joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a3ba0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x30
mov edx, dword [esp + 0x38]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x40]
push edi
mov edi, dword [esp + 0x4c]
lea eax, [edx + edx + 2]
cmp eax, edi
mov dword [esp + 0x48], edx
jge 0x4a3c68
lea ecx, [eax + eax*2]
lea ecx, [esi + ecx*8]
lea ebx, [ecx - 0x14]
mov ebp, dword [ebx]
mov dword [esp + 0x2c], ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 0x30], ebp
mov ebp, dword [ebx + 8]
add ecx, 4
mov dword [esp + 0x34], ebp
mov ebp, dword [ebx + 0xc]
mov bx, word [ebx + 0x10]
mov word [esp + 0x3c], bx
mov ebx, dword [ecx]
mov dword [esp + 0x14], ebx
mov ebx, dword [ecx + 4]
mov dword [esp + 0x18], ebx
mov ebx, dword [ecx + 8]
mov dword [esp + 0x1c], ebx
mov ebx, dword [ecx + 0xc]
mov cx, word [ecx + 0x10]
mov dword [esp + 0x20], ebx
mov ebx, dword [esp + 0x2c]
mov word [esp + 0x24], cx
mov ecx, dword [esp + 0x14]
shr ecx, 8
shr ebx, 8
cmp cl, bl
mov dword [esp + 0x38], ebp
jae 0x4a3c2a
dec eax
lea ecx, [eax + eax*2]
mov ebx, dword [esi + ecx*8]
lea ecx, [esi + ecx*8]
lea edx, [edx + edx*2]
mov dword [esi + edx*8], ebx
mov ebx, dword [ecx + 4]
lea edx, [esi + edx*8]
mov dword [edx + 4], ebx
mov ebx, dword [ecx + 8]
mov dword [edx + 8], ebx
mov ebx, dword [ecx + 0xc]
mov dword [edx + 0xc], ebx
mov ebx, dword [ecx + 0x10]
mov dword [edx + 0x10], ebx
mov ecx, dword [ecx + 0x14]
mov dword [edx + 0x14], ecx
mov edx, eax
lea eax, [eax + eax + 2]
cmp eax, edi
jl 0x4a3bc3
jne 0x4a3c9f
lea ecx, [edx + edx*2]
lea ecx, [esi + ecx*8]
lea eax, [edi + edi*2]
mov edx, dword [esi + eax*8 - 0x18]
mov dword [ecx], edx
mov edx, dword [esi + eax*8 - 0x14]
lea eax, [esi + eax*8 - 0x18]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov edx, dword [eax + 0xc]
mov dword [ecx + 0xc], edx
mov edx, dword [eax + 0x10]
mov dword [ecx + 0x10], edx
mov eax, dword [eax + 0x14]
mov dword [ecx + 0x14], eax
lea edx, [edi - 1]
mov ecx, dword [esp + 0x68]
push ecx
mov ecx, dword [esp + 0x54]
sub esp, 0x18
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x70]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x74]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x78]
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x7c]
mov dword [eax + 0x10], ecx
mov ecx, dword [esp + 0x80]
mov dword [eax + 0x14], ecx
mov eax, dword [esp + 0x64]
push eax
push edx
push esi
call fcn.004a34d0
add esp, 0x28
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x4a4540
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x60
push edi
mov edi, dword [esp + 0x68]
cmp edi, eax
je 0x4a4675
push esi
lea esi, [edi + 0x18]
cmp esi, eax
je 0x4a4674
push ebx
push ebp
lea eax, [edi + 4]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x2c], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x30], edx
mov edx, dword [eax + 0xc]
mov ax, word [eax + 0x10]
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], edx
mov word [esp + 0x3c], ax
lea eax, [esi + 4]
mov ecx, eax
mov edx, dword [ecx]
mov dword [esp + 0x14], edx
mov edx, dword [ecx + 4]
mov dword [esp + 0x18], edx
mov edx, dword [ecx + 8]
mov dword [esp + 0x1c], edx
mov edx, dword [ecx + 0xc]
mov cx, word [ecx + 0x10]
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x14]
mov word [esp + 0x24], cx
mov ecx, dword [esp + 0x2c]
shr edx, 8
shr ecx, 8
cmp dl, cl
jae 0x4a45e0
cmp edi, esi
lea eax, [esi + 0x18]
je 0x4a4663
cmp esi, eax
je 0x4a4663
push 0
push 0
push eax
push esi
push edi
jmp 0x4a465b
mov ebx, dword [eax]
mov dword [esp + 0x44], ebx
mov ebx, dword [eax + 4]
mov dword [esp + 0x48], ebx
mov ebx, dword [eax + 8]
mov dword [esp + 0x4c], ebx
mov ebx, dword [eax + 0xc]
mov ax, word [eax + 0x10]
mov word [esp + 0x54], ax
mov al, byte [esp + 0x45]
mov edx, esi
mov ecx, esi
mov dword [esp + 0x50], ebx
lea esp, [esp]
sub ecx, 0x18
lea ebx, [ecx + 4]
mov ebp, dword [ebx]
mov dword [esp + 0x5c], ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 0x60], ebp
mov ebp, dword [ebx + 8]
mov dword [esp + 0x64], ebp
mov ebp, dword [ebx + 0xc]
mov bx, word [ebx + 0x10]
mov word [esp + 0x6c], bx
mov ebx, dword [esp + 0x5c]
shr ebx, 8
cmp al, bl
mov dword [esp + 0x68], ebp
jae 0x4a4649
mov edx, ecx
jmp 0x4a4610
cmp edx, esi
je 0x4a4663
lea eax, [esi + 0x18]
cmp esi, eax
je 0x4a4663
push 0
push 0
push eax
push esi
push edx
call fcn.004a35d0
add esp, 0x14
mov eax, dword [esp + 0x78]
add esi, 0x18
cmp esi, eax
jne 0x4a4562
pop ebp
pop ebx
pop esi
pop edi
add esp, 0x60
ret
Function at 0x4a9890
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x50313b
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
mov esi, ecx
mov dword [esi + 0x18], eax
mov eax, dword [eax + 0x30]
mov dword [esi + 0xc], eax
mov al, byte [esp + 0x24]
mov byte [esi + 0x29], al
mov al, byte [esp + 0x28]
push edi
movzx edi, al
lea ecx, [edi + edi*2]
lea edx, [ecx*8 + 4]
push edx
mov byte [esi + 0x28], bl
mov byte [esi + 0x2a], al
call fcn.004ec898
add esp, 4
mov dword [esp + 0x2c], eax
xor ebp, ebp
cmp eax, ebp
mov dword [esp + 0x18], ebp
je 0x4a9909
push fcn.0042b8a0
push fcn.0042b8d0
push edi
lea ebp, [eax + 4]
push 0x18
push ebp
mov dword [eax], edi
call fcn.004ee664
test ebp, ebp
mov dword [esp + 0x18], 0xffffffff
mov dword [esi + 0x14], ebp
je 0x4a9960
mov al, byte [esi + 0x2a]
xor ebp, ebp
test al, al
jbe 0x4a9949
xor edi, edi
mov eax, dword [esp + 0x28]
mov ecx, dword [esi + 0xc]
push 1
push eax
push ebx
push ecx
mov ecx, dword [esi + 0x14]
add ecx, edi
call fcn.0042b810
test al, al
je 0x4a9960
movzx edx, byte [esi + 0x2a]
inc ebp
add edi, 0x18
cmp ebp, edx
jl 0x4a9923
mov al, 1
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
xor al, al
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 0x10

Function at 0x4c28f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
test esi, esi
mov dword [ecx], 0xffffffff
jbe 0x4c2933
mov edx, dword [esp + 8]
push ebx
push edi
lea esp, [esp]
mov eax, dword [ecx]
movzx ebx, byte [edx]
mov edi, eax
and edi, 0xff
xor edi, ebx
mov ebx, dword [edi*4 + 0x542250]
shr eax, 8
xor eax, ebx
inc edx
dec esi
mov dword [ecx], eax
jne 0x4c2910
pop edi
pop ebx
mov eax, dword [ecx]
not eax
mov dword [ecx], eax
xor eax, eax
pop esi
ret
Function at 0x4d5c50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x503e18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov edx, dword [esp + 0x30]
push esi
mov eax, edx
push edi
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], 0
mov byte [esp + 0xc], 0
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4d5c88
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x10]
call fcn.00401a30
mov esi, dword [esp + 0x34]
lea eax, [esp + 8]
push eax
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.004d56a0
lea ecx, [esp + 8]
push ecx
mov ecx, esi
mov edi, eax
call fcn.004d55e0
mov esi, eax
cmp dword [esp + 0x20], 0x10
jb 0x4d5cd8
mov edx, dword [esp + 0xc]
push edx
call fcn.004eda9f
add esp, 4
cmp esi, edi
je 0x4d5d3e
mov ecx, dword [esp + 0x3c]
and ecx, 0xfffffff
mov eax, dword [esi + 0x28]
and eax, 0xfffffff
cmp eax, ecx
je 0x4d5d51
mov al, byte [esi + 0x31]
test al, al
jne 0x4d5d3a
mov eax, dword [esi + 8]
mov dl, byte [eax + 0x31]
test dl, dl
jne 0x4d5d1d
mov esi, eax
mov eax, dword [esi]
mov dl, byte [eax + 0x31]
test dl, dl
jne 0x4d5d3a
mov edi, edi
mov esi, eax
mov eax, dword [esi]
mov dl, byte [eax + 0x31]
test dl, dl
je 0x4d5d10
jmp 0x4d5d3a
mov eax, dword [esi + 4]
mov dl, byte [eax + 0x31]
test dl, dl
jne 0x4d5d38
cmp esi, dword [eax + 8]
jne 0x4d5d38
mov esi, eax
mov eax, dword [eax + 4]
mov dl, byte [eax + 0x31]
test dl, dl
je 0x4d5d27
mov esi, eax
cmp esi, edi
jne 0x4d5ce6
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
mov eax, dword [esi + 0x2c]
mov ecx, dword [esp + 0x24]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x4d6f60
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x503f1b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb0
push ebx
push esi
mov esi, dword [esp + 0xc8]
push edi
push 1
push 0x1b6
push 0x21
mov ebx, ecx
push esi
lea ecx, [esp + 0x34]
call fcn.004d5ef0
mov eax, dword [esp + 0x84]
test eax, eax
mov dword [esp + 0xc4], 0
jne 0x4d6fbe
push esi
push 0x52bdf0
call fcn.004d7320
add esp, 8
push 2
push 0
lea ecx, [esp + 0x2c]
call fcn.004d5280
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 4]
test byte [esp + eax + 0x2c], 6
jne 0x4d6fef
mov ecx, dword [esp + eax + 0x4c]
mov edx, dword [ecx]
push 1
push 1
push 0
lea eax, [esp + 0x18]
push eax
call dword [edx + 0x20]
jmp 0x4d7016
mov ecx, dword [0x5307e4]
mov edx, dword [0x6b4fc8]
mov eax, dword [0x6b4fcc]
mov dword [esp + 0xc], ecx
mov ecx, dword [0x5843a0]
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
push 0
push 0
lea ecx, [esp + 0x2c]
lea edi, [edx + eax]
call fcn.004d5280
push edi
call fcn.004ec898
add esp, 4
mov esi, eax
push edi
push esi
lea ecx, [esp + 0x2c]
call fcn.004d54e0
mov ecx, edi
shr ecx, 2
xor eax, eax
test ecx, ecx
jle 0x4d705c
nop
xor dword [esi + eax*4], 0x425529ac
inc eax
cmp eax, ecx
jl 0x4d7050
push edi
push esi
mov ecx, ebx
call fcn.004d6a50
push esi
call fcn.004ede99
add esp, 4
lea ecx, [esp + 0x2c]
call fcn.0041b730
test eax, eax
pop edi
pop esi
pop ebx
jne 0x4d70a3
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx + 4]
mov eax, dword [esp + ecx + 0x20]
mov edx, dword [esp + ecx + 0x40]
lea ecx, [esp + ecx + 0x18]
or eax, 2
test edx, edx
jne 0x4d709b
or eax, 4
push 0
push eax
call fcn.004eca3c
lea ecx, [esp + 0x7c]
mov dword [esp + 0xb8], 0xffffffff
call fcn.004d6030
lea ecx, [esp + 0x7c]
mov dword [esp + 0x7c], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
call fcn.004ec952
mov ecx, dword [esp + 0xb0]
mov dword fs:[0], ecx
add esp, 0xbc
ret 4

Function at 0x4d72b0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
push str.Error__line__d__:__s
call fcn.004d7260
add esp, 0xc
push 0
call fcn.004ee40e
int3

Function at 0x4d72d0
Capabilities:
Terminate process

Disassembly:
mov eax, 0x1000
call fcn.004eeec0
mov ecx, dword [esp + 0x1008]
lea eax, [esp + 0x100c]
push eax
push ecx
lea edx, [esp + 8]
push edx
call fcn.004f180b
mov ecx, dword [esp + 0x1010]
lea eax, [esp + 0xc]
push eax
push ecx
push str.Error__line__d__:__s
call fcn.004d7260
add esp, 0x18
push 0
call fcn.004ee40e
int3

Function at 0x4d7320
Capabilities:
Terminate process

Disassembly:
mov eax, 0x1000
call fcn.004eeec0
mov ecx, dword [esp + 0x1004]
lea eax, [esp + 0x1008]
push eax
push ecx
lea edx, [esp + 8]
push edx
call fcn.004f180b
lea eax, [esp + 0xc]
push eax
push str.Error_:__s
call fcn.004d7260
add esp, 0x14
push 0
call fcn.004ee40e
int3
Function at 0x4d9c70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x4d9c7b
xor eax, eax
ret
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x18]
cmp edi, 8
not esi
jb 0x4d9d73
mov ebp, edi
shr ebp, 3
xor edx, edx
mov dl, byte [ecx]
mov eax, esi
shr eax, 8
sub edi, 8
xor edx, esi
and edx, 0xff
mov esi, dword [edx*4 + 0x52c598]
xor edx, edx
mov dl, byte [ecx + 1]
xor eax, esi
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x52c598]
xor edx, edx
mov dl, byte [ecx + 1]
shr eax, 8
xor eax, esi
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x52c598]
xor edx, edx
mov dl, byte [ecx + 1]
shr eax, 8
xor eax, esi
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x52c598]
xor edx, edx
mov dl, byte [ecx + 1]
shr eax, 8
xor eax, esi
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x52c598]
shr eax, 8
xor eax, esi
xor edx, edx
mov dl, byte [ecx + 1]
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x52c598]
shr eax, 8
xor eax, esi
xor edx, edx
mov dl, byte [ecx + 1]
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x52c598]
shr eax, 8
xor eax, esi
xor edx, edx
mov dl, byte [ecx + 1]
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x52c598]
shr eax, 8
xor eax, esi
inc ecx
dec ebp
mov esi, eax
jne 0x4d9c96
test edi, edi
je 0x4d9d92
xor eax, eax
mov al, byte [ecx]
xor eax, esi
and eax, 0xff
mov ebp, dword [eax*4 + 0x52c598]
shr esi, 8
xor esi, ebp
inc ecx
dec edi
jne 0x4d9d77
pop edi
mov eax, esi
pop esi
not eax
pop ebp
ret

Function at 0x4dee20
Capabilities:
Terminate process

Disassembly:
push esi
push 0x28
call fcn.004f0592
mov esi, eax
add esp, 4
test esi, esi
jne 0x4dee3b
mov eax, str.out_of_dynamic_memory_in_yy_create_buffer__
jmp 0x4dedb0
mov eax, dword [esp + 0xc]
mov dword [esi + 0xc], eax
add eax, 2
push eax
call fcn.004f0592
add esp, 4
test eax, eax
mov dword [esi + 4], eax
jne 0x4dee5f
mov eax, str.out_of_dynamic_memory_in_yy_create_buffer__
jmp 0x4dedb0
mov eax, dword [esp + 8]
push eax
push esi
mov dword [esi + 0x14], 1
call fcn.004dedd0
add esp, 8
mov eax, esi
pop esi
ret
Function at 0x4ee34b
Capabilities:
Terminate process

Disassembly:
push 8
push 0x530a80
call fcn.004f4080
push 8
call fcn.004f3548
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x6b51d4], esi
jne 0x4ee37f
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x6b51d0], esi
mov al, byte [ebp + 0x10]
mov byte [0x6b51cc], al
cmp dword [ebp + 0xc], edi
jne 0x4ee3c9
cmp dword [0x6b6e10], edi
je 0x4ee3b9
mov eax, dword [0x6b6e0c]
sub eax, 4
mov dword [0x6b6e0c], eax
cmp eax, dword [0x6b6e10]
jb 0x4ee3b9
mov eax, dword [eax]
cmp eax, edi
je 0x4ee39a
call eax
jmp 0x4ee39a
push 0x5400e8
mov eax, 0x5400e0
call fcn.004ee2c9
pop ecx
push 0x5400f4
mov eax, 0x5400ec
call fcn.004ee2c9
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x4ee3fa
cmp dword [ebp + 0x10], edi
jne 0x4ee408
mov dword [0x6b51d4], esi
push dword [ebp + 8]
call fcn.004ee287
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x4ee407
push 8
call fcn.004f3493
pop ecx
ret
call fcn.004f40bb
ret

Function at 0x4effd7
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x4efff4
call fcn.004f1786
mov dword [eax], 0x16
xor eax, eax
jmp 0x4f005e
push esi
push 0x8c
push 1
call fcn.004f1b85
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4f0049
push esi
call fcn.004f4c45
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x4f0027
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x4eff42
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x4f005d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.004f011d
test ebx, ebx
pop ecx
je 0x4f005b
push ebx
call fcn.004f1798
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4f05a4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.004eeec0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4f063f
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x6b5194]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x4f063f
cmp eax, 1
je 0x4f0660
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4f063f
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x4f060c
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x4f063b
xor eax, eax
inc eax
jmp 0x4f067f
cmp edi, eax
jae 0x4f0643
xor eax, eax
jmp 0x4f067f
cmp eax, esi
jae 0x4f064a
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x6b5194]
jmp 0x4f0663
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4f5593
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x6b537c], ebx
push esi
push edi
jne 0x4f5613
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4f564e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5317ec
push edi
call esi
test eax, eax
mov dword [0x6b537c], eax
je 0x4f564e
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x6b5380], eax
call esi
cmp dword [0x6b5194], 2
mov dword [0x6b5384], eax
jne 0x4f5613
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x6b538c], eax
je 0x4f5613
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x6b5388], eax
mov eax, dword [0x6b5388]
test eax, eax
je 0x4f5658
call eax
test eax, eax
je 0x4f563f
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x6b538c]
test eax, eax
je 0x4f563f
test byte [ebp - 8], 1
jne 0x4f5658
cmp dword [0x6b51a0], 4
jb 0x4f5652
or byte [ebp + 0x12], 0x20
jmp 0x4f5677
xor eax, eax
jmp 0x4f5687
or byte [ebp + 0x12], 4
jmp 0x4f5677
mov eax, dword [0x6b5380]
test eax, eax
je 0x4f5677
call eax
mov ebx, eax
test ebx, ebx
je 0x4f5677
mov eax, dword [0x6b5384]
test eax, eax
je 0x4f5677
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x6b537c]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4f5758
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x543fcc]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x544770]
je 0x4f578d
inc eax
cmp eax, 0x13
jb 0x4f577e
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x544770]
jne 0x4f58b3
mov eax, dword [0x6b51e4]
cmp eax, 1
je 0x4f588b
cmp eax, edx
jne 0x4f57bd
cmp dword [0x543fb4], 1
je 0x4f588b
cmp ecx, 0xfc
je 0x4f58b3
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4f57f3
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.004f1d60
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.004f1c40
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4f5827
mov eax, edi
push eax
call fcn.004f1c40
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x530ac4
push edi
call fcn.004ee030
add esp, 0x10
push edi
call fcn.004f1c40
push dword [esi + 0x544774]
mov ebx, eax
call fcn.004f1c40
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.004eeec0
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.004f1d60
push edi
push ebx
call fcn.004f1d70
push 0x530ac0
push ebx
call fcn.004f1d70
push dword [esi + 0x544774]
push ebx
call fcn.004f1d70
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.004f5593
add esp, 0x2c
jmp 0x4f58b3
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x544774]
push dword [esi]
call fcn.004f1c40
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.004eee51
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x4f6cee
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x543fcc]
push edi
xor edi, edi
cmp dword [ebp + 0x3b0], edi
mov dword [ebp + 0x39c], eax
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], edi
jne 0x4f6d1f
xor eax, eax
jmp 0x4f6ea8
mov eax, dword [ebp + 0x3a8]
push ebx
mov ebx, dword [ebp + 0x3a8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x6b5ce0]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x4f6d5b
push 2
push edi
push edi
push dword [ebp + 0x3a8]
call fcn.004fdd08
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x4f6e36
cmp dword [ebp + 0x3b0], edi
mov eax, dword [ebp + 0x3ac]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x6c], edi
jbe 0x4f6e74
mov ecx, dword [ebp - 0x74]
sub ecx, dword [ebp + 0x3ac]
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], edi
cmp ecx, dword [ebp + 0x3b0]
jae 0x4f6dbf
mov edx, dword [ebp - 0x74]
inc dword [ebp - 0x74]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x4f6db0
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x70]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], 0x400
jl 0x4f6d90
mov edi, eax
lea eax, [ebp - 0x68]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4f6dff
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x78], eax
cmp eax, edi
jl 0x4f6e08
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp + 0x3ac]
xor edi, edi
cmp eax, dword [ebp + 0x3b0]
jb 0x4f6d81
jmp 0x4f6e0a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
xor edi, edi
mov eax, dword [ebp - 0x78]
cmp eax, edi
jne 0x4f6ea3
cmp dword [ebp - 0x6c], edi
je 0x4f6e74
push 5
pop esi
cmp dword [ebp - 0x6c], esi
jne 0x4f6e69
call fcn.004f1786
mov dword [eax], 9
call fcn.004f178f
mov dword [eax], esi
jmp 0x4f6e9e
push edi
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b0]
push dword [ebp + 0x3ac]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4f6e5e
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x78], eax
jmp 0x4f6e0a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
jmp 0x4f6e0a
push dword [ebp - 0x6c]
call fcn.004f1798
pop ecx
jmp 0x4f6e9e
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x4f6e8c
mov eax, dword [ebp + 0x3ac]
cmp byte [eax], 0x1a
jne 0x4f6e8c
xor eax, eax
jmp 0x4f6ea6
call fcn.004f1786
mov dword [eax], 0x1c
call fcn.004f178f
mov dword [eax], edi
or eax, 0xffffffff
jmp 0x4f6ea6
sub eax, dword [ebp - 0x7c]
pop esi
pop ebx
mov ecx, dword [ebp + 0x39c]
pop edi
call fcn.004eee51
add ebp, 0x3a0
leave
ret