joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46bec0
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x6e6358]
test eax, eax
je 0x46bece
call fcn.00469790
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push edi
push str.DSEBGMNew
push 0
push 0
push 0
call esi
push str.DSELVNew
push 0
push 0
push 0
mov dword [0x6e6350], eax
call esi
push str.DSESENew
push 0
push 0
push 0
mov dword [0x6e6354], eax
call esi
push str.DSEGETInfo
push 0
push 0
push 0
mov dword [0x6e633c], eax
call esi
push 0x104
mov dword [0x6e634c], eax
call fcn.004871ea
mov ecx, dword [str.BGM.ini]
push ecx
push 0x5a6068
mov edi, eax
push 0x4a0be0
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
mov edx, dword [str.BGM.dat]
push edx
push edi
call fcn.00436100
push edi
mov esi, eax
call fcn.0048726d
add esp, 0x20
test esi, esi
je 0x46bf95
push esi
call fcn.00435bf0
add esp, 4
add eax, 8
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [0x6e635c], eax
je 0x46bf8c
push eax
push esi
call fcn.00435b70
push esi
call fcn.00435c00
add esp, 0xc
push esi
call fcn.00435c40
add esp, 4
mov eax, dword [esp + 0xc]
push 0x6e6348
push 0
push eax
push 0x46a3f0
push 0
push 0
mov dword [0x6e6340], 9
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x6e6344], eax
mov ecx, dword [0x6e6344]
test ecx, ecx
pop edi
pop esi
jne 0x46bfd1
mov eax, reloc.DSOUND.dll_DirectSoundCreate
ret
mov edx, dword [0x6e6344]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, 1
mov dword [0x6e6358], eax
ret
Function at 0x46e940
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x49f70b
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4c06dc]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c06dc]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], eax
mov esi, ecx
mov ecx, dword [esp + 0x60]
mov edx, dword [ecx]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x3c], eax
lea edi, [esi + 0x48]
push edi
lea eax, [esp + 0x30]
push eax
push ecx
mov ecx, dword [edx + 0xc]
mov word [esp + 0x24], 1
mov word [esp + 0x26], 2
mov dword [esp + 0x28], 0xac44
mov word [esp + 0x30], 4
mov dword [esp + 0x2c], 0x2b110
mov word [esp + 0x32], 0x10
mov dword [esp + 0x38], 0x24
mov dword [esp + 0x3c], 0xc1c8
mov dword [esp + 0x40], 0x183990
call ecx
test eax, eax
jne 0x46eaee
push 1
lea ebx, [esi + 0x50]
push esi
mov dword [ebx], 0x2b110
mov dword [esi + 0x58], 0xac440
mov dword [esi + 0x60], 0x12d770
mov dword [esi + 0x68], 0x18398c
mov dword [esi + 0x70], 0xffffffff
call fcn.0046d280
push 2
push esi
mov dword [esi + 0x54], eax
call fcn.0046d280
push 0
push esi
mov dword [esi + 0x5c], eax
call fcn.0046d280
push 3
push esi
mov dword [esi + 0x64], eax
call fcn.0046d280
add esp, 0x20
mov dword [esi + 0x6c], eax
call fcn.0046d380
mov dword [esi + 0x74], eax
mov eax, dword [edi]
mov edx, dword [eax]
lea ebp, [esi + 0x4c]
push ebp
push 0x4aa4f8
push eax
mov eax, dword [edx]
call eax
test eax, eax
jne 0x46eaee
mov ebp, dword [ebp]
mov ecx, dword [ebp]
mov edx, dword [ecx + 0xc]
push ebx
push 5
push ebp
call edx
test eax, eax
jne 0x46eaee
push 0x81730
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [esi + 0xb0], eax
je 0x46eaee
cmp dword [esi + 0x3c], 0
jne 0x46eaf9
push 0x8f8
call fcn.0048731e
add esp, 4
mov dword [esp + 0x24], eax
test eax, eax
mov dword [esp + 0x58], 0
je 0x46eadd
mov ecx, eax
call fcn.0046f620
jmp 0x46eadf
xor eax, eax
test eax, eax
mov dword [esp + 0x58], 0xffffffff
mov dword [esi + 0x3c], eax
jne 0x46eaf9
mov ecx, esi
call fcn.0046e220
xor eax, eax
jmp 0x46eafe
mov eax, 1
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00487272
add esp, 0x48
ret 4
Function at 0x46ff50
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2e4
mov eax, dword [0x4c06dc]
xor eax, esp
mov dword [esp + 0x2e0], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
mov al, 0x3f
push str.save000.sav
push 0x4c2280
mov byte [0x4bac30], al
mov byte [0x4bac31], al
mov byte [0x4bac32], al
lea eax, [esp + 0x1e8]
push 0x4a11e4
push eax
call edi
add esp, 0x10
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x1e4]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
test esi, esi
mov dword [esp + 0xc], esi
je 0x47001d
cmp esi, 0xffffffff
je 0x47001d
test byte [esp + 0x20], 0x10
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
jne 0x470074
lea eax, [esp + 0x4c]
push eax
push 0x4c2280
lea ecx, [esp + 0x1e8]
push 0x4a11e4
push ecx
call edi
add esp, 0x10
push 0
push 0x8000080
push 3
push 0
push 1
push DirectSoundCreate
lea edx, [esp + 0x1f8]
push edx
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x470035
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2e0]
xor ecx, esp
call fcn.00487272
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
push esi
jne 0x470057
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0xc]
push edx
jmp 0x470017
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [esp + 0xc]
lea edx, [esp + 0x20]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x470145
jmp 0x470090
test byte [esp + 0x20], 0x10
jne 0x470131
lea eax, [esp + 0x4c]
push eax
push 0x4c2280
lea ecx, [esp + 0x1e8]
push 0x4a11e4
push ecx
call edi
add esp, 0x10
push 0
push 0x8000080
push 3
push 0
push 1
push DirectSoundCreate
lea edx, [esp + 0x1f8]
push edx
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x47012d
lea eax, [esp + 0x18]
push eax
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x47012d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
cmp eax, 1
jne 0x47012d
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x4c]
mov dword [esp + 0x10], eax
push edx
lea eax, [esp + 0x164]
push eax
mov dword [esp + 0x1c], ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x20]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x470090
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
movsx eax, byte [esp + 0x164]
lea edx, [eax + eax*4]
movsx eax, byte [esp + 0x165]
lea eax, [eax + edx*2]
movsx edx, byte [esp + 0x166]
pop edi
lea ecx, [eax + eax*4]
lea eax, [edx + ecx*2 - 0x14d0]
mov ecx, dword [esp + 0x2e8]
pop esi
pop ebx
xor ecx, esp
call fcn.00487272
mov esp, ebp
pop ebp
ret
Function at 0x470690
Capabilities:
Copy file

Disassembly:
push ebx
push esi
push edi
push 0x104
call fcn.004871ea
mov esi, eax
add esp, 4
test esi, esi
je 0x470740
push 0x104
call fcn.004871ea
mov edi, eax
add esp, 4
test edi, edi
je 0x470737
mov eax, dword [esp + 0x10]
push eax
call fcn.0046fca0
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push eax
push 0x4c2280
push 0x4a11e4
push esi
call ebx
push 0
push esi
call fcn.00436100
add esp, 0x1c
test eax, eax
je 0x47072e
push eax
call fcn.00435c40
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0046fca0
push eax
push 0x4c2280
push 0x4a11e4
push edi
call ebx
add esp, 0x18
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x47072e
push edi
call fcn.0048726d
push esi
call fcn.0048726d
add esp, 8
pop edi
pop esi
mov al, 1
pop ebx
ret
push edi
call fcn.0048726d
add esp, 4
push esi
call fcn.0048726d
add esp, 4
pop edi
pop esi
xor al, al
pop ebx
ret

Function at 0x470750
Capabilities:
Delete file

Disassembly:
push esi
push 0x104
call fcn.004871ea
mov esi, eax
add esp, 4
test esi, esi
je 0x4707b9
mov eax, dword [esp + 8]
push eax
call fcn.0046fca0
push eax
push 0x4c2280
push 0x4a11e4
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
push 0
push esi
call fcn.00436100
add esp, 0x1c
test eax, eax
je 0x4707b0
push eax
call fcn.00435c40
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x4707b0
push esi
call fcn.0048726d
add esp, 4
mov al, 1
pop esi
ret
push esi
call fcn.0048726d
add esp, 4
xor al, al
pop esi
ret

Function at 0x4707c0
Capabilities:
Delete file

Disassembly:
push esi
push 0x104
call fcn.004871ea
mov esi, eax
add esp, 4
test esi, esi
je 0x470818
mov eax, dword [esp + 8]
push esi
push eax
call fcn.0046fd00
push 0
push esi
call fcn.00436100
add esp, 0x10
test eax, eax
je 0x47080f
push eax
call fcn.00435c40
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x47080f
push esi
call fcn.0048726d
add esp, 4
mov al, 1
pop esi
ret
push esi
call fcn.0048726d
add esp, 4
xor al, al
pop esi
ret
Function at 0x4757f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x64
push ebx
mov ebx, dword [esp + 0x6c]
xor ecx, ecx
cmp ebx, ecx
push esi
push edi
jne 0x475841
mov edi, dword [0x6f16e0]
xor edx, edx
xor esi, esi
cmp edi, ecx
jbe 0x475833
mov edi, edi
mov eax, dword [ecx*4 + 0x6f18e8]
cmp dword [eax + 0x68], 0
jne 0x47582c
mov ebx, dword [eax + 0x1c]
imul ebx, dword [eax + 0x18]
imul ebx, ebx, 0x15
add edx, 1
add esi, ebx
add ecx, 1
cmp ecx, edi
jb 0x475810
imul edx, edx, 0x64
pop edi
lea eax, [edx + esi + 4]
pop esi
pop ebx
add esp, 0x64
ret
mov eax, dword [0x6f16e0]
mov dword [ebx], eax
add ebx, 4
cmp eax, ecx
mov dword [esp + 0x74], ecx
jbe 0x4759b4
push ebp
mov ebp, 0x6f18e8
lea ecx, [ecx]
mov eax, dword [ebp]
cmp dword [eax + 0x68], 0
jne 0x475998
mov ecx, dword [eax + 8]
fld dword [eax + 0x4c]
mov dword [esp + 0x18], ecx
fstp dword [esp + 0x50]
mov ecx, dword [eax + 0xc]
mov dword [esp + 0x14], ecx
mov ecx, dword [eax + 0x18]
mov dword [esp + 0x20], ecx
mov ecx, dword [eax + 0x5c]
mov dword [esp + 0x28], ecx
mov ecx, dword [eax + 0x60]
mov dword [esp + 0x2c], ecx
mov ecx, dword [eax + 0x24]
mov dword [esp + 0x30], ecx
mov ecx, dword [eax + 0x28]
mov dword [esp + 0x34], ecx
mov ecx, dword [eax + 0x2c]
mov edx, dword [eax]
mov dword [esp + 0x38], ecx
mov ecx, dword [eax + 0x30]
mov dword [esp + 0x3c], ecx
mov ecx, dword [eax + 0x34]
mov dword [esp + 0x40], ecx
mov ecx, dword [eax + 0x38]
mov dword [esp + 0x44], ecx
mov ecx, dword [eax + 0x3c]
mov dword [esp + 0x48], ecx
mov ecx, dword [eax + 0x40]
mov dword [esp + 0x4c], ecx
mov ecx, dword [eax + 0x50]
mov dword [esp + 0x54], ecx
mov ecx, dword [eax + 0x54]
mov dword [esp + 0x58], ecx
mov ecx, dword [eax + 0x58]
mov dword [esp + 0x10], edx
mov edx, dword [eax + 0x10]
mov dword [esp + 0x5c], ecx
mov ecx, dword [eax + 0x64]
mov dword [esp + 0x1c], edx
mov edx, dword [eax + 0x1c]
mov dword [esp + 0x60], ecx
mov ecx, dword [eax + 0x48]
mov dword [esp + 0x24], edx
imul edx, dword [esp + 0x20]
mov dword [esp + 0x64], ecx
mov ecx, dword [eax + 0x80]
mov dword [esp + 0x68], ecx
mov ecx, dword [eax + 0x84]
mov al, byte [eax + 0x88]
mov dword [esp + 0x6c], ecx
mov edi, ebx
mov byte [esp + 0x70], al
mov ecx, 0x19
lea esi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp]
mov edi, edx
mov edx, dword [ecx + 0x44]
push edi
push edx
add ebx, 0x64
push ebx
call fcn.00488580
add esp, 0xc
add ebx, edi
xor esi, esi
test edi, edi
jbe 0x475998
mov eax, dword [ebp]
mov ecx, dword [eax + 0x78]
cmp dword [ecx + esi*4], 0
je 0x47597e
mov dword [ebx], 1
mov eax, dword [ebp]
mov ecx, dword [eax + 0x78]
lea edx, [ebx + 4]
push edx
mov edx, dword [ecx + esi*4]
push edx
call fcn.00474690
add esp, 8
jmp 0x47598e
xor eax, eax
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], eax
add esi, 1
add ebx, 0x14
cmp esi, edi
jb 0x475954
mov ecx, dword [esp + 0x78]
mov eax, dword [0x6f16e0]
add ecx, 1
add ebp, 4
cmp ecx, eax
mov dword [esp + 0x78], ecx
jb 0x475860
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x64
ret
Function at 0x479ea0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x64
push esi
mov esi, dword [esp + 0x6c]
mov eax, dword [esi]
test eax, eax
je 0x47a071
add esi, 4
test eax, eax
jbe 0x47a071
push ebx
push ebp
mov dword [esp + 0x14], eax
push edi
mov eax, dword [esi + 8]
fld dword [esi + 0x40]
mov ecx, dword [esi + 0xc]
fadd st(0), st(0)
mov edx, dword [esi + 0x48]
lea edi, [esi + 0xc]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x4c]
mov dword [esp + 0x44], ecx
mov ecx, dword [esi + 0x18]
mov dword [esp + 0x28], edx
mov edx, dword [esi + 0x1c]
mov ebp, esi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x1c], edi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
call fcn.004884b0
mov edx, dword [esi + 0x20]
mov ecx, dword [esi + 0x50]
mov dword [esp + 0x38], eax
mov eax, dword [esi + 0x44]
mov dword [esp + 0x48], edx
mov edx, dword [esi + 0x2c]
mov dword [esp + 0x3c], eax
mov eax, dword [esi + 0x24]
mov dword [esp + 0x40], ecx
mov ecx, dword [esi + 0x28]
mov dword [esp + 0x54], edx
mov edx, dword [esi + 0x38]
mov dword [esp + 0x4c], eax
mov eax, dword [esi + 0x30]
mov dword [esp + 0x50], ecx
mov ecx, dword [esi + 0x34]
mov dword [esp + 0x60], edx
mov edx, dword [esi + 0x58]
mov dword [esp + 0x58], eax
mov eax, dword [esi + 0x3c]
mov dword [esp + 0x5c], ecx
mov ecx, dword [esi + 4]
mov dword [esp + 0x68], edx
mov dword [esp + 0x64], eax
mov eax, dword [esi + 0x5c]
mov dword [esp + 0x24], ecx
mov cl, byte [esi + 0x60]
lea edx, [esp + 0x20]
push 0
push edx
mov dword [esp + 0x74], eax
mov byte [esp + 0x78], cl
call fcn.00479d20
push eax
call fcn.00474ad0
add esp, 0xc
cmp byte [esi + 0x60], 0
mov dword [esp + 0x78], eax
je 0x479f9b
mov ecx, dword [esi + 0x5c]
mov edx, dword [esi + 0x58]
push ecx
push edx
push eax
call fcn.00477700
add esp, 0xc
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov edx, eax
imul edx, ecx
add esi, 0x64
mov ebx, esi
add esi, edx
test ecx, ecx
mov dword [esp + 0x10], 0
jle 0x47a040
lea ecx, [ecx]
xor edi, edi
test eax, eax
jle 0x47a02c
lea ebp, [esi + 4]
lea esp, [esp]
cmp dword [esi], 0
je 0x47a013
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x78]
push eax
push edi
push ecx
call fcn.00474c00
movzx edx, word [ebx]
push edx
call fcn.00474720
add esp, 0x10
test eax, eax
push ebp
je 0x47a001
push edx
mov edx, dword [esp + 0x80]
push edx
jmp 0x47a00b
movzx ax, byte [ebx]
mov ecx, dword [esp + 0x7c]
push eax
push ecx
call fcn.004771b0
add esp, 0xc
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x10]
add edi, 1
add esi, 0x14
add ebp, 0x14
add ebx, 1
cmp edi, eax
jl 0x479fd0
mov ebp, edx
mov ecx, dword [esp + 0x10]
add ecx, 1
cmp ecx, dword [ebp + 0x14]
mov dword [esp + 0x10], ecx
jl 0x479fc0
mov edi, dword [esp + 0x1c]
cmp dword [edi], 0
je 0x47a052
mov eax, dword [esp + 0x78]
push eax
call fcn.00474cc0
add esp, 4
mov ecx, dword [ebp]
mov edx, dword [esp + 0x78]
push ecx
push edx
call fcn.00474b00
add esp, 8
sub dword [esp + 0x18], 1
jne 0x479ec4
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
add esp, 0x64
ret
Function at 0x48456c
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x98
push ebx
push esi
xor esi, esi
cmp dword [ebp + 0x78], esi
push edi
mov edi, ecx
jne 0x48458d
mov eax, 0x8876086c
jmp 0x484680
cmp dword [ebp + 0x7c], esi
je 0x48460f
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x18], 2
je 0x4845ef
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push dword [ebp + 0x78]
push esi
push 0xfde9
call ebx
mov dword [ebp + 0x6c], eax
add eax, 3
and eax, 0xfffffffc
call fcn.004888f0
mov dword [ebp + 0x7c], esp
push esi
push esi
push dword [ebp + 0x6c]
push dword [ebp + 0x7c]
push 0xffffffffffffffff
push dword [ebp + 0x78]
push esi
push 0xfde9
call ebx
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x78], eax
mov dword [ebp + 0x7c], esi
cmp dword [ebp + 0x7c], esi
je 0x48460f
push esi
push 0x10000000
push 3
push esi
push 1
push DirectSoundCreate
push dword [ebp + 0x78]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x484628
push esi
push 0x10000000
push 3
push esi
push 1
push DirectSoundCreate
push dword [ebp + 0x78]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [edi], eax
je 0x48466e
push esi
push esi
push esi
push 2
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, 0xffffffff
mov dword [edi + 4], eax
je 0x48466e
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [edi + 0xc], eax
je 0x48466e
cmp eax, esi
je 0x48467b
push esi
push esi
push esi
push 4
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, esi
mov dword [edi + 8], eax
jne 0x48467e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0x88760b59
jmp 0x484680
mov dword [edi + 8], esi
xor eax, eax
lea esp, [ebp - 0x34]
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret 8

Function at 0x487272
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4c06dc]
jne 0x48727c
repz ret
jmp fcn.0048c324
Function at 0x492a12
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x4c1088]
je 0x492a2d
inc edi
cmp edi, 0x17
jb 0x492a1e
cmp edi, 0x17
jae 0x492bad
push ebp
push 3
call fcn.0049c6d2
cmp eax, 1
pop ecx
je 0x492b79
push 3
call fcn.0049c6d2
test eax, eax
pop ecx
jne 0x492a61
cmp dword [0x4c077c], 1
je 0x492b79
cmp ebx, 0xfc
je 0x492bac
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x6f7040
push ebp
call fcn.0048e5be
add esp, 0xc
test eax, eax
je 0x492a97
push esi
push esi
push esi
push esi
push esi
call fcn.00487e43
add esp, 0x14
push 0x104
mov esi, 0x6f7059
push esi
push 0
mov byte [0x6f715d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x492adb
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0048e5be
add esp, 0xc
test eax, eax
je 0x492adb
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00487e43
add esp, 0x14
push esi
call fcn.0048c230
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x492b20
push esi
call fcn.0048c230
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x6f7354
push 0x4b30fc
sub ecx, eax
push ecx
push eax
call fcn.0048fd89
add esp, 0x14
test eax, eax
je 0x492b20
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00487e43
add esp, 0x14
jmp 0x492b22
xor esi, esi
push 0x4b30f8
push ebx
push ebp
call fcn.00494a02
add esp, 0xc
test eax, eax
je 0x492b42
push esi
push esi
push esi
push esi
push esi
call fcn.00487e43
add esp, 0x14
push dword [edi*8 + 0x4c108c]
push ebx
push ebp
call fcn.00494a02
add esp, 0xc
test eax, eax
je 0x492b64
push esi
push esi
push esi
push esi
push esi
call fcn.00487e43
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0049c515
add esp, 0xc
jmp 0x492bac
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x492bac
cmp ebp, 0xffffffff
je 0x492bac
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x4c108c]
push dword [esi]
call fcn.0048c230
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x49c515
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0048de25
xor ebx, ebx
cmp dword [0x6f763c], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x49c5eb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x49c6cb
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4b6814
push edi
call esi
cmp eax, ebx
je 0x49c6cb
push eax
call fcn.0048ddb7
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x6f763c], eax
call esi
push eax
call fcn.0048ddb7
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x6f7640], eax
call esi
push eax
call fcn.0048ddb7
mov dword [0x6f7644], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00490a56
test eax, eax
pop ecx
pop ecx
je 0x49c5b9
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00487e43
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x49c5eb
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0048ddb7
cmp eax, ebx
pop ecx
mov dword [0x6f764c], eax
je 0x49c5eb
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0048ddb7
pop ecx
mov dword [0x6f7648], eax
mov eax, dword [0x6f7648]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x49c670
cmp dword [0x6f764c], ecx
je 0x49c670
push eax
call fcn.0048de2e
push dword [0x6f764c]
mov esi, eax
call fcn.0048de2e
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x49c670
cmp edi, ebx
je 0x49c670
call esi
cmp eax, ebx
je 0x49c63d
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x49c63d
test byte [ebp - 0x18], 1
jne 0x49c670
lea eax, [ebp - 0x10]
push eax
call fcn.00490a8d
test eax, eax
pop ecx
je 0x49c658
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00487e43
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x49c667
or dword [ebp + 0x10], 0x200000
jmp 0x49c6ab
or dword [ebp + 0x10], 0x40000
jmp 0x49c6ab
mov eax, dword [0x6f7640]
cmp eax, dword [ebp - 8]
je 0x49c6ab
push eax
call fcn.0048de2e
cmp eax, ebx
pop ecx
je 0x49c6ab
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x49c6ab
mov eax, dword [0x6f7644]
cmp eax, dword [ebp - 8]
je 0x49c6ab
push eax
call fcn.0048de2e
cmp eax, ebx
pop ecx
je 0x49c6ab
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x6f763c]
call fcn.0048de2e
cmp eax, ebx
pop ecx
je 0x49c6cb
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x49c6cd
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4c791e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4d0440
cmp edx, dword [eax]
je 0x4c7940
add eax, 8
inc ecx
cmp eax, 0x4d04d0
jl 0x4c7931
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4d0440]
jne 0x4c7a6e
mov eax, dword [0x4d4b2c]
cmp eax, 1
je 0x4c7a48
test eax, eax
jne 0x4c7971
cmp dword [0x4d0384], 1
je 0x4c7a48
cmp edx, 0xfc
je 0x4c7a6e
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4c79a8
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004c8030
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004c8260
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4c79eb
lea eax, [ebp - 0x1a4]
push eax
call fcn.004c8260
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4cbd28
push edi
call fcn.004c9a30
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004c8030
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004c8040
lea eax, [ebp - 0xa0]
push 0x4cbd08
push eax
call fcn.004c8040
push dword [esi + 0x4d0444]
lea eax, [ebp - 0xa0]
push eax
call fcn.004c8040
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004c99a4
add esp, 0x2c
pop edi
jmp 0x4c7a6e
lea eax, [ebp + 8]
lea esi, [esi + 0x4d0444]
push 0
push eax
push dword [esi]
call fcn.004c8260
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret