joyce8/EMBER2024-capa huggingface dataset:
Function at 0x485a80
Capabilities:
Resolve dns

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, eax
mov eax, dword [esp + 0x1c]
mov dword [esi], 0
push ecx
mov byte [eax], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x485b14
cmp word [ebx + 8], 2
push edi
jne 0x485ae5
cmp word [ebx + 0xa], 4
jne 0x485ae5
mov edi, dword [ebx + 0xc]
mov eax, dword [edi]
test eax, eax
je 0x485ae5
jmp 0x485ac0
mov edx, dword [eax]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push edx
push ebp
push eax
push ecx
call fcn.00485a10
mov dword [esi], eax
test eax, eax
je 0x485b08
add edi, 4
lea esi, [eax + 0x1c]
mov eax, dword [edi]
test eax, eax
jne 0x485ac0
mov edx, dword [ebx]
mov eax, dword [esp + 0x20]
push 0x400
push edx
push 0x401
push eax
call fcn.004a2681
add esp, 0x10
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
pop edi
pop esi
pop ebp
mov eax, 8
pop ebx
ret 0x10
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x485b24.11001
jmp dword [eax*4 + 0x485b4c]
pop esi
pop ebp
mov eax, 0x2af9
pop ebx
ret 0x10
pop esi
pop ebp
mov eax, 0x2afa
pop ebx
ret 0x10
pop esi
pop ebp
mov eax, 0x2afb
pop ebx
ret 0x10

Function at 0x4862f0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x230
cmp dword [0x500078], 0
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], str.getaddrinfo
mov dword [esp + 0x14], 0x485de0
mov dword [esp + 0x18], str.getnameinfo
mov dword [esp + 0x1c], 0x4860c0
mov dword [esp + 0x20], str.freeaddrinfo
mov dword [esp + 0x24], fcn.00485d90
jne 0x48643d
push 0x104
lea eax, [esp + 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x486433
lea ecx, [esp + 0x138]
push ecx
lea edx, [esp + 0x2c]
push 0x10c
push edx
call fcn.004a22e5
push str.ws2_32
lea eax, [esp + 0x38]
push 0x10c
push eax
call fcn.004a260d
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x18
lea ecx, [esp + 0x28]
push ecx
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4863ae
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x4863fa
push esi
call ebp
lea edx, [esp + 0x138]
push edx
lea eax, [esp + 0x2c]
push 0x10c
push eax
call fcn.004a22e5
push str.wship6
lea ecx, [esp + 0x38]
push 0x10c
push ecx
call fcn.004a260d
add esp, 0x18
lea edx, [esp + 0x28]
push edx
call edi
mov esi, eax
test esi, esi
je 0x486433
push str.getaddrinfo
push esi
call ebx
test eax, eax
jne 0x4863fa
push esi
call ebp
jmp 0x486433
xor edi, edi
lea esp, [esp]
mov eax, dword [esp + edi*8 + 0x10]
push eax
push esi
call ebx
mov dword [esp + edi*8 + 0x14], eax
test eax, eax
je 0x4863f5
inc edi
cmp edi, 3
jl 0x486400
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
mov dword [0x4fd7c4], ecx
mov dword [0x4fd7cc], edx
mov dword [fcn.00485d90], eax
mov dword [0x500078], 1
mov eax, dword [0x4fd7cc]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x230
ret
Function at 0x4874f0
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x4d1048
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
movzx eax, word [esp + 0x30]
push ebx
push ebp
push esi
movzx esi, byte [esp + 0x40]
push edi
shl esi, 0x10
or esi, eax
push 0x4ff5a8
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], 0x4ff5a8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x20]
push edx
mov edi, 0x4ff5c4
mov dword [esp + 0x40], 0
call fcn.00487c10
mov edi, dword [eax]
mov ebx, dword [eax + 4]
mov ebp, dword [0x4ff5dc]
test edi, edi
je 0x487565
cmp edi, dword [0x4ff5c4]
je 0x48756a
call fcn.0049f380
cmp ebx, ebp
je 0x4875ce
test edi, edi
jne 0x48758d
call fcn.0049f380
cmp ebx, dword [edi + 0x18]
jne 0x487581
call fcn.0049f380
mov ebx, dword [ebx + 0x10]
test ebx, ebx
je 0x487591
mov eax, dword [ebx + 4]
jmp 0x487593
mov edi, dword [edi]
jmp 0x487577
xor eax, eax
test eax, eax
je 0x48759a
sub eax, 2
push 0x4ff5a8
test eax, 0xfffffffe
jne 0x4875b1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x4876c8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 8
push 0x4d9064
lea ebx, [esp + 0x14]
call fcn.00402bd0
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [esp + 0x1c], esi
mov esi, dword [esp + 0x10]
mov dword [esp + 0x20], esi
test esi, esi
je 0x4875f5
push esi
call ebp
lea eax, [esp + 0x1c]
push eax
lea edi, [esp + 0x28]
mov ebx, 0x4ff5c4
mov byte [esp + 0x3c], 2
call fcn.00487af0
mov byte [esp + 0x38], 1
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test esi, esi
je 0x48762c
push esi
call edi
test eax, eax
jne 0x48762c
push esi
call fcn.0049e96f
add esp, 4
mov byte [esp + 0x38], 0
test esi, esi
je 0x487645
push esi
call edi
test eax, eax
jne 0x487645
push esi
call fcn.0049e96f
add esp, 4
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x4876df
call fcn.0049f380
xor eax, eax
mov edi, dword [esp + 0x28]
cmp edi, dword [eax + 0x18]
jne 0x487666
call fcn.0049f380
push 0x4ff5a8
add edi, 0x10
mov dword [esp + 0x3c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0xc
call fcn.0049e995
add esp, 4
push 0x4ff5c0
mov esi, eax
call ebp
mov cx, word [esp + 0x40]
mov dl, byte [esp + 0x44]
lea eax, [esp + 0x18]
push eax
push 0
push esi
push 0x4872b0
push 0
push 0
mov dword [esi], 0x4ff5a8
mov word [esi + 4], cx
mov byte [esi + 6], dl
mov dword [esi + 8], edi
call fcn.004a18e7
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
xor al, al
mov dword fs:[0], ecx
pop ebx
add esp, 0x2c
ret 8
mov eax, dword [eax]
jmp 0x487658
Function at 0x48a710
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4cf278
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [ecx]
push esi
push edi
test eax, eax
je 0x48a758
lea ecx, [esp + 0x1c]
push ecx
push ebx
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
neg eax
sbb eax, eax
inc eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x10
ret 4
mov edi, dword [ecx + 4]
test edi, edi
je 0x48a7fa
mov dword [esp + 8], 0
lea eax, [esp + 8]
push eax
push edx
mov dword [esp + 0x1c], 0
call fcn.0048a5b0
test al, al
je 0x48a7d6
mov esi, dword [esp + 8]
test esi, esi
je 0x48a792
mov ecx, dword [esi + 4]
lea eax, [esi + 8]
jmp 0x48a796
xor ecx, ecx
xor eax, eax
push ecx
push eax
push ebx
call fcn.004a7df0
add esp, 0xc
mov dword [esp + 0x14], 0xffffffff
test esi, esi
je 0x48a7c1
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x48a7c1
push esi
call fcn.0049e96f
add esp, 4
mov al, 1
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x10
ret 4
mov dword [esp + 0x14], 0xffffffff
mov esi, dword [esp + 8]
test esi, esi
je 0x48a7fa
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x48a7fa
push esi
call fcn.0049e96f
add esp, 4
mov ecx, dword [esp + 0xc]
pop edi
xor al, al
mov dword fs:[0], ecx
pop esi
add esp, 0x10
ret 4

Function at 0x48a810
Capabilities:
Set registry value

Disassembly:
push ecx
push esi
mov esi, eax
mov eax, dword [ecx]
test eax, eax
je 0x48a84d
mov ecx, dword [esi]
test ecx, ecx
je 0x48a825
mov edx, dword [ecx + 4]
jmp 0x48a827
xor edx, edx
test ecx, ecx
je 0x48a830
add ecx, 8
jmp 0x48a832
xor ecx, ecx
push edx
push ecx
mov ecx, dword [esp + 0x14]
push ecx
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
inc eax
pop esi
pop ecx
ret 4
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x48a888
mov eax, dword [esi]
test eax, eax
je 0x48a85f
mov esi, dword [eax + 4]
jmp 0x48a861
xor esi, esi
test eax, eax
je 0x48a877
push esi
add eax, 8
push eax
push edi
mov edx, ecx
call fcn.0048a4c0
pop esi
pop ecx
ret 4
push esi
xor eax, eax
push eax
push edi
mov edx, ecx
call fcn.0048a4c0
pop esi
pop ecx
ret 4
xor al, al
pop esi
pop ecx
ret 4
Function at 0x48a890
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, eax
mov eax, dword [edi]
test eax, eax
je 0x48a902
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push 0
push ebp
push eax
mov dword [esp + 0x30], 0
call ebx
test eax, eax
jne 0x48a91c
mov edx, dword [esp + 0x18]
push edx
call fcn.004a12f2
mov ecx, dword [edi]
add esp, 4
mov esi, eax
lea eax, [esp + 0x18]
push eax
push esi
push 0
push 0
push ebp
push ecx
call ebx
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
push esi
call fcn.00490250
push esi
call fcn.004a02dd
add esp, 4
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov edi, dword [edi + 4]
test edi, edi
je 0x48a91c
mov edx, dword [esp + 0x1c]
push edx
push ebp
call fcn.0048a5b0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 8

Function at 0x48aae0
Capabilities:
Set registry value

Disassembly:
push ecx
mov eax, dword [ecx]
test eax, eax
je 0x48ab03
push 8
lea ecx, [esp + 0xc]
push ecx
push 3
push 0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete al
pop ecx
ret 8
mov edx, dword [ecx + 4]
test edx, edx
je 0x48ab1b
push 8
lea eax, [esp + 0xc]
push eax
push esi
call fcn.0048a4c0
pop ecx
ret 8
xor al, al
pop ecx
ret 8

Function at 0x48ab50
Capabilities:
Set registry value

Disassembly:
push ecx
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x48ab56
sub eax, edx
sar eax, 1
lea ecx, [eax + eax]
mov eax, dword [edi]
test eax, eax
je 0x48ab83
push ecx
push esi
push 1
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete al
pop ecx
ret
mov edx, dword [edi + 4]
test edx, edx
je 0x48ab94
push ecx
push esi
push ebx
call fcn.0048a4c0
pop ecx
ret
xor al, al
pop ecx
ret

Function at 0x48abd0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x60
push 0x58
lea eax, [esp + 8]
push 0
push eax
mov dword [esp + 0xc], 0
call fcn.004a30a0
mov edx, dword [esp + 0x70]
add esp, 0xc
lea ecx, [esp]
push ecx
push 0x5c
push edx
call dword [sym.imp.GDI32.dll_GetObjectW]
mov eax, dword [esi]
test eax, eax
je 0x48ac21
push 0x5c
lea ecx, [esp + 4]
push ecx
push 3
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete al
add esp, 0x60
ret 4
mov edx, dword [esi + 4]
test edx, edx
je 0x48ac3b
push 0x5c
lea eax, [esp + 4]
push eax
push edi
call fcn.0048a4c0
add esp, 0x60
ret 4
xor al, al
add esp, 0x60
ret 4
Function at 0x48b010
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d1c38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push edi
mov esi, edx
mov dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x30]
push ecx
mov dword [esp + 0x2c], 0
call fcn.0048a890
mov edi, dword [esp + 0xc]
test al, al
je 0x48b0ad
test edi, edi
je 0x48b0ad
mov eax, dword [edi + 4]
test eax, eax
je 0x48b0ad
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
push eax
lea edx, [edi + 8]
push esi
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], 0
call fcn.0040e6e0
push edi
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x48b098
push edi
call fcn.0049e96f
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x20
ret 4
push 1
call fcn.0045c250
mov dword [esp + 0x24], 0xffffffff
test edi, edi
je 0x48b0d4
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x48b0d4
push edi
call fcn.0049e96f
add esp, 4
mov ecx, dword [esp + 0x1c]
pop edi
xor al, al
mov dword fs:[0], ecx
pop esi
add esp, 0x20
ret 4
Function at 0x48ba60
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4cff88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], 5
call fcn.0048c990
mov byte [esp + 0x1c], 6
call fcn.0048bbd0
cmp byte [edi + 0x5d8], 0
mov ebx, dword [esp + 0x10]
je 0x48bad7
test ebx, ebx
je 0x48bab0
mov eax, dword [ebx + 4]
jmp 0x48bab2
xor eax, eax
test eax, eax
je 0x48bab9
sub eax, 2
test eax, 0xfffffffe
je 0x48bad7
test ebx, ebx
je 0x48bacb
lea eax, [ebx + 8]
test eax, eax
jne 0x48bad0
mov eax, 0x4d9064
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [edi + 0x5f0]
mov eax, dword [ecx]
lea esi, [edi + 0x5dc]
mov dword [ecx], ecx
mov ecx, dword [esi + 0x14]
mov dword [ecx + 4], ecx
mov dword [esi + 0x18], 0
cmp eax, dword [esi + 0x14]
je 0x48bb12
lea esp, [esp]
mov ebp, dword [eax]
push eax
call fcn.0049e96f
add esp, 4
mov eax, ebp
cmp ebp, dword [esi + 0x14]
jne 0x48bb00
mov byte [esp + 0x1c], 5
test ebx, ebx
je 0x48bb2f
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x48bb2f
push ebx
call fcn.0049e96f
add esp, 4
mov ecx, esi
mov byte [esp + 0x1c], 4
call fcn.00415b00
lea esi, [edi + 0x5c0]
call fcn.004159d0
lea eax, [edi + 0x550]
push eax
mov byte [esp + 0x20], 2
call fcn.00410820
lea esi, [edi + 0x508]
mov dword [esp + 0x10], esi
lea eax, [esi + 0x18]
push eax
mov byte [esp + 0x20], 7
call fcn.00415830
push esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea ecx, [edi + 0x4b0]
push ecx
mov byte [esp + 0x20], 0
call fcn.00402e90
add edi, 0x3a8
push edi
mov dword [esp + 0x20], 0xffffffff
call fcn.00410a70
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x10
ret 4

Function at 0x48bfc0
Capabilities:
Get system information on windows
Read file via mapping

Disassembly:
sub esp, 0x30
push edi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esi + 0x3c4]
neg eax
cdq
and edx, dword [esi + 0x254]
mov edi, eax
and edi, dword [esi + 0x250]
mov eax, dword [esi + 0x3c0]
sub eax, edi
push eax
push edi
push edx
mov dword [esp + 0x14], ecx
mov ecx, dword [esi + 0x3b8]
push 4
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x5a8], eax
test eax, eax
jne 0x48c01f
mov dword [esi + 0x5ac], eax
xor al, al
pop edi
add esp, 0x30
ret
mov ecx, dword [esi + 0x250]
mov edx, ecx
sub edx, edi
add eax, edx
mov dword [esi + 0x5ac], eax
mov dword [esi + 0x54c], eax
sub eax, ecx
mov ecx, dword [esi + 0x258]
add ecx, eax
mov dword [esi + 0x504], ecx
mov ecx, dword [esi + 0x260]
add ecx, eax
lea eax, [esi + 0x550]
call fcn.0043cf30
mov al, 1
pop edi
add esp, 0x30
ret
Function at 0x48d110
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4cf240
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [esp + 0xc], 0
mov eax, dword [ebx + 8]
push eax
lea eax, [esp + 0x10]
mov esi, ecx
push eax
mov eax, esi
call fcn.0048caa0
mov eax, dword [esi + 0x5c8]
lea edi, [esi + 0x5c0]
inc eax
mov ecx, edi
call fcn.0048e4c0
mov eax, dword [edi + 8]
mov edx, dword [edi]
mov edi, dword [esp + 0xc]
lea ecx, [eax + eax*4]
lea eax, [ecx + edx - 5]
mov cl, byte [esp + 0x10]
mov dword [eax], edi
mov byte [eax + 4], cl
mov eax, dword [ebx + 8]
cmp dword [eax + 0x30], 0
jne 0x48d1b1
sub esp, 8
mov eax, esp
push esi
mov dword [eax], edi
lea esi, [esp + 0x38]
mov byte [eax + 4], cl
call fcn.0048d300
mov edi, esi
mov esi, dword [ebp + 8]
call fcn.00410c80
mov dword [esp + 0x2c], vtable.CEventRef.0
mov ecx, edi
jmp 0x48d2e1
mov eax, dword [esi + 0x248]
or eax, dword [esi + 0x24c]
je 0x48d1c7
mov eax, dword [esi + 0x234]
jmp 0x48d1cd
mov eax, dword [esi + 0x5c8]
dec eax
mov dword [esp + 0xc], eax
lea edi, [esp + 0x14]
mov eax, ebx
call fcn.0040bb70
mov dword [esp + 0x4c], 0
mov ecx, dword [esp + 0x1c]
movzx edi, word [ecx]
mov edx, dword [esi + 0x4ac]
mov eax, dword [esi + 0x4a8]
push edx
push eax
lea ecx, [esi + 0x3a8]
add edi, 2
push ecx
mov al, 1
mov ecx, edi
lea ebx, [esp + 0x2c]
call fcn.00410b30
mov byte [esp + 0x4c], 1
mov eax, dword [esp + 0x28]
test eax, eax
je 0x48d23a
mov edx, dword [esp + 0x1c]
push edi
push edx
push eax
call fcn.004a7df0
add esp, 0xc
add dword [esi + 0x4a8], edi
adc dword [esi + 0x4ac], 0
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x2c]
mov edi, esi
call fcn.0048d390
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
movzx ecx, word [eax + 0x28]
mov edx, dword [eax + 0x2c]
mov ebx, 0x103
lea edi, [edx + ecx*4 + 0x34]
cmp dword [eax + 0x24], ebx
jne 0x48d26a
xor ecx, ecx
xor edx, edx
jmp 0x48d270
mov ecx, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
mov esi, dword [eax + 0x24]
mov eax, dword [esp + 0x34]
cmp dword [eax + 0x24], ebx
jne 0x48d29b
sub ecx, dword [eax + 0x1c]
sbb edx, dword [eax + 0x20]
mov dword [eax + 0x14], ecx
xor ecx, ecx
cmp edx, ecx
mov dword [eax + 0x18], edx
jg 0x48d29b
jl 0x48d295
cmp dword [eax + 0x14], ecx
jae 0x48d29b
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x24], esi
mov esi, dword [ebp + 8]
mov dword [eax + 0x30], edi
lea edi, [esp + 0x2c]
call fcn.00410c80
mov ecx, edi
mov dword [esp + 0x2c], vtable.CEventRef.0
call fcn.00405d80
mov eax, dword [esp + 0x24]
test eax, eax
je 0x48d2dd
mov edi, dword [eax]
add eax, 0x14
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
add edi, 0xe0
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [esp + 0x14]
call fcn.00405d80
mov ecx, dword [esp + 0x44]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x48e3f0
Capabilities:
Delete file

Disassembly:
sub esp, 0x10
mov eax, dword [ebx + 0x18]
push ebp
mov ebp, dword [eax]
push esi
mov esi, dword [ebx]
push edi
mov byte [esp + 0xf], 1
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], esi
lea ebx, [ebx]
mov edi, dword [ebx + 0x18]
mov eax, dword [ebx]
test esi, esi
je 0x48e41d
cmp esi, eax
je 0x48e422
call fcn.0049f380
cmp ebp, edi
je 0x48e470
test esi, esi
jne 0x48e46c
call fcn.0049f380
cmp ebp, dword [esi + 0x18]
jne 0x48e439
call fcn.0049f380
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x48e445
add eax, 8
jne 0x48e44a
mov eax, 0x4d9064
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x48e459
mov byte [esp + 0xf], al
lea esi, [esp + 0x10]
call fcn.0041d2c0
mov ebp, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
jmp 0x48e410
mov esi, dword [esi]
jmp 0x48e42f
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebp
add esp, 0x10
ret

Function at 0x490a00
Capabilities:
Link many functions at runtime
Set environment variable

Disassembly:
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.ntdll.dll
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SymInitialize
push esi
call edi
push str.EnumerateLoadedModules64
push esi
mov dword [0x4febe0], eax
call edi
push str.SymRegisterCallback64
push esi
mov dword [0x4feb60], eax
call edi
push str.SymGetModuleInfo64
push esi
mov dword [0x4feb3c], eax
call edi
push str.SymCleanup
push esi
mov dword [0x4feb68], eax
call edi
push str.SymFromAddrW
push esi
mov dword [0x4feb74], eax
call edi
push str.SymGetSymFromName
push esi
mov dword [0x4feb64], eax
call edi
push str.SymSetOptions
push esi
mov dword [0x4feb28], eax
call edi
push str.SymSetHomeDirectoryW
push esi
mov dword [0x4feb78], eax
call edi
push str.SymLoadModuleExW
push esi
mov dword [0x4feb54], eax
call edi
push str.SymLoadModule64
push esi
mov dword [0x4feb44], eax
call edi
push str.SymUnloadModule64
push esi
mov dword [0x4feb70], eax
call edi
push str.StackWalk64
push esi
mov dword [0x4feb40], eax
call edi
push str.SymGetLineFromAddrW64
push esi
mov dword [0x4feb34], eax
call edi
push str.SymGetLinePrevW64
push esi
mov dword [0x4feb6c], eax
call edi
push str.SymGetSourceFileTokenW
push esi
mov dword [0x4feb5c], eax
call edi
push str.SymGetSourceFileW
push esi
mov dword [0x4feb48], eax
call edi
push str.SymGetModuleBase64
push esi
mov dword [0x4feb88], eax
call edi
mov dword [0x4feb7c], eax
push str.SymFunctionTableAccess64
push esi
call edi
push str.SymFindFileInPathW
push esi
mov dword [0x4feb50], eax
mov dword [0x4feb84], 0x4908c0
call edi
push str.SymSetSearchPathW
push esi
mov dword [0x4feb38], eax
call edi
mov dword [0x4feb80], eax
mov eax, dword [0x4ff310]
pop edi
pop esi
test eax, eax
je 0x490b47
add eax, 8
jne 0x490b4c
mov eax, 0x4d9064
push eax
push str._NT_SYMBOL_PATH
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp dword [0x4feb44], 0
je 0x490b7f
cmp dword [0x4feb64], 0
je 0x490b7f
cmp dword [0x4feb84], 0
je 0x490b7f
cmp dword [0x4feb38], 0
je 0x490b7f
mov al, 1
ret
xor al, al
ret
Function at 0x4912a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4cfe78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
lea eax, [esp + 0xc]
mov esi, ecx
push eax
push esi
call fcn.0040a770
mov dword [esp + 0x18], 0
movzx ecx, word [esi + 0x28]
add ecx, ecx
add ecx, ecx
mov edx, dword [ecx + esi + 0x38]
mov ecx, dword [ecx + esi + 0x34]
push edx
mov edx, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x30]
push edx
push eax
push 0
call fcn.00490e50
mov esi, eax
mov dword [esp + 0x18], 0xffffffff
mov eax, dword [esp + 0xc]
test eax, eax
je 0x49131f
push eax
mov edi, eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x49131f
push edi
call fcn.0049e96f
add esp, 4
mov eax, dword [esp + 0x20]
push esi
call fcn.00453e00
mov ecx, dword [esp + 0x10]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0x14
ret 0x10

Function at 0x492200
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x800
push esi
push 0x4ff7c8
xor esi, esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x4febe0], esi
je 0x492264
cmp dword [0x4feb64], esi
je 0x492264
push 0x12237
call dword [0x4feb78]
push esi
push esi
push edi
call dword [0x4febe0]
cmp dword [0x4feb54], 0
mov esi, eax
je 0x492264
push 0x400
lea eax, [esp + 8]
push eax
push str.TEMP
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [esp + 4]
push ecx
push edi
call dword [0x4feb54]
push 0x4ff7c8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
test esi, esi
setne al
pop esi
add esp, 0x800
ret
Function at 0x493110
Capabilities:
Get file version info

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
lea eax, [esp + 0x14]
push eax
xor ebx, ebx
push ebp
mov dword [esp + 0x1c], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
push esi
call fcn.0049e767
add esp, 4
mov edi, eax
push edi
push esi
push ebx
push ebp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x49314e
cmp dword [edi + 0x30], 0x60000
jb 0x49314e
mov bl, 1
push edi
call fcn.0049e610
add esp, 4
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
ret 4