 0x47db59
call fcn.004c3658
xor ecx, ecx
cmp dword [eax], 4
sete cl
test ecx, ecx
je 0x47dbcd
mov ebx, dword [esp + 0x18]
jmp 0x47dac0
cmp edi, dword [esp + 0x40]
jg 0x47dbcd
jl 0x47db65
cmp esi, ebp
jae 0x47dbcd
mov ebx, dword [esp + 0x18]
jmp 0x47dac0
cmp dword [ebx + 0x70], 0xffffffff
je 0x47dbd3
mov edi, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
lea esp, [esp]
mov ecx, ebp
mov edx, 0x7fffffff
sub ecx, esi
sbb eax, edi
test eax, eax
ja 0x47db97
jb 0x47db95
cmp ecx, edx
jae 0x47db97
mov edx, ecx
mov eax, dword [esp + 0x38]
push edx
add eax, esi
push eax
push dword [ebx + 0x70]
call fcn.004c67ea
mov ecx, eax
add esp, 0xc
test ecx, ecx
jle 0x47dbc3
cdq
add esi, eax
mov eax, dword [esp + 0x40]
adc edi, edx
cmp edi, eax
jl 0x47db80
jg 0x47dbc3
cmp esi, ebp
jb 0x47db80
cmp ecx, 0xffffffff
setne al
test al, al
jne 0x47dc09
mov eax, esi
or eax, edi
jne 0x47dc09
or esi, 0xffffffff
or edi, esi
call fcn.004c3658
push dword [eax]
lea eax, [esp + 0x40]
push eax
call fcn.00410680
add esp, 8
mov ecx, dword [esp + 0x1c]
push eax
push 1
mov dword [esp + 0x38], 1
call fcn.0047c300
lea ecx, [esp + 0x3c]
call fcn.00467a00
mov eax, esi
mov edx, edi
jmp 0x47dc63
lea eax, [esp + 0x38]
push 0x16
push eax
call fcn.00410680
add esp, 8
push eax
push 1
mov ecx, esi
mov dword [esp + 0x38], 0
call fcn.0047c300
mov eax, dword [esp + 0x38]
mov ecx, dword [eax]
test ecx, ecx
je 0x47dc51
cmp ecx, 0xffffffff
je 0x47dc5e
or ecx, 0xffffffff
lock xadd dword [eax], ecx
setne al
test al, al
jne 0x47dc5e
mov eax, dword [esp + 0x38]
push 4
push 2
push eax
call fcn.00413640
add esp, 0xc
or eax, 0xffffffff
or edx, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0xc
Function at 0x47e210
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4e6460
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x64a000]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov dword [esp + 0x14], ecx
mov ebp, dword [esp + 0x34]
mov ebx, dword [ecx + 0xc]
mov dword [esp + 0x18], ebx
test ebp, ebp
jl 0x47e380
mov esi, dword [esp + 0x30]
jg 0x47e25c
test esi, esi
jb 0x47e380
cmp esi, esi
jne 0x47e380
test ebp, ebp
jne 0x47e380
xorps xmm0, xmm0
movlpd qword [esp + 0x30], xmm0
mov ebx, dword [esp + 0x34]
mov edi, dword [esp + 0x30]
cmp dword [ecx + 0x58], ebp
je 0x47e2cb
push dword [ecx + 0x58]
mov eax, esi
sub eax, edi
push eax
mov eax, dword [esp + 0x34]
add eax, edi
push 1
push eax
call fcn.004c65f3
add esp, 0x10
add edi, eax
adc ebx, 0
test eax, eax
jne 0x47e2bb
call fcn.004c3658
xor ecx, ecx
cmp dword [eax], 4
sete cl
test ecx, ecx
mov ecx, dword [esp + 0x14]
je 0x47e318
jmp 0x47e282
cmp ebx, ebp
jg 0x47e314
jl 0x47e2c5
cmp edi, esi
jae 0x47e314
mov ecx, dword [esp + 0x14]
jmp 0x47e282
cmp dword [ecx + 0x70], 0xffffffff
je 0x47e318
mov ecx, esi
mov eax, ebp
sub ecx, edi
mov edx, 0x7fffffff
sbb eax, ebx
test eax, eax
ja 0x47e2ea
jb 0x47e2e8
cmp ecx, edx
jae 0x47e2ea
mov edx, ecx
mov eax, dword [esp + 0x2c]
push edx
add eax, edi
push eax
mov eax, dword [esp + 0x1c]
push dword [eax + 0x70]
call fcn.004c708f
add esp, 0xc
test eax, eax
jle 0x47e314
cdq
add edi, eax
adc ebx, edx
cmp ebx, ebp
jl 0x47e2d1
jg 0x47e314
cmp edi, esi
jb 0x47e2d1
mov ecx, dword [esp + 0x14]
or esi, ebp
je 0x47e373
mov eax, edi
or eax, ebx
jne 0x47e373
or edi, 0xffffffff
or ebx, edi
call fcn.004c3658
push dword [eax]
lea eax, [esp + 0x30]
push eax
call fcn.00410680
add esp, 8
mov esi, eax
mov dword [esp + 0x24], 1
call fcn.004c3658
mov ecx, dword [esp + 0x18]
xor edx, edx
push esi
cmp dword [eax], 0x1c
sete dl
lea edx, [edx*2 + 2]
push edx
call fcn.0047c300
lea ecx, [esp + 0x2c]
call fcn.00467a00
mov eax, edi
mov edx, ebx
jmp 0x47e3d4
and dword [ecx + 0x28], 0xffdfffff
mov eax, edi
mov edx, ebx
jmp 0x47e3d4
lea eax, [esp + 0x2c]
push 0x16
push eax
call fcn.00410680
add esp, 8
push eax
push 2
mov ecx, ebx
mov dword [esp + 0x2c], 0
call fcn.0047c300
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
test ecx, ecx
je 0x47e3c2
cmp ecx, 0xffffffff
je 0x47e3cf
or ecx, 0xffffffff
lock xadd dword [eax], ecx
setne al
test al, al
jne 0x47e3cf
mov eax, dword [esp + 0x2c]
push 4
push 2
push eax
call fcn.00413640
add esp, 0xc
or eax, 0xffffffff
or edx, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc
Function at 0x47e960
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x4e0690
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x64a000]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x14]
push eax
call fcn.0047cc70
mov edi, eax
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x24], 0
call fcn.0047cc70
mov esi, eax
push 1
mov ecx, edi
mov byte [esp + 0x24], 1
call fcn.0041de40
push eax
mov ecx, esi
call fcn.0041de40
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
mov eax, dword [esp + 0x10]
setne bl
or esi, 0xffffffff
mov ecx, dword [eax]
test ecx, ecx
je 0x47e9f2
cmp ecx, esi
je 0x47e9ff
mov ecx, esi
lock xadd dword [eax], ecx
setne al
test al, al
jne 0x47e9ff
mov eax, dword [esp + 0x10]
push 4
push 2
push eax
call fcn.00413640
add esp, 0xc
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
test ecx, ecx
je 0x47ea1e
cmp ecx, 0xffffffff
je 0x47ea2b
lock xadd dword [eax], esi
dec esi
setne al
test al, al
jne 0x47ea2b
mov eax, dword [esp + 0x14]
push 4
push 2
push eax
call fcn.00413640
add esp, 0xc
test bl, bl
jne 0x47ea42
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x30]
mov dword [ecx], eax
mov dword [ecx + 4], 2
mov al, bl
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret