joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d850
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
mov ebp, ecx
cmp byte [ebp], 0
jne 0x45da1c
push esi
push 0
lea esi, [ebp + 0xc]
call fcn.004668c0
push eax
mov ecx, esi
call fcn.00468ca0
test al, al
jne 0x45da1b
push edi
mov ecx, esi
call fcn.0046ff60
mov eax, dword [ebp + 0x48]
test eax, eax
je 0x45d8ee
mov ecx, dword [esi]
cmp eax, ecx
jne 0x45d8ee
mov eax, dword [ecx]
call dword [eax + 8]
cmp dword [eax + 4], 1
jle 0x45d8b0
mov eax, dword [esi + 8]
shr eax, 1
test al, 1
jne 0x45d8b0
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x20]
movzx eax, ax
jmp 0x45d8b2
xor eax, eax
cmp word [ebp + 0x50], ax
jne 0x45d8ee
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 8]
cmp dword [eax + 4], 1
jle 0x45d8da
mov eax, dword [esi + 8]
shr eax, 1
test al, 1
jne 0x45d8da
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x24]
movzx eax, ax
jmp 0x45d8dc
xor eax, eax
cmp word [ebp + 0x52], ax
jne 0x45d8ee
mov eax, dword [ebp + 0x54]
cmp eax, dword [esi + 8]
je 0x45da1a
mov ecx, esi
call fcn.0046ff60
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 8]
cmp dword [eax + 4], 1
jle 0x45d917
mov eax, dword [esi + 8]
shr eax, 1
test al, 1
jne 0x45d917
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x20]
movzx eax, ax
jmp 0x45d919
xor eax, eax
push ebx
cmp word [ebp + 0x50], ax
jne 0x45d9c8
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 8]
cmp dword [eax + 4], 1
jle 0x45d946
mov eax, dword [esi + 8]
shr eax, 1
test al, 1
jne 0x45d946
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x24]
movzx eax, ax
jmp 0x45d948
xor eax, eax
cmp word [ebp + 0x52], ax
jne 0x45d9c8
mov ebx, dword [ebp + 0x48]
test ebx, ebx
je 0x45d9c8
mov ecx, esi
call fcn.0046ff60
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 8]
mov edx, dword [ebx]
mov ecx, ebx
mov dword [esp + 0x10], eax
call dword [edx + 8]
mov ebx, eax
mov eax, dword [esp + 0x10]
mov ecx, dword [ebx + 4]
mov edx, dword [eax + 4]
cmp ecx, edx
je 0x45d986
lea eax, [edx + ecx]
cmp eax, 1
jmp 0x45d9bd
cmp ecx, 1
jle 0x45d9c4
mov ecx, dword [eax]
mov eax, dword [ebx]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x45d9b6
test dx, dx
je 0x45d9b2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x45d9b6
add eax, 4
add ecx, 4
test dx, dx
jne 0x45d990
xor eax, eax
jmp 0x45d9bb
sbb eax, eax
or eax, 1
test eax, eax
sete al
test al, al
je 0x45d9c8
xor bl, bl
jmp 0x45d9ca
mov bl, 1
push esi
lea ecx, [esp + 0x18]
call fcn.004544c0
push eax
lea ecx, [ebp + 0x48]
call fcn.00456500
mov esi, dword [esp + 0x18]
test esi, esi
je 0x45da08
or edi, 0xffffffff
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x45da08
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], edi
dec edi
jne 0x45da08
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 4]
test bl, bl
pop ebx
je 0x45da1a
pop edi
pop esi
mov ecx, ebp
pop ebp
add esp, 0x14
jmp fcn.0045cba0
pop edi
pop esi
pop ebp
add esp, 0x14
ret
Function at 0x47eb30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push dword [0x6e1b5c]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x47eb8c
push esi
push 0x10
call fcn.0040cad0
mov esi, eax
add esp, 4
test esi, esi
je 0x47eb7a
push esi
push dword [0x6e1b5c]
mov byte [esi], 5
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, esi
pop esi
ret
xor esi, esi
push esi
push dword [0x6e1b5c]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, esi
pop esi
ret
Function at 0x484d00
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
mov edx, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
test esi, esi
je 0x484d23
lea eax, [esi - 1]
lea eax, [edx + eax*2]
cmp word [eax], 0x3d
jne 0x484d23
sub eax, 2
sub esi, 1
jne 0x484d15
mov eax, esi
and al, 3
cmp al, 1
je 0x484dde
mov ebx, dword [esp + 0x18]
cmp esi, 4
jb 0x484d88
xor eax, eax
xor edi, edi
nop dword [eax]
movzx ecx, word [edx]
add edx, 2
cmp ecx, 0x100
jae 0x484dde
mov cl, byte [ecx + 0x6290d8]
cmp cl, 0xff
je 0x484dde
shl eax, 6
inc edi
movzx ecx, cl
or eax, ecx
cmp edi, 4
jl 0x484d40
mov byte [ebx + 2], al
sub esi, 4
shr eax, 8
mov byte [ebx + 1], al
shr eax, 8
mov byte [ebx], al
add ebx, 3
cmp esi, 4
jae 0x484d38
test esi, esi
je 0x484dd8
xor ecx, ecx
xor edi, edi
movzx eax, word [edx]
lea edx, [edx + 2]
cmp eax, 0x100
jae 0x484dde
mov al, byte [eax + 0x6290d8]
cmp al, 0xff
je 0x484dde
shl ecx, 6
inc edi
movzx eax, al
or ecx, eax
cmp edi, esi
jb 0x484d90
cmp esi, 4
jge 0x484dc8
mov eax, 4
sub eax, esi
shl ecx, 6
sub eax, 1
jne 0x484dc0
shr ecx, 8
cmp esi, 3
jb 0x484dd3
mov byte [ebx + 1], cl
shr ecx, 8
mov byte [ebx], cl
pop edi
pop esi
mov al, 1
pop ebx
ret
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x486cf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0x80
mov dword [esi + 0x28], 0xffffffff
mov dword [esi + 0x2c], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov word [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0x80
mov dword [esi + 0x74], 0xffffffff
mov dword [esi + 0x78], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0x188f7
mov dword [esi + 0x8c], 0
mov dword [esi + 0x90], 0
mov dword [esi + 0x94], 0
mov dword [esi + 0x98], 0
mov dword [esi + 0x9c], 0
mov dword [esi + 0xa0], 0
mov dword [esi + 0xa4], 0
mov dword [esi + 0xa8], 0
mov dword [esi + 0xac], 0
mov dword [esi + 0xb0], 0
mov dword [esi + 0xb4], 0
mov dword [esi + 0xb8], 0
mov dword [esi + 0xbc], 0
mov dword [esi + 0xd0], 0
mov dword [esi + 0xd4], 0
mov dword [esi + 0xd8], 0x80
mov dword [esi + 0xdc], 0xffffffff
mov dword [esi + 0xe0], 0
mov dword [esi + 0xe8], 0
mov dword [esi + 0xec], 0
mov eax, dword [0x6abc9c]
mov ecx, dword [0x6abca0]
lea ecx, [eax + ecx*8]
cmp eax, ecx
je 0x486ea4
cmp dword [eax + 4], 0
je 0x486e8e
cmp dword [eax], 0
jne 0x486e99
add eax, 8
cmp eax, ecx
jne 0x486e83
mov eax, esi
pop esi
ret
push esi
mov ecx, 0x6abc9c
call fcn.0045b780
mov eax, esi
pop esi
ret
Function at 0x48def0
Capabilities:
Encode data using base64

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
mov eax, 0xaaaaaaab
push esi
mov esi, dword [esp + 0x18]
push edi
mov dword [ebp], 0
mov dword [ebp + 4], 0
lea ecx, [esi + 2]
mov dword [ebp + 8], 0
mul ecx
mov edi, edx
shr edi, 1
shl edi, 2
lea eax, [edi + 1]
cmp edi, 0xffffffff
jle 0x48df4d
push 0
mov ecx, ebp
mov dword [ebp + 4], eax
call fcn.0040cde0
lea eax, [edi*2 + 2]
push eax
push 0
push dword [ebp]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
jmp 0x48df59
jge 0x48df59
mov ecx, ebp
mov dword [ebp + 4], eax
call fcn.00412d40
mov eax, dword [ebp]
mov edi, eax
mov dword [esp + 0xc], eax
push ebx
mov ebx, dword [esp + 0x1c]
cmp esi, 3
jb 0x48dffa
mov eax, 0xaaaaaaab
mov ebp, esi
mul ebp
shr edx, 1
mov dword [esp + 0x20], edx
nop
mov al, byte [ebx]
sub ebp, 3
mov cl, byte [ebx + 1]
mov dl, byte [ebx + 2]
add ebx, 3
movzx esi, al
shl esi, 8
movzx eax, cl
or esi, eax
movzx eax, dl
shl esi, 8
or esi, eax
mov eax, esi
shr esi, 6
and eax, 0x3f
movzx eax, byte [eax + 0x629098]
mov word [edi + 6], ax
mov eax, esi
and eax, 0x3f
shr esi, 6
movzx eax, byte [eax + 0x629098]
mov word [edi + 4], ax
mov eax, esi
and eax, 0x3f
shr esi, 6
movzx eax, byte [eax + 0x629098]
mov word [edi + 2], ax
movzx eax, byte [esi + 0x629098]
mov word [edi], ax
add edi, 8
sub dword [esp + 0x20], 1
jne 0x48df80
mov dword [esp + 0x20], ebp
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
test esi, esi
je 0x48e05d
mov cl, byte [ebx]
xor al, al
cmp esi, 2
jne 0x48e00a
mov al, byte [ebx + 1]
movzx ecx, cl
mov edx, 0x3d
shl ecx, 8
movzx eax, al
or ecx, eax
mov word [edi + 6], dx
shl ecx, 2
cmp esi, 1
jne 0x48e02a
mov eax, edx
jmp 0x48e036
mov eax, ecx
and eax, 0x3f
movzx eax, byte [eax + 0x629098]
mov word [edi + 4], ax
shr ecx, 6
mov eax, ecx
shr ecx, 6
and eax, 0x3f
movzx eax, byte [eax + 0x629098]
mov word [edi + 2], ax
movzx eax, byte [ecx + 0x629098]
mov word [edi], ax
add edi, 8
xor eax, eax
mov word [edi], ax
mov ecx, dword [ebp + 4]
pop ebx
lea eax, [ecx - 1]
neg ecx
sbb ecx, ecx
sub edi, dword [esp + 0xc]
and eax, ecx
sar edi, 1
cdq
xor ecx, ecx
cmp edi, eax
jne 0x48e080
cmp ecx, edx
je 0x48e087
call fcn.0060bec0
nop
int3
pop edi
pop esi
mov eax, ebp
pop ebp
pop ecx
ret
Function at 0x4946d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0xc]
not ecx
push edi
mov edi, dword [esp + 0x14]
lea ebx, [esi + 3]
and ebx, 0xfffffffc
sub ebx, esi
cmp edi, ebx
jle 0x4947a5
sub edi, ebx
test ebx, ebx
je 0x49470f
movzx eax, byte [esi]
inc esi
movzx edx, cl
xor edx, eax
shr ecx, 8
xor ecx, dword [edx*4 + 0x6a94c8]
sub ebx, 1
jne 0x4946f7
mov eax, edi
cdq
and edx, 7
push ebp
lea ebp, [edx + eax]
sar ebp, 3
test ebp, ebp
je 0x494797
mov edx, dword [esi + 4]
mov eax, edx
mov ebx, dword [esi]
add esi, 8
shr eax, 0x10
xor ebx, ecx
movzx ecx, al
mov eax, edx
shr eax, 8
movzx eax, al
mov ecx, dword [ecx*4 + 0x6a98c8]
xor ecx, dword [eax*4 + 0x6a9cc8]
mov eax, ebx
shr eax, 0x10
movzx eax, al
xor ecx, dword [eax*4 + 0x6aa8c8]
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x6aacc8]
mov eax, edx
shr eax, 0x18
xor ecx, dword [eax*4 + 0x6a94c8]
mov eax, ebx
shr eax, 0x18
xor ecx, dword [eax*4 + 0x6aa4c8]
movzx eax, dl
xor ecx, dword [eax*4 + 0x6aa0c8]
movzx eax, bl
xor ecx, dword [eax*4 + 0x6ab0c8]
sub ebp, 1
jne 0x494720
and edi, 0x80000007
jns 0x4947a4
dec edi
or edi, 0xfffffff8
inc edi
pop ebp
test edi, edi
je 0x4947ca
nop dword [eax]
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx edx, cl
xor edx, eax
shr ecx, 8
xor ecx, dword [edx*4 + 0x6a94c8]
sub edi, 1
jne 0x4947b0
pop edi
not ecx
pop esi
mov eax, ecx
pop ebx
ret
Function at 0x49f160
Capabilities:
Hash data using sha1

Disassembly:
lea eax, [ecx + 0x80]
mov dword [ecx], 0x67452301
mov dword [ecx + 0xc0], eax
mov eax, ecx
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
ret

Function at 0x49f8c0
Capabilities:
Hash data using sha1

Disassembly:
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
ret
Function at 0x4a6510
Capabilities:
Hash data using sha1

Disassembly:
sub esp, 0xc8
mov eax, dword [0x6b66bc]
xor eax, esp
mov dword [esp + 0xc4], eax
mov eax, dword [esp + 0xcc]
lea ecx, [esp + 0x80]
push esi
push dword [esp + 0xd8]
mov esi, dword [esp + 0xe0]
push dword [esp + 0xd8]
mov dword [esp + 0xcc], ecx
lea ecx, [esp + 0xc]
push eax
mov dword [esp + 0x10], 0x67452301
mov dword [esp + 0x14], 0xefcdab89
mov dword [esp + 0x18], 0x98badcfe
mov dword [esp + 0x1c], 0x10325476
mov dword [esp + 0x20], 0xc3d2e1f0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call fcn.004b2b70
lea ecx, [esp + 4]
call fcn.004a3730
movups xmm0, xmmword [esp + 0x64]
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0xc8]
movups xmmword [esi], xmm0
mov dword [esi + 0x10], eax
pop esi
xor ecx, esp
call fcn.005f4480
add esp, 0xc8
ret
Function at 0x4afbc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
xor edx, edx
xor eax, eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
lea ecx, [edi + 0x94]
lock cmpxchg dword [ecx], edx
test eax, eax
jle 0x4afd4d
movsd xmm0, qword [0x6114a0]
lea ecx, [edi + 0x74]
mov eax, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movsd qword [esp + 0x20], xmm0
mov dword [esp + 0x14], eax
nop
mov esi, dword [ecx]
mov ebx, dword [edi + 0x78]
mov ecx, dword [edi + 0x64]
mov ebp, dword [ecx]
cmp ebx, esi
jl 0x4afc23
mov eax, ebx
sub eax, esi
cdq
push edx
push eax
mov eax, dword [edi + 0x68]
add eax, esi
push eax
call dword [ebp + 0xb4]
jmp 0x4afc4a
mov eax, dword [edi + 0x6c]
sub eax, esi
cdq
push edx
push eax
mov eax, dword [edi + 0x68]
add eax, esi
push eax
call dword [ebp + 0xb4]
mov ecx, dword [edi + 0x64]
mov eax, ebx
cdq
push edx
push eax
mov esi, dword [ecx]
push dword [edi + 0x68]
call dword [esi + 0xb4]
lea eax, [edi + 0x74]
xchg dword [eax], ebx
lea ebx, [edi + 0x94]
lock dec dword [ebx]
cmp dword [edi + 0x58], 0
mov ebp, dword [esp + 0x14]
je 0x4afce2
lea eax, [esp + 0x28]
push eax
call ebp
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
call fcn.005f4d10
mulsd xmm0, qword [0x6bf6e0]
addsd xmm0, qword [esp + 0x20]
subsd xmm0, qword [edi + 0x9c]
movsd qword [esp + 0x18], xmm0
call fcn.004a5c80
movsd xmm0, qword [esp + 0x18]
fstp qword [esp + 0x40]
comisd xmm0, xmmword [esp + 0x40]
jbe 0x4afce2
mov ecx, dword [edi + 0x64]
mov eax, dword [ecx]
call dword [eax + 0xe4]
lea eax, [esp + 0x30]
push eax
call ebp
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
call fcn.005f4d10
mulsd xmm0, qword [0x6bf6e0]
addsd xmm0, qword [esp + 0x20]
movsd qword [edi + 0x9c], xmm0
xor ecx, ecx
lea esi, [edi + 0x98]
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
jle 0x4afd3a
mov ecx, dword [edi + 0x64]
mov eax, dword [ecx]
call dword [eax + 0xe4]
lea eax, [esp + 0x38]
push eax
call ebp
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
call fcn.005f4d10
mulsd xmm0, qword [0x6bf6e0]
or eax, 0xffffffff
addsd xmm0, qword [esp + 0x20]
movsd qword [edi + 0x9c], xmm0
lock xadd dword [esi], eax
dec eax
jns 0x4afd3a
call fcn.0060c2d0
nop
int3
xor ecx, ecx
xor eax, eax
lock cmpxchg dword [ebx], ecx
lea ecx, [edi + 0x74]
test eax, eax
jg 0x4afc00
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bf360
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 8]
sub esp, 8
push esi
mov esi, ecx
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x2c], eax
mov eax, dword [esp + 0x18]
mov dword [esi + 0x30], eax
mov eax, dword [esp + 0x1c]
mov dword [esi], 0x631afc
mov dword [esi + 4], ecx
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], eax
test ecx, ecx
je 0x4bf3c7
cmp ecx, 0xffffffff
je 0x4bf3c7
lea eax, [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [esp + 4]
mov dword [esi + 0x24], eax
mov eax, dword [esp + 8]
mov dword [esi + 0x28], eax
xorps xmm0, xmm0
mov eax, esi
movups xmmword [esi + 8], xmm0
mov dword [esi + 0x18], 0
pop esi
add esp, 8
ret 0x10
Function at 0x4c24d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
call fcn.0041e840
mov dword [esp + 0xc], eax
call fcn.004cc0f0
mov edx, dword [edi]
mov dword [esp + 0x10], eax
xor eax, eax
mov edx, dword [edx]
mov word [edx], ax
mov edx, dword [edi]
mov esi, dword [edx]
mov ecx, esi
lea ebx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4c2500
sub ecx, ebx
sar ecx, 1
push ebp
lea ebp, [esi + ecx*2]
mov esi, dword [edi + 4]
mov ebx, esi
sub ebx, ecx
test ebx, ebx
jle 0x4c253c
lea eax, [ebx - 1]
push eax
push dword [esp + 0x14]
push ebp
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
add esp, 0xc
xor eax, eax
mov word [ebp + ebx*2 - 2], ax
mov edx, dword [edi]
mov esi, dword [edi + 4]
mov ebx, dword [edx]
mov ecx, ebx
lea ebp, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4c2543
sub ecx, ebp
sar ecx, 1
lea ebp, [ebx + ecx*2]
mov ebx, esi
sub ebx, ecx
test ebx, ebx
jle 0x4c257c
lea eax, [ebx - 1]
push eax
push str.Binaries_
push ebp
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
add esp, 0xc
xor eax, eax
mov word [ebp + ebx*2 - 2], ax
mov edx, dword [edi]
mov esi, dword [edi + 4]
mov ebx, dword [edx]
mov ecx, ebx
lea ebp, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4c2583
sub ecx, ebp
sar ecx, 1
lea ebp, [ebx + ecx*2]
mov ebx, esi
sub ebx, ecx
test ebx, ebx
jle 0x4c25bb
lea eax, [ebx - 1]
push eax
push dword [esp + 0x18]
push ebp
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
add esp, 0xc
xor eax, eax
mov word [ebp + ebx*2 - 2], ax
mov edx, dword [edi]
mov esi, dword [edi + 4]
mov ebx, dword [edx]
mov ecx, ebx
lea ebp, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4c25c2
sub ecx, ebp
sar ecx, 1
lea ebp, [ebx + ecx*2]
mov ebx, esi
sub ebx, ecx
test ebx, ebx
jle 0x4c25fb
lea eax, [ebx - 1]
push eax
push 0x61bb6c
push ebp
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
add esp, 0xc
xor eax, eax
mov word [ebp + ebx*2 - 2], ax
mov edx, dword [edi]
mov esi, dword [edi + 4]
mov ebx, dword [edx]
mov ecx, ebx
lea ebp, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4c2602
sub ecx, ebp
sar ecx, 1
sub esi, ecx
pop ebp
lea ebx, [ebx + ecx*2]
test esi, esi
jle 0x4c2636
lea eax, [esi - 1]
push eax
push dword [esp + 0x1c]
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
add esp, 0xc
xor eax, eax
mov word [ebx + esi*2 - 2], ax
mov edx, dword [edi]
push dword [edx]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop edi
cmp eax, 0xffffffff
pop esi
setne al
pop ebx
add esp, 8
ret 4
Function at 0x4c4f70
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x98
mov eax, dword [0x6b66bc]
xor eax, esp
mov dword [esp + 0x94], eax
mov eax, dword [0x6b4914]
or eax, dword [0x6b4918]
push esi
push edi
jne 0x4c5130
push 0x40
push eax
lea eax, [esp + 0x60]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x58], 0x40
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xorps xmm0, xmm0
mov dword [esp + 0x40], 0
lea eax, [esp + 0x20]
movaps xmmword [esp + 0x20], xmm0
push eax
movaps xmmword [esp + 0x34], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x80]
mov edi, dword [esp + 0x60]
mov esi, dword [esp + 0x64]
mov ecx, dword [esp + 0x3c]
mov dword [0x6b491c], eax
mov eax, dword [esp + 0x84]
mov dword [0x6b4920], eax
mov eax, dword [esp + 0x24]
mov dword [0x6b4930], eax
mov dword [0x6b4924], eax
mov eax, edi
or eax, esi
mov dword [0x6b4914], edi
mov dword [0x6b4918], esi
mov dword [0x6b492c], ecx
mov dword [0x6b4928], ecx
mov dword [esp + 0x1c], 0
je 0x4c5040
mov dword [esp + 0x1c], 0xffffffff
mov edx, edi
mov ecx, esi
add edx, 0xffffffff
mov eax, edx
adc ecx, 0xffffffff
or eax, ecx
jne 0x4c5062
mov eax, 0xffffffc0
mov dword [esp + 0x14], 0xffffffff
jmp 0x4c50f6
xorps xmm0, xmm0
movlpd qword [esp + 0x10], xmm0
cmp ecx, 1
jb 0x4c507f
ja 0x4c5076
test edx, edx
jb 0x4c507f
mov edx, ecx
xor ecx, ecx
lea eax, [ecx + 0x20]
jmp 0x4c5083
mov eax, dword [esp + 0x10]
test ecx, ecx
jne 0x4c508f
cmp edx, 0x10000
jb 0x4c5099
shrd edx, ecx, 0x10
shr ecx, 0x10
add eax, 0x10
test ecx, ecx
jne 0x4c50a5
cmp edx, 0x100
jb 0x4c50af
shrd edx, ecx, 8
shr ecx, 8
add eax, 8
test ecx, ecx
jne 0x4c50b8
cmp edx, 0x10
jb 0x4c50c2
shrd edx, ecx, 4
shr ecx, 4
add eax, 4
test ecx, ecx
jne 0x4c50cb
cmp edx, 4
jb 0x4c50d5
shrd edx, ecx, 2
shr ecx, 2
add eax, 2
test ecx, ecx
jne 0x4c50de
cmp edx, 2
jb 0x4c50e1
add eax, 1
or edx, ecx
jne 0x4c50ef
movlpd qword [esp + 0x10], xmm0
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x64]
add eax, 0xffffffc1
lea edx, [eax + 0x40]
xor ecx, ecx
and edx, dword [esp + 0x1c]
xor eax, eax
bts eax, edx
cmp edx, 0x20
cmovae ecx, eax
xor eax, ecx
cmp edx, 0x40
mov dword [0x6b4934], eax
cmovae ecx, eax
add edi, 0x3fffffff
mov dword [0x6b4938], ecx
adc esi, 0
shrd edi, esi, 0x1e
mov dword [0x6b493c], edi
mov ecx, dword [esp + 0x9c]
mov eax, 0x6b4914
pop edi
pop esi
xor ecx, esp
call fcn.005f4480
mov esp, ebp
pop ebp
ret
Function at 0x4c58c0
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x6c
mov eax, dword [0x6b66bc]
xor eax, esp
mov dword [esp + 0x68], eax
push esi
mov esi, dword [esp + 0x74]
mov ecx, esi
call fcn.00416a60
push 0x40
lea eax, [esp + 0x30]
mov dword [esi + 0x5c], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x2c], 0x40
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xorps xmm0, xmm0
lea eax, [esp + 4]
push 0x28
push eax
movups xmmword [esp + 0xc], xmm0
movups xmmword [esp + 0x1c], xmm0
movq qword [esp + 0x2c], xmm0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.KERNEL32.dll_K32GetProcessMemoryInfo
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x60]
mov ecx, dword [esp + 0x4c]
mov dword [esi], eax
mov eax, dword [esp + 0x38]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esi + 0x2c], eax
mov eax, dword [esp + 0x40]
mov dword [esi + 0x30], eax
cmp edx, dword [esp + 0x50]
ja 0x4c595e
mov eax, dword [esp + 0x5c]
jb 0x4c5964
cmp eax, ecx
jbe 0x4c5964
mov edx, dword [esp + 0x50]
mov eax, ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x44], ecx
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x34], eax
mov eax, dword [esp + 0x10]
mov dword [esi + 0x4c], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x3c], eax
mov eax, esi
mov dword [esi + 0x54], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esi + 0x38], edx
mov dword [esi + 0x40], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x58], 0
pop esi
xor ecx, esp
call fcn.005f4480
add esp, 0x6c
ret
Function at 0x4ca920
Capabilities:
Create process memory minidump

Disassembly:
sub esp, 0x20
push ebx
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, dword [esp + 0x30]
xor ebx, ebx
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [esp + 0x54]
cmp edi, eax
setne bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x4ca963
pop edi
pop ebp
xor al, al
pop ebx
add esp, 0x20
ret
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x24], eax
mov eax, dword [ecx + 0x38]
add eax, eax
mov dword [esp + 0x28], ebx
cmp dword [ecx + 0x34], 0
mov dword [esp + 0x14], 0x10000
mov dword [esp + 0x18], eax
je 0x4ca99b
mov eax, dword [ecx + 0x30]
mov dword [esp + 0x1c], eax
jmp 0x4ca9a3
mov dword [esp + 0x1c], 0x60f5ec
lea eax, [esp + 0x14]
mov dword [esp + 0xc], 1
push esi
mov dword [esp + 0x14], eax
xor esi, esi
call fcn.00424ec0
push 0
test al, al
mov ecx, 0x1826
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x2c]
cmovne esi, ecx
push eax
push esi
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push eax
push edi
call sub.dbghelp.dll_MiniDumpWriteDump
push ebp
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 1
pop esi
pop edi
pop ebp
sete al
pop ebx
add esp, 0x20
ret