joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45daa5
Capabilities:
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fbc
push ebx
push esi
push edi
push esi
push esi
add esp, 4
add esi, 0x89df
and esi, 0x5e35
add esi, 0x95b
or esi, 0xf79c
pop esi
push ebx
jmp 0x45dad6
or ebx, 0x7cdd
sub ebx, 0x7f71
pop ebx
mov eax, 0x4d
mov word [ebp - 0x1ef4], ax
mov ecx, 0x42
mov word [ebp - 0x1ef2], cx
mov edx, 0x53
mov word [ebp - 0x1ef0], dx
mov eax, 0x65
mov word [ebp - 0x1eee], ax
mov ecx, 0x72
mov word [ebp - 0x1eec], cx
mov edx, 0x76
mov word [ebp - 0x1eea], dx
mov eax, 0x69
mov word [ebp - 0x1ee8], ax
mov ecx, 0x63
mov word [ebp - 0x1ee6], cx
mov edx, 0x65
mov word [ebp - 0x1ee4], dx
mov eax, 0x2e
mov word [ebp - 0x1ee2], ax
mov ecx, 0x65
mov word [ebp - 0x1ee0], cx
mov edx, 0x78
mov word [ebp - 0x1ede], dx
mov eax, 0x65
mov word [ebp - 0x1edc], ax
xor ecx, ecx
mov word [ebp - 0x1eda], cx
mov dword [ebp - 0xfac], 1
push esi
push edx
add esp, 4
xor esi, 0x6b28
pop esi
push ebx
push esi
add esp, 4
xor ebx, 0x128ac
pop ebx
push eax
push ebx
add esp, 4
sub eax, 0x4211
and eax, 0x6d72
pop eax
push ecx
or ecx, 0xbd37
pop ecx
imul edx, dword [ebp - 0xfac], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0xfac], 0x138
sub edx, eax
xor edx, 0xabe912
imul edx, dword [ebp - 0xfac]
imul ecx, dword [ebp - 0xfac], 0x138
sub edx, ecx
mov dword [ebp - 0xfb0], edx
push edx
push edi
add esp, 4
and edx, 0x13ac2
and edx, 0x16190
pop edx
push esi
xor esi, 0x16ff3
or esi, 0x14f93
pop esi
push edi
push ebx
add esp, 4
sub edi, 0xb917
or edi, 0xca56
pop edi
mov dword [ebp - 0x10], 1
push ecx
jmp 0x45dc41
pop ecx
push edx
xor edx, 0x1d8
pop edx
push edi
and edi, 0x6fa6
jmp 0x45dc5a
jmp 0x45dc60
pop edi
push edi
jmp 0x45dc69
pop edi
imul edx, dword [ebp - 0x10], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x10], 0x138
sub edx, eax
xor edx, 0x153c
imul edx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10], 0x138
sub edx, ecx
mov dword [ebp - 0x14], edx
push esi
call fcn.0045dca3
add byte [esi], dh
xor bh, byte ss:[ecx]
inc esp

Function at 0x45dca3
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub esi, 0x77d4
call 0x45dcbc
add byte [eax + 0x3b], dl
xor al, 0x35
xor al, 0x4e
xor edi, dword [0xc4833c32]
add al, 0x5e
push edx
add edx, 0xe1ac
pop edx
push ebx
push edi
add esp, 4
or ebx, 0x1796
pop ebx
push edx
xor edx, 0x134f7
pop edx
push ecx
xor ecx, 0x1360a
jmp 0x45dceb
jmp 0x45dcf3
sub ecx, 0x4f53
pop ecx
mov dword [ebp - 0x2c], 1
push ebx
push edi
add esp, 4
and ebx, 0x1b98
add ebx, 0xd01d
pop ebx
push eax
push eax
add esp, 4
xor eax, 0x42da
and eax, 0x8b2c
jmp 0x45dd2c
xor eax, 0x12b7b
pop eax
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x45df14
Function at 0x45dcbc
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
sub esi, 0x77d4
call 0x45dcbc
add byte [eax + 0x3b], dl
xor al, 0x35
xor al, 0x4e
xor edi, dword [0xc4833c32]
add al, 0x5e
push edx
add edx, 0xe1ac
pop edx
push ebx
push edi
add esp, 4
or ebx, 0x1796
pop ebx
push edx
xor edx, 0x134f7
pop edx
push ecx
xor ecx, 0x1360a
jmp 0x45dceb
jmp 0x45dcf3
sub ecx, 0x4f53
pop ecx
mov dword [ebp - 0x2c], 1
push ebx
push edi
add esp, 4
and ebx, 0x1b98
add ebx, 0xd01d
pop ebx
push eax
push eax
add esp, 4
xor eax, 0x42da
and eax, 0x8b2c
jmp 0x45dd2c
xor eax, 0x12b7b
pop eax
imul edx, dword [ebp - 0x2c], 0x138
add edx, 0x44f3644b
imul eax, dword [ebp - 0x2c], 0x138
sub edx, eax
xor edx, 0
imul edx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c], 0x138
sub edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x45df14
Function at 0x4633cf
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or edi, 0x8b08
or edi, 0x5ce4
call 0x4633ed
add byte [eax + 0x48], dl
dec ebp
xor bh, byte [esi]
inc ebp
cmp bh, byte [esi]
add esp, 4
pop edi
mov ecx, dword [ebp - 0x4e4]
mov dword [ebp - 0x2a8], ecx
jmp 0x463467

Function at 0x4633ed
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
or edi, 0x8b08
or edi, 0x5ce4
call 0x4633ed
add byte [eax + 0x48], dl
dec ebp
xor bh, byte [esi]
inc ebp
cmp bh, byte [esi]
add esp, 4
pop edi
mov ecx, dword [ebp - 0x4e4]
mov dword [ebp - 0x2a8], ecx
jmp 0x463467
Function at 0x463661
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x463672
add byte [ebp + 0x34], cl
aaa
push eax
inc edi
inc esp
dec ebx
dec edx
add esp, 4
xor edx, 0x18100
or edx, 0xc3e4
pop edx
cmp dword [ebp - 0xc58], 0
jne 0x46369a
mov dword [ebp - 0x710], 0
jmp 0x4638e5
mov edx, dword [ebp - 0xc58]
mov dword [ebp - 0x4e8], edx

Function at 0x463672
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x463672
add byte [ebp + 0x34], cl
aaa
push eax
inc edi
inc esp
dec ebx
dec edx
add esp, 4
xor edx, 0x18100
or edx, 0xc3e4
pop edx
cmp dword [ebp - 0xc58], 0
jne 0x46369a
mov dword [ebp - 0x710], 0
jmp 0x4638e5
mov edx, dword [ebp - 0xc58]
mov dword [ebp - 0x4e8], edx
Function at 0x464117
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
mov ecx, dword [ebp - 0x2a8]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x304], edx
push eax
push edx
add esp, 4
jmp 0x464138
sub eax, 0x10189
pop eax
push ecx
push esi
add esp, 4
call 0x464152
add byte [eax + 0x35], cl
cmp eax, dword [edx + 0x3f]
inc esp
inc edi
inc ebp
add esp, 4
xor ecx, 0x8b78
pop ecx
mov dword [ebp - 0x730], 0
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x1580], eax
cmp dword [ebp - 0x1580], 0
jne 0x46418c
mov ecx, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], ecx
jmp 0x46447d
mov edx, dword [ebp - 0x1580]
mov eax, dword [ebp - 0x304]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1584], eax
jne 0x4641b4
mov ecx, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], ecx
jmp 0x46447d
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x1584]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x1588], edx
cmp dword [ebp - 0x1588], 0
jne 0x4641e6
mov eax, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], eax
jmp 0x46447d
mov ecx, dword [ebp - 0x304]
add ecx, dword [ebp - 0x1588]
mov dword [ebp - 0x724], ecx
jne 0x46420b
mov edx, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], edx
jmp 0x46447d
mov eax, dword [ebp - 0x724]
mov ecx, dword [ebp - 0x304]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x1900], ecx
mov edx, dword [ebp - 0x724]
mov eax, dword [ebp - 0x304]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x1904], eax
mov ecx, dword [ebp - 0x724]
mov edx, dword [ebp - 0x304]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x1908], edx
mov dword [ebp - 0x728], 0
jmp 0x464265
Function at 0x464152
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
mov ecx, dword [ebp - 0x2a8]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x304], edx
push eax
push edx
add esp, 4
jmp 0x464138
sub eax, 0x10189
pop eax
push ecx
push esi
add esp, 4
call 0x464152
add byte [eax + 0x35], cl
cmp eax, dword [edx + 0x3f]
inc esp
inc edi
inc ebp
add esp, 4
xor ecx, 0x8b78
pop ecx
mov dword [ebp - 0x730], 0
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x1580], eax
cmp dword [ebp - 0x1580], 0
jne 0x46418c
mov ecx, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], ecx
jmp 0x46447d
mov edx, dword [ebp - 0x1580]
mov eax, dword [ebp - 0x304]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1584], eax
jne 0x4641b4
mov ecx, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], ecx
jmp 0x46447d
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x1584]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x1588], edx
cmp dword [ebp - 0x1588], 0
jne 0x4641e6
mov eax, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], eax
jmp 0x46447d
mov ecx, dword [ebp - 0x304]
add ecx, dword [ebp - 0x1588]
mov dword [ebp - 0x724], ecx
jne 0x46420b
mov edx, dword [ebp - 0x730]
mov dword [ebp - 0x4f0], edx
jmp 0x46447d
mov eax, dword [ebp - 0x724]
mov ecx, dword [ebp - 0x304]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x1900], ecx
mov edx, dword [ebp - 0x724]
mov eax, dword [ebp - 0x304]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x1904], eax
mov ecx, dword [ebp - 0x724]
mov edx, dword [ebp - 0x304]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x1908], edx
mov dword [ebp - 0x728], 0
jmp 0x464265

Function at 0x46b2a0
Capabilities:
Encode data using xor

Disassembly:
inc ebp
xchg bh, al
pop es
test ah, ah
sahf
inc ebp
add eax, dword [ebx]
pop esp
push ebx
out dx, al
pop es
xor eax, 0x6ee404d
inc ebx
push ebx
push eax
pop ebx
xchg al, al
jae 0x46b2ad
add al, byte [edx]
add edi, dword [eax + 0x12]
retf 0x3788

Function at 0x480a80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d6a78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push esi
mov esi, ecx
mov eax, dword [esi + 0x68]
mov eax, dword [eax + 0x28]
mov ecx, dword [0x6d1f98]
push eax
push ecx
lea ecx, [esp + 0xc]
call fcn.0042fb50
mov edx, dword [esi + 0x6c]
mov ecx, dword [esi + 0x68]
lea eax, [esp + 4]
push eax
mov dword [esp + 0x48], 0
mov dword [esp + 0x30], edx
mov dword [esp + 0x10], ecx
call fcn.004246b0
lea ecx, [esp + 4]
mov dword [esp + 0x44], 0xffffffff
call fcn.004092b5
mov ecx, dword [esp + 0x3c]
pop esi
mov dword fs:[0], ecx
add esp, 0x44
ret
Function at 0x4bda53
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x50eea0
call fcn.004bd2c8
mov edi, 0x94
mov eax, edi
call fcn.004bc670
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x6e55e0], ecx
mov eax, dword [esi + 4]
mov dword [0x6e55ec], eax
mov edx, dword [esi + 8]
mov dword [0x6e55f0], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x6e55e4], esi
cmp ecx, 2
call fcn.0045daa5
add byte [eax], 0
mov dword [0x6e55e4], esi
shl eax, 8
add eax, edx
mov dword [0x6e55e8], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x4bdaee
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4bdaee
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x4bdb06
cmp eax, 0x20b
je 0x4bdaf3
mov dword [ebp - 0x1c], esi
jmp 0x4bdb1a
cmp dword [ecx + 0x84], 0xe
jbe 0x4bdaee
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x4bdb14
cmp dword [ecx + 0x74], 0xe
jbe 0x4bdaee
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.004c4822
pop ecx
test eax, eax
jne 0x4bdb2e
push 0x1c
call fcn.004bda2f
pop ecx
call fcn.004c3344
test eax, eax
jne 0x4bdb3f
push 0x10
call fcn.004bda2f
pop ecx
call fcn.004c3fdb
mov dword [ebp - 4], esi
call fcn.004c5396
test eax, eax
jge 0x4bdb58
push 0x1b
call fcn.004bda0a
pop ecx
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov dword [0x6e5e64], eax
call fcn.004c6961
mov dword [0x6e5630], eax
call fcn.004c68bf
test eax, eax
jge 0x4bdb7e
push 8
call fcn.004bda0a
pop ecx
call fcn.004c668c
test eax, eax
jge 0x4bdb8f
push 9
call fcn.004bda0a
pop ecx
push 1
call fcn.004bc203
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x4bdba5
push eax
call fcn.004bda0a
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
call fcn.004c662f
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x4bdbc6
movzx eax, word [ebp - 0x40]
jmp 0x4bdbc9
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.004070b2
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x4bdbe7
push edi
call fcn.004bc330
call fcn.004bc352
jmp 0x4bdc19
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.004bd303
ret
Function at 0x4c5c2a
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x4c5c58
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x4c5c5f
cmp ebx, dword [eax + 4]
jae 0x4c5c5f
xor eax, eax
jmp 0x4c5e4f
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x4c5c70
xor eax, eax
inc eax
jmp 0x4c5e4e
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x4c5c86
cmp ecx, edx
jae 0x4c5dcb
cmp dword [eax + 4], 0
je 0x4c5c8f
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x4c5c77
cmp dword [ebp + 8], 0
je 0x4c5cb1
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x4c5dcb
cmp eax, esi
jae 0x4c5dcb
mov eax, dword [0x6e57e0]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x4c5cd6
cmp dword [esi*4 + 0x6e57e8], edi
je 0x4c5dcf
inc esi
cmp esi, eax
jl 0x4c5cc4
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_VirtualQuery]
test eax, eax
je 0x4c5e4b
cmp dword [ebp - 8], 0x1000000
jne 0x4c5e4b
test byte [ebp - 0xc], 0xcc
je 0x4c5d54
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x4c5e4b
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x4c5e4b
cmp word [eax + 0x18], 0x10b
jne 0x4c5e4b
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x4c5e4b
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x4c5d54
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x4c5d54
test byte [ecx + 0x27], 0x80
jne 0x4c5dcb
push 1
push 0x6e5828
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
test eax, eax
jne 0x4c5c68
mov ecx, dword [0x6e57e0]
test ecx, ecx
mov edx, ecx
jle 0x4c5d88
lea eax, [ecx*4 + 0x6e57e4]
cmp dword [eax], edi
je 0x4c5d88
dec edx
sub eax, 4
test edx, edx
jg 0x4c5d7c
test edx, edx
jne 0x4c5db9
push 0xf
pop ebx
cmp ecx, ebx
jg 0x4c5d95
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x4c5dad
lea eax, [edx*4 + 0x6e57e8]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x4c5d9b
cmp ecx, 0x10
jge 0x4c5db9
inc ecx
mov dword [0x6e57e0], ecx
push 0
push 0x6e5828
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
jmp 0x4c5c68
xor eax, eax
jmp 0x4c5e4e
test esi, esi
jle 0x4c5c68
mov ebx, dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
push 1
push 0x6e5828
call ebx
test eax, eax
jne 0x4c5c68
cmp dword [esi*4 + 0x6e57e8], edi
je 0x4c5e25
mov eax, dword [0x6e57e0]
lea esi, [eax - 1]
test esi, esi
jl 0x4c5e13
cmp dword [esi*4 + 0x6e57e8], edi
je 0x4c5e0f
dec esi
jns 0x4c5e03
test esi, esi
jge 0x4c5e23
cmp eax, 0x10
jge 0x4c5e1e
inc eax
mov dword [0x6e57e0], eax
lea esi, [eax - 1]
jmp 0x4c5e25
je 0x4c5e3d
xor ecx, ecx
test esi, esi
jl 0x4c5e3d
lea eax, [ecx*4 + 0x6e57e8]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x4c5e2b
push 0
push 0x6e5828
call ebx
jmp 0x4c5c68
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4c631b
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x6cda48]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x6ce2d8]
je 0x4c6350
inc eax
cmp eax, 0x13
jb 0x4c6341
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x6ce2d8]
jne 0x4c6476
mov eax, dword [0x6e5638]
cmp eax, 1
je 0x4c644e
cmp eax, edx
jne 0x4c6380
cmp dword [0x6cdcf4], 1
je 0x4c644e
cmp ecx, 0xfc
je 0x4c6476
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
test eax, eax
jne 0x4c63b6
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.004bc410
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.004bba60
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4c63ea
mov eax, edi
push eax
call fcn.004bba60
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x506dd0
push edi
call fcn.004bc810
add esp, 0x10
push edi
call fcn.004bba60
push dword [esi + 0x6ce2dc]
mov ebx, eax
call fcn.004bba60
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.004bc670
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.004bc410
push edi
push ebx
call fcn.004bc420
push 0x50eff4
push ebx
call fcn.004bc420
push dword [esi + 0x6ce2dc]
push ebx
call fcn.004bc420
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.004c8324
add esp, 0x2c
jmp 0x4c6476
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x6ce2dc]
push dword [esi]
call fcn.004bba60
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.004bc19b
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x4c7fbe
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.004bc670
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_VirtualQuery]
test eax, eax
je 0x4c8059
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x6e55e0]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x4c8059
cmp eax, 1
je 0x4c807a
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_VirtualQuery]
test eax, eax
je 0x4c8059
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x4c8026
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x4c8055
xor eax, eax
inc eax
jmp 0x4c8099
cmp edi, eax
jae 0x4c805d
xor eax, eax
jmp 0x4c8099
cmp eax, esi
jae 0x4c8064
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov eax, dword [0x6e55e0]
jmp 0x4c807d
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4c8324
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x6e5a14], ebx
push esi
push edi
jne 0x4c83a4
push str.user32.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4c83df
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x51027c
push edi
call esi
test eax, eax
mov dword [0x6e5a14], eax
je 0x4c83df
push 0x51026c
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x6e5a18], eax
call esi
cmp dword [0x6e55e0], 2
mov dword [0x6e5a1c], eax
jne 0x4c83a4
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x6e5a24], eax
je 0x4c83a4
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x6e5a20], eax
mov eax, dword [0x6e5a20]
test eax, eax
je 0x4c83e9
call eax
test eax, eax
je 0x4c83d0
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x6e5a24]
test eax, eax
je 0x4c83d0
test byte [ebp - 8], 1
jne 0x4c83e9
cmp dword [0x6e55ec], 4
jb 0x4c83e3
or byte [ebp + 0x12], 0x20
jmp 0x4c8408
xor eax, eax
jmp 0x4c8418
or byte [ebp + 0x12], 4
jmp 0x4c8408
mov eax, dword [0x6e5a18]
test eax, eax
je 0x4c8408
call eax
mov ebx, eax
test ebx, ebx
je 0x4c8408
mov eax, dword [0x6e5a1c]
test eax, eax
je 0x4c8408
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x6e5a14]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4ca202
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.004bc670
mov eax, dword [0x6cda48]
push ebx
push esi
push 1
xor esi, esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.004c5594
or ebx, 0xffffffff
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0x1008], eax
je 0x4ca335
push 2
push esi
push dword [ebp + 8]
call fcn.004c5594
add esp, 0xc
cmp eax, ebx
je 0x4ca335
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x4ca2d5
mov ebx, 0x1000
push ebx
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.004bc3b0
push 0x8000
push dword [ebp + 8]
call fcn.004cc3aa
add esp, 0x14
mov dword [ebp - 0x100c], eax
cmp edi, ebx
mov eax, ebx
jge 0x4ca28b
mov eax, edi
push eax
lea eax, [ebp - 0x1004]
push eax
push dword [ebp + 8]
call fcn.004c0f23
add esp, 0xc
cmp eax, 0xffffffff
je 0x4ca2ab
sub edi, eax
test edi, edi
jg 0x4ca283
jmp 0x4ca2c3
call fcn.004bf71c
cmp dword [eax], 5
jne 0x4ca2c0
call fcn.004bf713
mov dword [eax], 0xd
or esi, 0xffffffff
push dword [ebp - 0x100c]
push dword [ebp + 8]
call fcn.004cc3aa
pop ecx
pop ecx
jmp 0x4ca31d
jge 0x4ca31d
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004c5594
push dword [ebp + 8]
call fcn.004c1b77
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.DLL_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, ebx
jne 0x4ca31d
call fcn.004bf713
mov dword [eax], 0xd
call fcn.004bf71c
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [edi], eax
push 0
push dword [ebp - 0x1008]
push dword [ebp + 8]
call fcn.004c5594
add esp, 0xc
mov eax, esi
pop edi
jmp 0x4ca337
mov eax, ebx
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.004bc19b
leave
ret