joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a69b0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53b99b
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x58a088]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi], 0
je 0x4a69e9
call fcn.004a6b50
cmp byte [0x58e8dc], 0
jne 0x4a69fc
mov eax, 0x80000001
jmp 0x4a6b2c
mov eax, dword [esi]
test eax, eax
jne 0x4a6a7c
push 8
call fcn.004e2005
mov edi, eax
add esp, 4
mov dword [ebp - 0x138], edi
mov dword [ebp - 4], 0
push 1
call fcn.004e2005
add esp, 4
mov dword [edi + 4], eax
mov byte [eax], 0
lea eax, [ebp - 0x130]
push 0x118
push 0
push eax
call fcn.004e48c0
add esp, 0xc
mov dword [ebp - 0x134], 0x11c
lea eax, [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4a6a6b
cmp dword [ebp - 0x130], 6
mov eax, dword [edi + 4]
setae cl
mov byte [eax], cl
mov dword [ebp - 4], 0xffffffff
mov dword [esi], edi
mov dword [edi], 0
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x4a6b1b
call fcn.004a3c60
test al, al
jne 0x4a6ab6
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esi]
push eax
add ecx, 4
call fcn.004a41c0
test al, al
je 0x4a6b1b
mov ecx, dword [esi]
add ecx, 4
call fcn.004a3770
call fcn.004a3c60
test al, al
je 0x4a6b1b
push str.Advapi32.dll
lea ecx, [ebp - 0x150]
call fcn.00402a40
mov dword [ebp - 4], 2
lea eax, [ebp - 0x150]
push eax
call fcn.004a7a40
mov ecx, eax
call fcn.004a7b00
mov edi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x150]
call fcn.00402a30
test edi, edi
je 0x4a6b1b
push str.RegOpenCurrentUser
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4a6b1b
push dword [esi]
push dword [ebp + 8]
call eax
test eax, eax
je 0x4a6b1b
mov eax, dword [esi]
mov dword [eax], 0
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x4a6b2a
mov dword [eax], 0x80000001
mov eax, dword [esi]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004e1ff4
mov esp, ebp
pop ebp
ret 4
Function at 0x4a6d10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53ba56
mov eax, dword fs:[0]
push eax
sub esp, 0x64c
mov eax, dword [0x58a088]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x654]
mov ebx, dword [ebp + 0xc]
call fcn.00402a90
mov dword [ebp - 4], 0
mov eax, dword [0x58e9c4]
mov dword [ebp - 0x63c], 0
mov dword [ebp - 0x63c], 0x58e9c4
test eax, eax
je 0x4a6d7c
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 1
mov ecx, 0x58e9c8
call fcn.00404470
test al, al
jne 0x4a6dc6
push 0x58e9c8
call fcn.00402d80
lea ecx, [ebp - 0x654]
add esp, 4
cmp ecx, eax
je 0x4a6e8a
mov ecx, 0x58e9c8
call fcn.00402ab0
mov ecx, eax
cmp dword [eax + 0x14], 8
jb 0x4a6dbd
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
jmp 0x4a6e7f
push 0x20c
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.004e48c0
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x4a6f2f
xor eax, eax
push 0x412
push eax
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x638]
push eax
call fcn.004e48c0
add esp, 0xc
lea eax, [ebp - 0x638]
push 0x208
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x4a6e68
test eax, eax
je 0x4a6e68
add eax, eax
cmp eax, 0x412
jae 0x4a6f81
xor ecx, ecx
mov word [ebp + eax - 0x638], cx
lea eax, [ebp - 0x638]
push eax
call fcn.00402d30
add esp, 4
push eax
lea eax, [ebp - 0x638]
jmp 0x4a6e7e
lea eax, [ebp - 0x220]
push eax
call fcn.00402d30
add esp, 4
push eax
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x654]
call fcn.00402b20
mov byte [ebp - 4], 0
mov eax, dword [0x58e9c4]
test eax, eax
je 0x4a6e9e
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push ebx
push edi
lea eax, [ebp - 0x654]
mov dword [ebp - 0x63c], 0
push eax
mov ecx, esi
call fcn.004a6ca0
test al, al
je 0x4a6ec3
mov bl, 1
jmp 0x4a6f4f
push 0x20c
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.004e48c0
add esp, 0xc
lea eax, [ebp - 0x220]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec eax
cmp eax, 0x103
ja 0x4a6f4d
xor eax, eax
mov word [ebp - 0x16], ax
lea eax, [ebp - 0x220]
push eax
call fcn.00402d30
add esp, 4
lea ecx, [ebp - 0x654]
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.00402b20
push ebx
push edi
lea eax, [ebp - 0x654]
mov ecx, esi
push eax
call fcn.004a6ca0
mov bl, al
jmp 0x4a6f4f
mov byte [ebp - 4], 0
mov eax, dword [0x58e9c4]
test eax, eax
je 0x4a6f43
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x63c], 0
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x654]
call fcn.00402a30
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e1ff4
mov esp, ebp
pop ebp
ret 8
call fcn.004e2671
int3
Function at 0x4a9410
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53c0df
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x58a088]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0xc]
mov edx, dword [edi + 4]
push eax
lea ecx, [eax + 0x94]
call fcn.004a9a70
mov esi, dword [edi + 4]
add esp, 4
sub esi, 0x94
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.00402a30
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.00402a30
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.00402a30
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.00402a30
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.00402a30
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00402a30
mov eax, dword [ebp + 8]
add dword [edi + 4], 0xffffff6c
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x4a9fd0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53c2cf
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x58a088]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 4
lea ecx, [esi + 0x7c]
call fcn.00402a30
mov byte [ebp - 4], 3
lea ecx, [esi + 0x64]
call fcn.00402a30
mov byte [ebp - 4], 2
lea ecx, [esi + 0x48]
call fcn.00402a30
mov byte [ebp - 4], 1
lea ecx, [esi + 0x30]
call fcn.00402a30
mov byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.00402a30
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00402a30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4ab2d0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53c46f
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x58a088]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
push esi
call fcn.00404cf0
mov dword [ebp - 4], 0
lea eax, [esi + 0x18]
push eax
lea ecx, [edi + 0x18]
call fcn.00404cf0
mov byte [ebp - 4], 1
lea eax, [esi + 0x30]
push eax
lea ecx, [edi + 0x30]
call fcn.00404cf0
mov byte [ebp - 4], 2
lea eax, [esi + 0x48]
push eax
lea ecx, [edi + 0x48]
call fcn.00404cf0
mov byte [ebp - 4], 3
lea ecx, [edi + 0x64]
mov al, byte [esi + 0x60]
mov byte [edi + 0x60], al
lea eax, [esi + 0x64]
push eax
call fcn.00404cf0
mov byte [ebp - 4], 4
lea eax, [esi + 0x7c]
push eax
lea ecx, [edi + 0x7c]
call fcn.00404cf0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4adf60
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x58a088]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
cmp dword [ebp + 0x10], 0xffffffff
mov edi, dword [esp + 0x20]
je 0x4adfe2
mov ecx, 0x100000
nop dword [eax]
nop word [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x4adfe2
test ecx, ecx
je 0x4adfde
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x4adfa0
xor eax, eax
jmp 0x4adfe7
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4adff1
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004e1ff4
add esp, 0xc
ret 0xc

Function at 0x4af400
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52dbd8
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x58a088]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esi + 8]
test edi, edi
jne 0x4af43b
xor al, al
jmp 0x4af4de
add edi, 0x20
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x14], edi
je 0x4af457
mov eax, dword [edi]
test eax, eax
je 0x4af457
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
mov eax, dword [esi + 8]
cmp dword [eax + 4], 0
je 0x4af4bb
push 1
lea ebx, [esi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
mov eax, dword [esi + 8]
add eax, 0xc
push eax
push 4
push esi
push 0x4aefb0
push 0
push 0
call fcn.004f335a
mov ecx, dword [esi + 8]
add esp, 0x18
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 8]
cmp dword [eax + 0x10], 0
jne 0x4af4fa
mov eax, dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
push 0xffffffffffffffff
push ebx
call eax
sub eax, 1
jne 0x4af4b3
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov ecx, dword [esi + 8]
call fcn.004af170
xor bl, bl
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x4af4dc
mov eax, dword [edi]
test eax, eax
je 0x4af4d5
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x14], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e1ff4
mov esp, ebp
pop ebp
ret
mov byte [eax + 8], 1
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x4af512
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esi + 8]
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x4af49d
mov bl, 1
jmp 0x4af4bd
Function at 0x4b0290
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52c268
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x58a088]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov ebx, ecx
cmp esi, 0xffffffff
jne 0x4b02c7
xor al, al
jmp 0x4b032a
and esi, 0xffffb1af
push esi
call fcn.00403390
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4b02e2
mov al, 1
jmp 0x4b032a
lea ecx, [ebp - 0x28]
call fcn.00402a90
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
mov ecx, ebx
call fcn.004b0950
test al, al
je 0x4b0317
push esi
lea ecx, [ebp - 0x28]
call fcn.00403390
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4b0317
mov bl, 1
jmp 0x4b0319
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402a30
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e1ff4
mov esp, ebp
pop ebp
ret

Function at 0x4b0350
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52c268
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x58a088]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.00403390
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4b03ce
lea ecx, [ebp - 0x28]
call fcn.00402a90
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
mov ecx, ebx
call fcn.004b0950
test al, al
je 0x4b03bd
lea ecx, [ebp - 0x28]
call fcn.00403390
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402a30
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e1ff4
mov esp, ebp
pop ebp
ret
Function at 0x4b0500
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d020
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x58a088]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00403390
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call edi
test eax, eax
je 0x4b0546
mov al, 1
jmp 0x4b063b
mov ecx, esi
call fcn.00403390
push eax
lea ecx, [ebp - 0x28]
call fcn.00402a40
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.004b0350
mov ebx, eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402a30
cmp ebx, 0xffffffff
jne 0x4b0585
xor al, al
jmp 0x4b063b
mov ecx, esi
call fcn.00403390
push eax
lea ecx, [ebp - 0x28]
call fcn.00402a40
mov dword [ebp - 4], 1
xor edx, edx
lea ecx, [ebp - 0x28]
call fcn.004b0290
mov bl, al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402a30
test bl, bl
je 0x4b057e
mov ecx, esi
call fcn.00403390
push eax
call edi
test eax, eax
jne 0x4b053f
lea ecx, [ebp - 0x28]
call fcn.00402a90
mov dword [ebp - 4], 2
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.004b0950
test al, al
je 0x4b05fd
lea ecx, [ebp - 0x28]
call fcn.00403390
push eax
call edi
test eax, eax
je 0x4b05fd
mov bl, 1
jmp 0x4b062a
mov ecx, esi
call fcn.00403390
push eax
lea ecx, [ebp - 0x44]
call fcn.00402a40
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x44]
mov edx, dword [ebp - 0x2c]
call fcn.004b0290
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x44]
call fcn.00402a30
xor bl, bl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402a30
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e1ff4
mov esp, ebp
pop ebp
ret

Function at 0x4b0660
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x58a088]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
mov ebx, dword [esp + 0x218]
lea eax, [esp + 4]
push esi
push edi
push 0x20c
push 0
push eax
mov esi, edx
mov edi, ecx
call fcn.004e48c0
add esp, 0xc
lea eax, [esp + 0xc]
mov ecx, esi
push eax
push 0
call fcn.00403390
push eax
mov ecx, edi
call fcn.00403390
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x4b06f5
xor eax, eax
mov word [esp + 0x216], ax
lea eax, [esp + 0xc]
push eax
call fcn.00402d30
add esp, 4
mov ecx, ebx
push eax
lea eax, [esp + 0x10]
push eax
call fcn.00402b20
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004e1ff4
add esp, 0x210
ret
mov ecx, dword [esp + 0x218]
xor al, al
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004e1ff4
add esp, 0x210
ret
Function at 0x4b3db0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x58a088]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
mov esi, ecx
mov dword [esp + 4], 0x114
push 0x110
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [esi], 0
call fcn.004e48c0
add esp, 0xc
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x4b3e47
cmp dword [esp + 8], 6
jb 0x4b3e47
mov byte [esi], 1
mov ecx, dword [esp + 0x118]
pop esi
xor ecx, esp
call fcn.004e1ff4
add esp, 0x118
ret

Function at 0x4b3e60
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d550
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x58a088]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.wintrust.dll
lea ecx, [ebp - 0x28]
call fcn.00402a40
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.004a7a40
mov ecx, eax
call fcn.004a7b00
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402a30
push str.crypt32.dll
lea ecx, [ebp - 0x40]
call fcn.00402a40
mov dword [ebp - 4], 1
lea eax, [ebp - 0x40]
push eax
call fcn.004a7a40
mov ecx, eax
call fcn.004a7b00
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00402a30
test ebx, ebx
je 0x4b3f75
test esi, esi
je 0x4b3f75
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptCATAdminCalcHashFromFileHandle
push ebx
call esi
push str.CryptCATAdminAcquireContext
push ebx
mov dword [edi + 4], eax
call esi
push str.CryptCATAdminEnumCatalogFromHash
push ebx
mov dword [edi + 8], eax
call esi
push str.CryptCATCatalogInfoFromContext
push ebx
mov dword [edi + 0xc], eax
call esi
push str.CryptCATAdminReleaseCatalogContext
push ebx
mov dword [edi + 0x10], eax
call esi
push str.CryptCATAdminReleaseContext
push ebx
mov dword [edi + 0x14], eax
call esi
push str.WTHelperProvDataFromStateData
push ebx
mov dword [edi + 0x18], eax
call esi
push str.WTHelperGetProvSignerFromChain
push ebx
mov dword [edi + 0x1c], eax
call esi
push str.WinVerifyTrust
push ebx
mov dword [edi + 0x20], eax
call esi
push str.CertNameToStrW
push dword [ebp - 0x10]
mov dword [edi + 0x24], eax
call esi
mov dword [edi + 0x28], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b5060
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d5e8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x58a088]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [edi]
test eax, eax
je 0x4b50a6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
lea ecx, [ebp - 0x14]
mov word [edi + 4], 0
mov dword [ebp - 0x14], 0
call fcn.004b9360
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x14]
cmp dword [esi], 0
je 0x4b50cf
lea ebx, [esi + 8]
jmp 0x4b50d1
xor ebx, ebx
mov ecx, dword [ebp - 0x18]
call fcn.00404470
test al, al
jne 0x4b50e7
mov ecx, dword [ebp - 0x18]
call fcn.00403390
jmp 0x4b50e9
xor eax, eax
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
test eax, eax
je 0x4b510a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4b510a
mov byte [edi + 5], 1
cmp dword [edi], 0
setne bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x4b5133
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x4b5148
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 4], 0
push 0x2c
push esi
call fcn.004e2035
add esp, 8
mov dword [ebp - 0x14], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e1ff4
mov esp, ebp
pop ebp
ret 4
Function at 0x4b5180
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d5e8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x58a088]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov ebx, dword [ebp + 8]
test eax, eax
je 0x4b51c3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
push ecx
lea ecx, [ebp - 0x14]
mov word [edi + 4], 0
mov dword [ebp - 0x14], 0
call fcn.004b9420
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x14]
cmp dword [esi], 0
je 0x4b51f0
lea eax, [esi + 8]
mov dword [ebp - 0x18], eax
jmp 0x4b51f7
mov dword [ebp - 0x18], 0
mov ecx, ebx
call fcn.00404470
test al, al
jne 0x4b520b
mov ecx, ebx
call fcn.00403390
jmp 0x4b520d
xor eax, eax
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
test eax, eax
jne 0x4b525e
call ecx
cmp eax, 5
jne 0x4b5258
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, ebx
call fcn.00404470
test al, al
jne 0x4b5248
mov ecx, ebx
call fcn.00403390
jmp 0x4b524a
xor eax, eax
push eax
push 0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [edi]
test eax, eax
je 0x4b527c
call ecx
cmp eax, 0xb7
jne 0x4b5271
mov byte [edi + 5], 1
mov ecx, dword [edi]
call fcn.004a4990
mov eax, dword [edi]
test eax, eax
setne bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x4b52a2
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x4b52b7
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 4], 0
push 0x2c
push esi
call fcn.004e2035
add esp, 8
mov dword [ebp - 0x14], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e1ff4
mov esp, ebp
pop ebp
ret 4