joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44eb7e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov ebx, ecx
push edi
lea edi, [ebp - 0xc]
mov esi, dword [ebx + 0x70]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 8]
mov eax, esi
sub eax, 9
je 0x44ec14
sub eax, 1
je 0x44ebf6
sub eax, 3
je 0x44ebf6
test dword [ebx + 0x4c0], 0x2000
je 0x44ebcc
push esi
call fcn.0049a4af
pop ecx
test eax, eax
jne 0x44ebcc
cmp esi, 0x2d
je 0x44ebcc
cmp esi, 0x2e
je 0x44ebcc
cmp esi, 0x2c
jne 0x44ec49
mov ecx, dword [ebx + 0x4c0]
test cl, 8
je 0x44ebe4
lea eax, [esi - 0x61]
cmp eax, 0x19
ja 0x44ebe4
add esi, 0xffffffe0
jmp 0x44ec32
test cl, 0x10
je 0x44ec2f
lea eax, [esi - 0x41]
cmp eax, 0x19
ja 0x44ec2f
add esi, 0x20
jmp 0x44ec32
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x44ec2f
test dword [ebx + 0x4c0], 0x1000
jmp 0x44ec2d
test byte [ebx + 0x4c4], 0x80
jne 0x44ec2f
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x44ec49
mov esi, dword [ebp - 8]
mov eax, dword [ebx + 0x4d8]
push 0
push dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push esi
push dword [ebp - 0xc]
mov eax, dword [ecx]
call dword [eax + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x44ef56
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x30
mov eax, 0x4d00e1
call fcn.00479097
mov esi, ecx
mov edx, esi
lea eax, [esi + 8]
neg edx
lea ecx, [ebp - 0x3c]
sbb edx, edx
and edx, eax
push edx
call fcn.00407845
mov dword [ebp - 0x3c], 0x4e90e4
mov eax, dword [ebp + 0x10]
lea edi, [esi + 8]
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x3c]
and dword [ebp - 4], 0
and dword [ebp - 0x14], 0
mov dword [ebp - 0x18], eax
mov eax, dword [edi]
push ecx
push edi
mov dword [ebp - 0x1c], ebx
call dword [eax + 0x1f4]
cmp dword [ebp - 0x14], 0
jne 0x44efcc
cmp ebx, 0xd
jne 0x44efd7
test dword [esi + 0x4c0], 0x1000
jne 0x44efd7
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x44efd7
push 0
mov ecx, edi
call fcn.0040e9d2
jmp 0x44eff2
mov eax, dword [esi + 0x4d8]
push 0
mov ecx, dword [eax + 0xc]
mov eax, dword [esi + 0x70]
mov edx, dword [ecx]
push dword [eax + 8]
push dword [eax + 4]
push dword [eax]
call dword [edx + 0xc]
lea ecx, [ebp - 0x3c]
call fcn.00407d36
call fcn.00479052
ret 0xc
Function at 0x4521ce
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x28
mov eax, 0x4cffde
call fcn.00479063
mov dword [ebp - 0x10], ecx
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call esi
push 0x11
mov edi, eax
call esi
mov ebx, eax
push 0x10
and ebx, 0x8000
call esi
and eax, 0x8000
and edi, 0x8000
jne 0x45221e
test ebx, ebx
jne 0x452212
test eax, eax
je 0x452244
push 4
jmp 0x452243
test eax, eax
jne 0x45221a
push 2
jmp 0x452243
push 6
jmp 0x452243
test ebx, ebx
jne 0x45222d
test eax, eax
jne 0x452229
inc eax
jmp 0x452244
test ebx, ebx
je 0x452239
test eax, eax
jne 0x452235
push 3
jmp 0x452243
test ebx, ebx
jne 0x452241
test eax, eax
je 0x452241
push 5
jmp 0x452243
push 7
pop eax
mov ebx, dword [ebp - 0x10]
cmp ax, word [ebx + 0x260]
jne 0x452257
mov ax, word [ebx + 0x262]
lea esi, [ebx + 4]
mov word [ebx + 0x25c], ax
push esi
lea ecx, [ebp - 0x34]
call fcn.00407845
mov dword [ebp - 0x34], 0x4ea814
mov ax, word [ebx + 0x25c]
lea ecx, [ebp - 0x34]
and dword [ebp - 4], 0
mov word [ebp - 0x12], ax
mov ax, word [ebx + 0x25e]
mov word [ebp - 0x14], ax
mov eax, dword [esi]
push ecx
push esi
call dword [eax + 0x1f4]
lea ecx, [ebp - 0x34]
call fcn.00407d36
call fcn.0047903d
ret
Function at 0x453bb9
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0x18
mov eax, 0x4d0b47
call fcn.00479063
mov esi, ecx
mov edi, dword [ebp + 8]
movzx eax, di
cmp eax, 0x25
jb 0x453c2a
cmp eax, 0x26
jbe 0x453bff
cmp eax, 0x28
ja 0x453c2a
mov eax, dword [esi]
push esi
call dword [eax + 0x10]
mov ecx, dword [esi]
push esi
lea edi, [eax + 1]
call dword [ecx + 0x14]
cmp edi, eax
jge 0x453d1b
mov ecx, dword [esi]
push edi
push esi
call dword [ecx + 0x18]
jmp 0x453d1b
mov eax, dword [esi]
push esi
call dword [eax + 0x10]
mov ecx, dword [esi]
push esi
lea edi, [eax - 1]
call dword [ecx + 0x14]
cmp edi, eax
jge 0x453d1b
test edi, edi
js 0x453d1b
mov eax, dword [esi]
push edi
push esi
call dword [eax + 0x18]
jmp 0x453d1b
push eax
call fcn.0049a4e0
pop ecx
test eax, eax
je 0x453d1b
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
sub eax, dword [esi + 0x2cc]
cmp eax, 0x12c
jbe 0x453c5a
lea eax, [esi + 0x2c0]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
call ebx
lea ecx, [esi + 0x2c0]
mov dword [esi + 0x2cc], eax
push edi
call fcn.0040498b
mov eax, dword [esi]
push esi
call dword [eax + 0x10]
mov ecx, dword [esi]
mov ebx, eax
push esi
lea edi, [ebx + 1]
call dword [ecx + 0x14]
jmp 0x453cbb
push 0
push edi
lea eax, [ebp - 0x18]
mov ecx, esi
push eax
call fcn.00453626
and dword [ebp - 4], 0
lea eax, [esi + 0x2c0]
push 1
push eax
lea ecx, [ebp - 0x18]
call fcn.0040576a
test al, al
jne 0x453d00
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
inc edi
call fcn.00404820
mov eax, dword [esi]
push esi
call dword [eax + 0x14]
cmp edi, eax
jl 0x453c81
xor edi, edi
test ebx, ebx
js 0x453d1b
push 0
push edi
lea eax, [ebp - 0x24]
mov ecx, esi
push eax
call fcn.00453626
xor eax, eax
lea ecx, [ebp - 0x24]
inc eax
push eax
mov dword [ebp - 4], eax
lea eax, [esi + 0x2c0]
push eax
call fcn.0040576a
test al, al
jne 0x453d0c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
inc edi
call fcn.00404820
cmp edi, ebx
jle 0x453cc5
jmp 0x453d1b
mov eax, dword [esi]
push edi
push esi
call dword [eax + 0x18]
lea ecx, [ebp - 0x18]
jmp 0x453d16
mov eax, dword [esi]
push edi
push esi
call dword [eax + 0x18]
lea ecx, [ebp - 0x24]
call fcn.00404820
call fcn.0047903d
ret 0xc

Function at 0x46ddba
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x4ea7e4
push dword [ebp + 8]
call fcn.0049e2be
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x46de17
push ebx
push edi
push esi
call fcn.0049e575
push eax
call fcn.0049e6b3
mov edi, eax
pop ecx
pop ecx
cmp edi, dword [ebp + 0x10]
jbe 0x46ddf6
push 0x7a
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
jmp 0x46de0c
push esi
push edi
push 1
push dword [ebp + 0xc]
call fcn.0049e4bb
xor ebx, ebx
add esp, 0x10
cmp edi, eax
sete bl
push esi
call fcn.00498baf
pop ecx
pop edi
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
Function at 0x46de6e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov ecx, esi
push dword [ebp + 0xc]
call fcn.0046e993
mov ebx, eax
test ebx, ebx
je 0x46dee0
push edi
push ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x46dec4
cmp dword [ebp + 0x18], edi
jae 0x46dea9
push 0x7a
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x46dec4
push ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x46dec4
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
jne 0x46dec8
xor eax, eax
jmp 0x46dedf
push edi
push eax
push dword [ebp + 0x14]
call fcn.0048c590
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x14

Function at 0x46dff3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x140
mov eax, 0x4d1fc2
call fcn.00479097
mov edi, ecx
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x128], 0
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
test eax, eax
jne 0x46e092
push 0x4d5188
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x140]
push eax
call fcn.0042b0e3
and dword [ebp - 4], 0
push ebx
push eax
lea eax, [ebp - 0x124]
push eax
call fcn.0042b0e3
lea ecx, [ebp - 0x140]
mov byte [ebp - 4], 2
call fcn.00404820
lea ecx, [ebp - 0x124]
call fcn.004037ba
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x46e069
test al, 0x20
jne 0x46e079
push 0x4d3710
lea ecx, [ebp - 0x124]
call fcn.004048e0
lea eax, [ebp - 0x124]
mov ecx, esi
push eax
call fcn.004045f3
lea ecx, [ebp - 0x124]
jmp 0x46e115
push ebx
push eax
lea ecx, [ebp - 0x118]
call fcn.0046d836
lea eax, [ebp - 0x118]
push eax
lea ecx, [edi + 0x14]
call fcn.0046e973
mov ebx, eax
test ebx, ebx
jne 0x46e0c2
push 0x4d3710
mov ecx, esi
call fcn.0040462d
jmp 0x46e11a
push 0x4d5188
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x14c]
push eax
call fcn.0042b0e3
lea ecx, [ebx + 0x108]
mov dword [ebp - 4], 3
push ecx
push eax
lea eax, [ebp - 0x134]
push eax
call fcn.0046d9cc
lea ecx, [ebp - 0x14c]
mov byte [ebp - 4], 5
call fcn.00404820
lea eax, [ebp - 0x134]
mov ecx, esi
push eax
call fcn.004045f3
lea ecx, [ebp - 0x134]
call fcn.00404820
mov eax, esi
call fcn.00479052
ret 0xc
Function at 0x46ec5f
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0x288
mov eax, 0x4d2042
call fcn.00479097
mov ebx, ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x288]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x270], eax
call fcn.0040470e
and dword [ebp - 4], 0
lea eax, [ebx + 8]
test edi, edi
je 0x46ecf4
push 0x4d5188
push eax
lea eax, [ebp - 0x27c]
push eax
call fcn.0042b0e3
push edi
push eax
lea eax, [ebp - 0x294]
mov byte [ebp - 4], 1
push eax
call fcn.0042b0e3
push str..
push eax
lea eax, [ebp - 0x26c]
mov byte [ebp - 4], 2
push eax
call fcn.0042b0e3
push eax
lea ecx, [ebp - 0x288]
mov byte [ebp - 4], 3
call fcn.00404879
lea ecx, [ebp - 0x26c]
call fcn.00404820
lea ecx, [ebp - 0x294]
call fcn.00404820
jmp 0x46ed16
push str..
push eax
lea eax, [ebp - 0x27c]
push eax
call fcn.0042b0e3
push eax
lea ecx, [ebp - 0x288]
mov byte [ebp - 4], 4
call fcn.00404879
lea ecx, [ebp - 0x27c]
mov byte [ebp - 4], 0
call fcn.00404820
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.0040434e
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x46ee79
lea ecx, [ebp - 0x26c]
call fcn.0040470e
mov byte [ebp - 4], 5
test edi, edi
jne 0x46ed71
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x26c]
call fcn.004048e0
jmp 0x46edc7
lea ecx, [ebp - 0x294]
call fcn.0040470e
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 6
push ecx
push edi
push str._s_s
lea ecx, [ebp - 0x27c]
push ecx
push eax
call fcn.00404f7e
add esp, 0x14
push eax
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 7
call fcn.00404879
lea ecx, [ebp - 0x27c]
call fcn.00404820
lea ecx, [ebp - 0x294]
mov byte [ebp - 4], 5
call fcn.00404820
test byte [ebp - 0x260], 0x10
je 0x46ee1d
lea eax, [ebp - 0x234]
push 0x4f30f0
push eax
call fcn.0049ae2f
pop ecx
pop ecx
test eax, eax
je 0x46ee40
lea eax, [ebp - 0x234]
push 0x4f30f4
push eax
call fcn.0049ae2f
pop ecx
pop ecx
test eax, eax
je 0x46ee40
push dword [ebp + 0x10]
lea eax, [ebp - 0x26c]
push dword [ebp - 0x270]
push eax
call fcn.0040434e
push eax
mov ecx, ebx
call fcn.0046ec5f
jmp 0x46ee40
test byte [ebp - 0x260], 0xa1
je 0x46ee40
push dword [ebp + 0x10]
lea eax, [ebp - 0x26c]
push eax
call fcn.0040434e
push eax
call dword [ebp - 0x270]
test eax, eax
je 0x46ee67
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 0
call fcn.00404820
lea eax, [ebp - 0x260]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x46ed4a
jmp 0x46ee72
lea ecx, [ebp - 0x26c]
call fcn.00404820
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x288]
call fcn.00404820
call fcn.00479052
ret 0xc
Function at 0x475056
Capabilities:
Log keystrokes
Parse credit card information

Disassembly:
push 0x10
mov eax, 0x4d277c
call fcn.00479063
xor esi, esi
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
mov ecx, edi
mov dword [ebp - 4], esi
call fcn.0040470e
mov ecx, dword [ebp + 0xc]
movzx edx, cx
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], 1
cmp edx, 0x25
ja 0x475104
je 0x4750fa
mov eax, edx
sub eax, 0xd
je 0x4750f0
sub eax, 0xe
je 0x4750e6
sub eax, 5
je 0x4750dc
sub eax, 1
je 0x4750d2
sub eax, 1
je 0x4750c8
sub eax, 1
je 0x4750be
sub eax, 1
jne 0x47513d
push str.Home
jmp 0x475242
push 0x4f4d64
jmp 0x475242
push str.PageDown
jmp 0x475242
push str.PageUp
jmp 0x475242
push str.Space
jmp 0x475242
push 0x4f4d18
jmp 0x475242
push 0x4f4d20
jmp 0x475242
push str.Left
jmp 0x475242
mov eax, edx
sub eax, 0x26
je 0x47523d
sub eax, 1
je 0x475236
sub eax, 1
je 0x47522f
dec eax
sub eax, 1
je 0x475228
sub eax, 3
je 0x475221
sub eax, 1
je 0x47521a
cmp cx, 0x30
jb 0x475149
cmp cx, 0x39
jbe 0x475152
lea eax, [ecx - 0x41]
cmp ax, 0x19
ja 0x47515f
push ecx
mov ecx, edi
call fcn.0040491d
jmp 0x475249
lea eax, [ecx - 0x60]
cmp ax, 9
ja 0x475173
lea eax, [edx - 0x60]
push eax
push str.Num__d
jmp 0x4751b5
cmp cx, 0x6a
jne 0x475183
push 0x4f4dd8
jmp 0x475242
cmp cx, 0x6b
jne 0x475193
push str.Num_
jmp 0x475242
cmp cx, 0x6e
jne 0x4751a3
push str.Num_Del
jmp 0x475242
lea eax, [ecx - 0x70]
cmp ax, 0xb
ja 0x4751d3
lea eax, [edx - 0x6f]
push eax
push 0x4f4e00
lea eax, [ebp - 0x1c]
push eax
push edi
call fcn.00404f7e
add esp, 0x10
mov esi, eax
push 3
pop ecx
rep lodsd eax, dword [esi]
lea ecx, [ebp - 0x1c]
call fcn.00404820
jmp 0x475249
push 2
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
movsx ecx, al
cmp ecx, 0x3d
jg 0x4751fc
je 0x47520b
cmp ecx, 0x27
je 0x47520b
cmp ecx, 0x2b
jle 0x475249
cmp ecx, 0x2f
jle 0x47520b
cmp ecx, 0x3b
je 0x47520b
jmp 0x475249
cmp ecx, 0x5b
jl 0x475249
cmp ecx, 0x5d
jle 0x47520b
cmp ecx, 0x60
jne 0x475249
cbw
mov ecx, edi
movzx eax, ax
push eax
call fcn.0040498b
jmp 0x475249
push str.Delete
jmp 0x475242
push str.Insert
jmp 0x475242
push str.Print
jmp 0x475242
push str.Down
jmp 0x475242
push str.Right
jmp 0x475242
push 0x4f4d2c
mov ecx, edi
call fcn.004048e0
mov eax, edi
call fcn.0047903d
ret
Function at 0x48338a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 8]
and edi, 7
je 0x4833ae
cmp dword [esi + 8], edi
jge 0x4833a6
push esi
call fcn.0047e8e8
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
mov edx, dword [esi + 8]
xor ecx, ecx
test edx, edx
jle 0x4833d2
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x4833ba
mov dword [esi + 8], edx
cmp dword [esi + 8], 0
jge 0x4833e8
push str.zlib_corrupt
call fcn.0047e80b
pop ecx
jmp 0x48346e
cmp ecx, 4
jge 0x483408
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jb 0x4833f8
xor edx, edx
jmp 0x4833fe
movzx edx, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x4833ef
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
jne 0x4833d8
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x48343e
push str.read_past_buffer
jmp 0x4833dd
mov ecx, dword [esi + 0x10]
lea eax, [ecx + edi]
cmp eax, dword [esi + 0x18]
jbe 0x483458
push edi
push ecx
push esi
call fcn.00486827
add esp, 0xc
test eax, eax
je 0x48346e
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.0048c590
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret
Function at 0x486c9c
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
jne 0x486cb5
mov eax, 0x80070057
jmp 0x486e6b
push 0x4ea7dc
push dword [ebp + 0x18]
call fcn.0049e2be
mov edi, eax
mov dword [ebp - 0xc], edi
pop ecx
pop ecx
test edi, edi
jne 0x486cd7
mov eax, 0x80004005
jmp 0x486e6b
xor esi, esi
push esi
push esi
push esi
push str.1.5.19
call fcn.004b6c2f
add esp, 0x10
mov dword [ebp - 4], eax
test eax, eax
jne 0x486cf9
push edi
call fcn.00498baf
pop ecx
jmp 0x486ccd
push eax
call fcn.004b8a74
mov dword [ebp - 8], eax
pop ecx
test eax, eax
jne 0x486d1c
push edi
call fcn.00498baf
push esi
lea eax, [ebp - 4]
push eax
call fcn.004b6d7c
add esp, 0xc
jmp 0x486ccd
push 0x40
push 0x48f050
push dword [ebp - 4]
call fcn.004b7d11
push esi
push eax
call fcn.0048f070
add esp, 0x14
push dword [ebp - 0xc]
test eax, eax
je 0x486d47
call fcn.00498baf
lea eax, [ebp - 8]
push eax
jmp 0x486d0e
push dword [ebp - 4]
call fcn.004b91f1
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
push esi
push esi
push esi
push 6
push 8
push edi
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.004b95cd
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.004b7203
mov eax, ebx
imul eax, edi
shl eax, 2
push eax
call fcn.00478c05
add esp, 0x38
mov dword [ebp - 0x1c], eax
push 4
pop edx
test edi, edi
je 0x486e00
mov esi, dword [ebp + 0xc]
mov eax, edi
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0xff
test ebx, ebx
je 0x486df3
mov dword [ebp - 0x14], ebx
mov bl, byte [esi + 3]
xor edx, edx
movzx eax, byte [esi]
movzx ecx, bl
imul eax, ecx
push 4
div dword [ebp - 0x10]
xor edx, edx
mov byte [edi + 2], al
movzx eax, byte [esi + 1]
imul eax, ecx
div dword [ebp - 0x10]
xor edx, edx
mov byte [edi + 1], al
movzx eax, byte [esi + 2]
imul eax, ecx
mov ecx, 0xff
mov byte [edi + 3], bl
div ecx
pop edx
mov byte [edi], al
add esi, edx
add edi, edx
sub dword [ebp - 0x14], 1
jne 0x486da8
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x18]
sub eax, 1
mov dword [ebp - 0x18], eax
jne 0x486da1
mov edi, dword [ebp + 0x14]
xor esi, esi
cmp edi, 0x3fffffff
ja 0x486e74
xor ecx, ecx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00478c05
pop ecx
mov ecx, eax
mov dword [ebp - 0x18], ecx
test edi, edi
je 0x486e35
mov eax, dword [ebp - 0x1c]
shl ebx, 2
mov dword [ecx + esi*4], eax
inc esi
add eax, ebx
cmp esi, edi
jb 0x486e2b
push ecx
push dword [ebp - 4]
call fcn.004b71a4
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.004b6f85
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
call fcn.004b6d7c
push dword [ebp - 0x18]
call fcn.00478b19
push dword [ebp - 0xc]
call fcn.00498baf
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push str.Image_is_too_tall_to_process_in_memory
push dword [ebp - 4]
call fcn.004b79db
int3
Function at 0x4a47d1
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004a4647

Function at 0x4b155f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4b1574
mov eax, dword [esi]
and eax, 0xf
jmp 0x4b1576
xor eax, eax
cmp eax, 1
jb 0x4b1687
cmp eax, 5
ja 0x4b1687
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
cmp eax, 1
jbe 0x4b163d
push edi
lea ecx, [ebp + 0xc]
call fcn.004b2bba
push eax
push ebx
call fcn.004b172e
add esp, 0xc
lea ecx, [ebp + 0xc]
push edi
call fcn.004b6455
push eax
push ebx
call fcn.004b172e
add esp, 0xc
lea eax, [ebp - 0xc]
lea ecx, [ebp + 0xc]
push eax
call fcn.004b1d0d
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0xc]
and dword [ebp - 0x14], 0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
call fcn.004b0d65
test al, al
je 0x4b162e
and dword [ebp - 0x14], 0
mov esi, dword [ebp - 0xc]
push edi
lea ecx, [ebp - 0xc]
call fcn.004b2bba
push eax
push ebx
call fcn.004b172e
add esp, 0xc
lea ecx, [ebp - 0xc]
push edi
call fcn.004b6455
push eax
push ebx
call fcn.004b172e
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0xc]
mov esi, dword [esi + 0x14]
add esp, 0xc
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], esi
push eax
call fcn.004b0d65
test al, al
jne 0x4b15ec
push edi
push 0
push ebx
call fcn.004b172e
mov esi, dword [ebp + 0xc]
add esp, 0xc
test esi, esi
je 0x4b166a
mov esi, dword [esi + 0x14]
jmp 0x4b166c
mov al, byte [esi]
and al, 0xf
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push eax
call fcn.00498f96
push edi
push esi
push ebx
call fcn.004b155f
add esp, 0x1c
test esi, esi
je 0x4b166a
mov esi, dword [esi + 0x1c]
jmp 0x4b166c
xor esi, esi
push edi
push 1
push 1
test esi, esi
jne 0x4b1646
lea eax, [ebp - 2]
mov byte [ebp - 2], 0
push eax
call fcn.00498f96
add esp, 0x10
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4b168c
Capabilities:
Write file on windows

Disassembly:
push 0x44
mov eax, 0x4d2bbb
call fcn.00479097
mov esi, dword [ebp + 0xc]
lea ecx, [ebp - 0x50]
push 0xa
sub esp, 0xc
mov dword [esp + 8], 0x40100000
mov dword [esp + 4], 0x3e800000
mov dword [esp], 0x3f400000
push 0x11
call fcn.004b0bc4
and dword [ebp - 4], 0
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 8]
call fcn.004b1215
lea eax, [ebp - 0x50]
push eax
call fcn.004b1407
mov ecx, dword [ebp - 0x4c]
push esi
push 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push 1
push eax
mov dword [ebp - 0x20], 0x6c6d7873
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x18], ecx
call fcn.00498f96
lea eax, [ebp - 0x50]
push eax
push esi
call fcn.004b17bf
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x50]
push eax
call fcn.004b155f
add esp, 0x30
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], 1
call fcn.004b10d6
call fcn.00479052
ret
Function at 0x4b172e
Capabilities:
Write file on windows

Disassembly:
push 0x18
mov eax, 0x4d2b92
call fcn.00479063
mov esi, dword [ebp + 8]
push dword [esi + 4]
call fcn.004b2684
and dword [ebp + 8], 0
mov edi, eax
pop ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x24]
call fcn.0040462d
and dword [ebp - 4], 0
lea eax, [ebp - 0x24]
push 0xfde9
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004044cc
add esp, 0xc
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.00404820
lea eax, [ebp - 0x18]
push eax
call fcn.0040524d
test eax, eax
jne 0x4b179f
lea ecx, [ebp - 0x18]
call fcn.004037ba
push eax
mov ecx, esi
call fcn.004b0f08
mov eax, dword [eax + 0xc]
mov dword [ebp + 8], eax
push dword [ebp + 0x10]
lea eax, [ebp + 8]
push edi
push 1
push eax
call fcn.00498f96
add esp, 0x10
lea ecx, [ebp - 0x18]
call fcn.004036bd
call fcn.0047903d
ret

Function at 0x4b17bf
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push edi
call fcn.0042d5c9
mov edi, eax
test edi, edi
je 0x4b1800
push esi
mov ecx, dword [ebp + 0xc]
mov esi, edi
push edi
call fcn.0041a5a0
push dword [ebp + 8]
mov edi, eax
mov eax, dword [esi]
push esi
call dword [eax + 0xc]
inc eax
push eax
mov eax, dword [esi]
push 1
push esi
call dword [eax + 0x20]
push eax
call fcn.00498f96
add esp, 0x10
test edi, edi
jne 0x4b17d2
pop esi
pop edi
pop ebp
ret

Function at 0x4b2a51
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
cmp dword [ebp + 0x10], esi
jne 0x4b2a71
mov eax, dword [ebp + 8]
mov dword [eax], 1
mov dword [eax + 8], esi
mov dword [eax + 4], esi
jmp 0x4b2b2f
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push dword [ebp + 0x10]
call fcn.004b22ed
pop ecx
pop ecx
mov ecx, eax
test ecx, ecx
je 0x4b2a8f
mov eax, dword [ebp + 8]
mov dword [eax], ecx
jmp 0x4b2a66
push ebx
push edi
mov edi, dword [ebp - 4]
lea eax, [edi + 2]
push eax
call dword [0x527fcc]
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x4b2ab0
mov eax, dword [ebp + 8]
mov dword [eax], 3
jmp 0x4b2ad4
push dword [ebp + 0x10]
push edi
push 1
push ebx
call fcn.0049e4bb
add esp, 0x10
cmp eax, edi
je 0x4b2adc
push ebx
call dword [0x527fd0]
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], 2
mov dword [eax + 8], esi
mov dword [eax + 4], esi
jmp 0x4b2b2d
push edi
push ebx
push dword [ebp + 0x18]
call fcn.004b22bc
mov edx, eax
add esp, 0xc
cmp edx, 2
je 0x4b2afe
push 2
push edx
call fcn.004b2bcd
pop ecx
pop ecx
test al, al
je 0x4b2b0c
shr edi, 1
xor ecx, ecx
lea eax, [edi + edi]
mov word [eax + ebx], cx
lea edi, [eax + 2]
push dword [ebp + 0x1c]
push 1
push 1
push edx
push dword [ebp + 0x14]
push edi
push ebx
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004b28a0
mov eax, dword [ebp + 8]
add esp, 0x28
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret