joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b4d16
Capabilities:
Write file on windows

Disassembly:
push ebp
test edx, edx
mov ebp, esp
push esi
mov esi, eax
push ebx
mov ebx, edx
je 0x4b4cbb
call fcn.004b4ae0
mov eax, dword [esi + 0x7c]
test eax, eax
jne 0x4b4cb4
mov eax, dword [ebx + 8]
test eax, eax
jne 0x4b4d6f
mov eax, dword [ebx + 0x38]
test eax, eax
jne 0x4b4d40
mov eax, dword [ebx + 0x3c]
test eax, eax
jne 0x4b4d11
mov eax, dword [ebx + 0x48]
test eax, eax
jne 0x4b4ce5
mov eax, dword [ebx + 0x28]
test eax, eax
jne 0x4b4ccf
mov edx, dword [ebx + 0x34]
test edx, edx
jne 0x4b4cc2
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
lea esp, [ebp - 8]
mov eax, esi
pop ebx
pop esi
pop ebp
jmp fcn.004b3cf0
mov eax, dword [esi]
push eax
push 0x10
push 1
push str.standalonetrue_n
call sub.msvcrt.dll_fwrite
add esp, 0x10
jmp 0x4b4cb4
mov ecx, dword [esi]
push ecx
push 4
push 1
push str.URL
call sub.msvcrt.dll_fwrite
mov edx, dword [ebx + 0x48]
mov eax, esi
call fcn.004b3a60
pop eax
mov eax, dword [esi]
pop edx
push eax
push 0xa
call sub.msvcrt.dll_fputc
add esp, 0x10
jmp 0x4b4cad
mov ecx, dword [esi]
push ecx
push 9
push 1
push str.encoding
call sub.msvcrt.dll_fwrite
mov edx, dword [ebx + 0x3c]
mov eax, esi
call fcn.004b3a60
pop eax
mov eax, dword [esi]
pop edx
push eax
push 0xa
call sub.msvcrt.dll_fputc
add esp, 0x10
jmp 0x4b4ca6
mov ecx, dword [esi]
push ecx
push 8
push 1
push 0x75fd5c
call sub.msvcrt.dll_fwrite
mov edx, dword [ebx + 0x38]
mov eax, esi
call fcn.004b3a60
pop eax
mov eax, dword [esi]
pop edx
push eax
push 0xa
call sub.msvcrt.dll_fputc
add esp, 0x10
jmp 0x4b4c9f
mov ecx, dword [esi]
push ecx
push 5
push 1
push 0x75fd65
call sub.msvcrt.dll_fwrite
mov edx, dword [ebx + 8]
mov eax, esi
call fcn.004b3a60
pop eax
mov eax, dword [esi]
pop edx
push eax
push 0xa
call sub.msvcrt.dll_fputc
add esp, 0x10
jmp 0x4b4c94
Function at 0x4b4d45
Capabilities:
Write file on windows

Disassembly:
push ebp
test edx, edx
mov ebp, esp
push esi
mov esi, eax
push ebx
mov ebx, edx
je 0x4b4cbb
call fcn.004b4ae0
mov eax, dword [esi + 0x7c]
test eax, eax
jne 0x4b4cb4
mov eax, dword [ebx + 8]
test eax, eax
jne 0x4b4d6f
mov eax, dword [ebx + 0x38]
test eax, eax
jne 0x4b4d40
mov eax, dword [ebx + 0x3c]
test eax, eax
jne 0x4b4d11
mov eax, dword [ebx + 0x48]
test eax, eax
jne 0x4b4ce5
mov eax, dword [ebx + 0x28]
test eax, eax
jne 0x4b4ccf
mov edx, dword [ebx + 0x34]
test edx, edx
jne 0x4b4cc2
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
lea esp, [ebp - 8]
mov eax, esi
pop ebx
pop esi
pop ebp
jmp fcn.004b3cf0
mov eax, dword [esi]
push eax
push 0x10
push 1
push str.standalonetrue_n
call sub.msvcrt.dll_fwrite
add esp, 0x10
jmp 0x4b4cb4
mov ecx, dword [esi]
push ecx
push 4
push 1
push str.URL
call sub.msvcrt.dll_fwrite
mov edx, dword [ebx + 0x48]
mov eax, esi
call fcn.004b3a60
pop eax
mov eax, dword [esi]
pop edx
push eax
push 0xa
call sub.msvcrt.dll_fputc
add esp, 0x10
jmp 0x4b4cad
mov ecx, dword [esi]
push ecx
push 9
push 1
push str.encoding
call sub.msvcrt.dll_fwrite
mov edx, dword [ebx + 0x3c]
mov eax, esi
call fcn.004b3a60
pop eax
mov eax, dword [esi]
pop edx
push eax
push 0xa
call sub.msvcrt.dll_fputc
add esp, 0x10
jmp 0x4b4ca6
mov ecx, dword [esi]
push ecx
push 8
push 1
push 0x75fd5c
call sub.msvcrt.dll_fwrite
mov edx, dword [ebx + 0x38]
mov eax, esi
call fcn.004b3a60
pop eax
mov eax, dword [esi]
pop edx
push eax
push 0xa
call sub.msvcrt.dll_fputc
add esp, 0x10
jmp 0x4b4c9f
mov ecx, dword [esi]
push ecx
push 5
push 1
push 0x75fd65
call sub.msvcrt.dll_fwrite
mov edx, dword [ebx + 8]
mov eax, esi
call fcn.004b3a60
pop eax
mov eax, dword [esi]
pop edx
push eax
push 0xa
call sub.msvcrt.dll_fputc
add esp, 0x10
jmp 0x4b4c94
Function at 0x4b4d74
Capabilities:
Write file on windows

Disassembly:
push ebp
test edx, edx
mov ebp, esp
push esi
mov esi, eax
push ebx
mov ebx, edx
je 0x4b4cbb
call fcn.004b4ae0
mov eax, dword [esi + 0x7c]
test eax, eax
jne 0x4b4cb4
mov eax, dword [ebx + 8]
test eax, eax
jne 0x4b4d6f
mov eax, dword [ebx + 0x38]
test eax, eax
jne 0x4b4d40
mov eax, dword [ebx + 0x3c]
test eax, eax
jne 0x4b4d11
mov eax, dword [ebx + 0x48]
test eax, eax
jne 0x4b4ce5
mov eax, dword [ebx + 0x28]
test eax, eax
jne 0x4b4ccf
mov edx, dword [ebx + 0x34]
test edx, edx
jne 0x4b4cc2
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
lea esp, [ebp - 8]
mov eax, esi
pop ebx
pop esi
pop ebp
jmp fcn.004b3cf0
mov eax, dword [esi]
push eax
push 0x10
push 1
push str.standalonetrue_n
call sub.msvcrt.dll_fwrite
add esp, 0x10
jmp 0x4b4cb4
mov ecx, dword [esi]
push ecx
push 4
push 1
push str.URL
call sub.msvcrt.dll_fwrite
mov edx, dword [ebx + 0x48]
mov eax, esi
call fcn.004b3a60
pop eax
mov eax, dword [esi]
pop edx
push eax
push 0xa
call sub.msvcrt.dll_fputc
add esp, 0x10
jmp 0x4b4cad
mov ecx, dword [esi]
push ecx
push 9
push 1
push str.encoding
call sub.msvcrt.dll_fwrite
mov edx, dword [ebx + 0x3c]
mov eax, esi
call fcn.004b3a60
pop eax
mov eax, dword [esi]
pop edx
push eax
push 0xa
call sub.msvcrt.dll_fputc
add esp, 0x10
jmp 0x4b4ca6
mov ecx, dword [esi]
push ecx
push 8
push 1
push 0x75fd5c
call sub.msvcrt.dll_fwrite
mov edx, dword [ebx + 0x38]
mov eax, esi
call fcn.004b3a60
pop eax
mov eax, dword [esi]
pop edx
push eax
push 0xa
call sub.msvcrt.dll_fputc
add esp, 0x10
jmp 0x4b4c9f
mov ecx, dword [esi]
push ecx
push 5
push 1
push 0x75fd65
call sub.msvcrt.dll_fwrite
mov edx, dword [ebx + 8]
mov eax, esi
call fcn.004b3a60
pop eax
mov eax, dword [esi]
pop edx
push eax
push 0xa
call sub.msvcrt.dll_fputc
add esp, 0x10
jmp 0x4b4c94

Function at 0x4b4da0
Capabilities:
Write file on windows

Disassembly:
push ebp
test edx, edx
mov ebp, esp
push esi
mov esi, eax
push ebx
mov ebx, edx
je 0x4b4dd7
call fcn.004b4c70
mov eax, dword [ebx + 4]
cmp eax, 9
sete dl
cmp eax, 0xd
sete al
or eax, edx
test al, 1
je 0x4b4dd0
mov edx, dword [ebx + 0xc]
test edx, edx
jne 0x4b4df9
mov esi, esi
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov eax, dword [eax + 0x7c]
test eax, eax
jne 0x4b4dd0
mov eax, dword [esi]
push eax
push 0x13
push 1
push str.DOCUMENT__NULL___n
call sub.msvcrt.dll_fwrite
add esp, 0x10
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov eax, dword [esi + 0x6c]
inc eax
mov dword [esi + 0x6c], eax
mov eax, esi
call fcn.004b3d90
mov eax, dword [esi + 0x6c]
dec eax
mov dword [esi + 0x6c], eax
jmp 0x4b4dd0
Function at 0x4b4de3
Capabilities:
Write file on windows

Disassembly:
push ebp
test edx, edx
mov ebp, esp
push esi
mov esi, eax
push ebx
mov ebx, edx
je 0x4b4dd7
call fcn.004b4c70
mov eax, dword [ebx + 4]
cmp eax, 9
sete dl
cmp eax, 0xd
sete al
or eax, edx
test al, 1
je 0x4b4dd0
mov edx, dword [ebx + 0xc]
test edx, edx
jne 0x4b4df9
mov esi, esi
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov eax, dword [eax + 0x7c]
test eax, eax
jne 0x4b4dd0
mov eax, dword [esi]
push eax
push 0x13
push 1
push str.DOCUMENT__NULL___n
call sub.msvcrt.dll_fwrite
add esp, 0x10
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov eax, dword [esi + 0x6c]
inc eax
mov dword [esi + 0x6c], eax
mov eax, esi
call fcn.004b3d90
mov eax, dword [esi + 0x6c]
dec eax
mov dword [esi + 0x6c], eax
jmp 0x4b4dd0

Function at 0x4b4fa0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
test esi, esi
je 0x4b502b
xor ebx, ebx
test edi, edi
je 0x4b5039
lea esi, [esi]
mov cl, byte [ebx + edi]
test cl, cl
je 0x4b5009
lea eax, [ecx - 9]
cmp cl, 0x20
sete dl
cmp al, 1
setbe al
or eax, edx
test al, 1
jne 0x4b5011
cmp cl, 0xd
je 0x4b5011
test cl, cl
js 0x4b5018
push eax
push eax
xor eax, eax
mov al, cl
push esi
push eax
call sub.msvcrt.dll_fputc
inc ebx
add esp, 0x10
cmp ebx, 0x27
jle 0x4b4fc0
push esi
push 3
push 1
push 0x75f528
call sub.msvcrt.dll_fwrite
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
push edx
push edx
push esi
push 0x20
jmp 0x4b4fec
push eax
xor eax, eax
mov al, cl
push eax
push 0x75f52c
push esi
call sub.msvcrt.dll_fprintf
jmp 0x4b4ff1
mov esi, dword [sym.imp.msvcrt.dll__iob]
add esi, 0x20
jmp 0x4b4fb3
push esi
push 6
push 1
push str._NULL_
jmp 0x4b5004
Function at 0x4b54c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
test esi, esi
je 0x4b5590
test ebx, ebx
je 0x4b557c
mov eax, dword [ebx + 4]
cmp eax, 0x12
ja case.0x4b54e3.0
jmp dword [eax*4 + 0x75ff60]
push edx
push edx
push esi
push 0x3f
call sub.msvcrt.dll_fputc
add esp, 0x10
cmp dword [ebx + 4], 0x12
je 0x4b552f
mov eax, dword [ebx + 0x2c]
test eax, eax
je 0x4b55a0
push eax
push eax
push esi
push 0x61
call sub.msvcrt.dll_fputc
mov eax, dword [ebx + 0x30]
add esp, 0x10
test eax, eax
je 0x4b5597
push eax
push eax
push esi
push 0x6e
call sub.msvcrt.dll_fputc
add esp, 0x10
sub esp, 0xc
push ebx
call fcn.004b5460
add esp, 0xc
push eax
push str.__8d
push esi
call sub.msvcrt.dll_fprintf
mov eax, dword [ebx + 4]
add esp, 0x10
cmp eax, 0x12
ja case.0x4b5552.0
jmp dword [eax*4 + 0x75ffac]
mov eax, dword [ebx + 8]
test eax, eax
jne 0x4b55aa
mov dword [ebp + 0xc], esi
mov dword [ebp + 8], 0xa
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
jmp sub.msvcrt.dll_fputc
push esi
push 5
push 1
push 0x75ff3e
call sub.msvcrt.dll_fwrite
nop
lea esi, [esi]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
push eax
push eax
push esi
push 0x2d
jmp 0x4b5527
push eax
push eax
push esi
push 0x2d
jmp 0x4b5513
push edx
push edx
push esi
push eax
call sub.msvcrt.dll_fputs
add esp, 0x10
mov dword [ebp + 0xc], esi
mov dword [ebp + 8], 0xa
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
jmp sub.msvcrt.dll_fputc
mov eax, dword [ebx + 0x28]
test eax, eax
je case.0x4b5552.4
push edx
push edx
push eax
push esi
call fcn.004b4fa0
add esp, 0x10
jmp 0x4b55b6
mov ecx, dword [ebx + 8]
test ecx, ecx
je case.0x4b5552.4
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x4b55f9
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x4b56c2
push eax
push eax
push esi
mov ecx, dword [ebx + 8]
push ecx
call sub.msvcrt.dll_fputs
jmp 0x4b55b3
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x4b56b3
push eax
mov ebx, dword [ebx + 8]
push ebx
push str.default_____s
push esi
call sub.msvcrt.dll_fprintf
add esp, 0x10
jmp 0x4b55b6
push eax
push eax
push esi
push 0x61
jmp 0x4b54f5
push eax
push eax
push esi
push 0x2d
jmp 0x4b54f5
push ecx
push ecx
push esi
push 0x45
jmp 0x4b54f5
push eax
push eax
push esi
push 0x65
jmp 0x4b54f5
push eax
push eax
push esi
push 0x43
jmp 0x4b54f5
push eax
push eax
push esi
push 0x74
jmp 0x4b54f5
push ecx
push ecx
push esi
push 0x6e
jmp 0x4b54f5
push eax
push eax
push esi
push 0x68
jmp 0x4b54f5
push eax
push eax
push esi
push 0x4e
jmp 0x4b54f5
push eax
push eax
push esi
push 0x46
jmp 0x4b54f5
push eax
push eax
push esi
push 0x54
jmp 0x4b54f5
push eax
push eax
push esi
push 0x64
jmp 0x4b54f5
push eax
push eax
push esi
push 0x63
jmp 0x4b54f5
push edx
push edx
push esi
push 0x70
jmp 0x4b54f5
mov ecx, dword [ebx + 8]
push ecx
push eax
push str._s_____s
jmp 0x4b561c
push edx
push eax
push 0x75ff5b
push esi
call sub.msvcrt.dll_fprintf
add esp, 0x10
jmp 0x4b55f9
Function at 0x4b5800
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
test esi, esi
je 0x4b5856
test edi, edi
je 0x4b587b
mov ecx, dword [edi + 4]
cmp ecx, 9
sete dl
cmp ecx, 0xd
sete al
or eax, edx
test al, 1
jne 0x4b5860
cmp ecx, 0x12
je 0x4b5865
mov eax, dword [edi + 0xc]
mov ebx, eax
test eax, eax
jne 0x4b5852
jmp 0x4b5865
push eax
push eax
push ebx
mov edi, dword [esi + 0x14]
push edi
call fcn.004b54c0
mov ebx, dword [ebx + 0x18]
add esp, 0x10
test ebx, ebx
jne 0x4b5840
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [edi + 0xc]
jmp 0x4b5852
push eax
push eax
push edi
mov eax, dword [esi + 0x14]
push eax
call fcn.004b54c0
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esi + 0x14]
push eax
push 5
push 1
push 0x75ff3e
call sub.msvcrt.dll_fwrite
jmp 0x4b5856

Function at 0x4b5890
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
test esi, esi
je 0x4b58d4
test eax, eax
je 0x4b58e0
push ebx
push ebx
push eax
mov ecx, dword [eax + 0x20]
push ecx
call fcn.0044ff40
add esp, 0x10
mov ebx, eax
test eax, eax
je 0x4b5900
push eax
push ebx
push 0x75f7d0
mov eax, dword [esi + 0x14]
push eax
call sub.msvcrt.dll_fprintf
mov dword [esp], ebx
call dword [0x69a2d0]
add esp, 0x10
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret
mov esi, dword [esi + 0x14]
push esi
push 5
push 1
push 0x75ff3e
call sub.msvcrt.dll_fwrite
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret
mov edx, dword [esi + 0x14]
push edx
push 0x13
push 1
push str._No_base_found_____n
call sub.msvcrt.dll_fwrite
jmp 0x4b58d1

Function at 0x4b5920
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
test esi, esi
je 0x4b595d
test ebx, ebx
je 0x4b5983
mov ecx, dword [ebx + 4]
cmp ecx, 9
sete dl
cmp ecx, 0xd
sete al
or eax, edx
test al, 1
jne 0x4b5966
cmp ecx, 2
je 0x4b5974
push eax
push 0
push ebx
mov eax, dword [esi + 0x14]
push eax
call fcn.004b51d0
add esp, 0x10
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret
push eax
push eax
push ebx
mov eax, dword [esi + 0x14]
push eax
call fcn.004b52b0
jmp 0x4b595a
push eax
push 0
push ebx
mov eax, dword [esi + 0x14]
push eax
call fcn.004b5050
jmp 0x4b595a
mov edx, dword [esi + 0x14]
push edx
push 5
push 1
push 0x75ff3e
call sub.msvcrt.dll_fwrite
jmp 0x4b595d
Function at 0x4b5d00
Capabilities:
Write file on windows

Disassembly:
push ebp
or eax, 0xffffffff
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [ebp - 0x10], 0
mov edx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
test edx, edx
je 0x4b5d82
test edi, edi
je 0x4b5d82
mov ebx, edi
jmp 0x4b5d2c
mov ebx, dword [ebx + 0xc]
test ebx, ebx
je 0x4b5d80
mov ecx, dword [ebx + 4]
cmp ecx, 9
sete dl
cmp ecx, 0xd
sete al
or eax, edx
test al, 1
jne 0x4b5dd6
cmp ecx, 1
je 0x4b5df6
cmp ecx, 9
sete dl
cmp ecx, 0xd
sete al
or eax, edx
test al, 1
jne 0x4b5d25
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x4b5d90
cmp ecx, 5
je 0x4b5d90
mov ebx, eax
mov eax, dword [ebp - 0x10]
inc eax
test ebx, ebx
mov dword [ebp - 0x10], eax
jne 0x4b5d2c
lea esi, [esi]
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp ebx, edi
je 0x4b5d80
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x4b5da0
mov ebx, eax
jmp 0x4b5d28
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x4b5db0
mov ebx, eax
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp ebx, edi
je 0x4b5dbf
mov eax, dword [ebx + 0x18]
test eax, eax
jne 0x4b5e5c
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x4b5dca
cmp ebx, edi
jne 0x4b5da3
xor ebx, ebx
cmp ebx, edi
jne 0x4b5d28
jmp 0x4b5d80
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
push eax
push 2
push 1
push 0x760145
call sub.msvcrt.dll_fwrite
add esp, 0x10
mov ecx, dword [ebx + 4]
jmp 0x4b5d4e
xor esi, esi
cmp esi, dword [ebp - 0x10]
jge 0x4b5e1e
lea esi, [esi]
mov eax, dword [ebp + 8]
inc esi
mov eax, dword [eax + 0x14]
push eax
push 2
push 1
push 0x760148
call sub.msvcrt.dll_fwrite
add esp, 0x10
cmp esi, dword [ebp - 0x10]
jl 0x4b5e00
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x4b5e2c
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x4b5e44
push edx
mov eax, dword [ebx + 8]
push eax
mov eax, dword [ebp + 8]
push 0x75f7d0
mov eax, dword [eax + 0x14]
push eax
call sub.msvcrt.dll_fprintf
jmp 0x4b5deb
push esi
push eax
mov eax, dword [ebp + 8]
push 0x75ff5b
mov ecx, dword [eax + 0x14]
push ecx
call sub.msvcrt.dll_fprintf
add esp, 0x10
jmp 0x4b5e2c
mov ebx, eax
jmp 0x4b5dcc
Function at 0x4b5ddf
Capabilities:
Write file on windows

Disassembly:
push ebp
or eax, 0xffffffff
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [ebp - 0x10], 0
mov edx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
test edx, edx
je 0x4b5d82
test edi, edi
je 0x4b5d82
mov ebx, edi
jmp 0x4b5d2c
mov ebx, dword [ebx + 0xc]
test ebx, ebx
je 0x4b5d80
mov ecx, dword [ebx + 4]
cmp ecx, 9
sete dl
cmp ecx, 0xd
sete al
or eax, edx
test al, 1
jne 0x4b5dd6
cmp ecx, 1
je 0x4b5df6
cmp ecx, 9
sete dl
cmp ecx, 0xd
sete al
or eax, edx
test al, 1
jne 0x4b5d25
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x4b5d90
cmp ecx, 5
je 0x4b5d90
mov ebx, eax
mov eax, dword [ebp - 0x10]
inc eax
test ebx, ebx
mov dword [ebp - 0x10], eax
jne 0x4b5d2c
lea esi, [esi]
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp ebx, edi
je 0x4b5d80
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x4b5da0
mov ebx, eax
jmp 0x4b5d28
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x4b5db0
mov ebx, eax
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp ebx, edi
je 0x4b5dbf
mov eax, dword [ebx + 0x18]
test eax, eax
jne 0x4b5e5c
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x4b5dca
cmp ebx, edi
jne 0x4b5da3
xor ebx, ebx
cmp ebx, edi
jne 0x4b5d28
jmp 0x4b5d80
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
push eax
push 2
push 1
push 0x760145
call sub.msvcrt.dll_fwrite
add esp, 0x10
mov ecx, dword [ebx + 4]
jmp 0x4b5d4e
xor esi, esi
cmp esi, dword [ebp - 0x10]
jge 0x4b5e1e
lea esi, [esi]
mov eax, dword [ebp + 8]
inc esi
mov eax, dword [eax + 0x14]
push eax
push 2
push 1
push 0x760148
call sub.msvcrt.dll_fwrite
add esp, 0x10
cmp esi, dword [ebp - 0x10]
jl 0x4b5e00
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x4b5e2c
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x4b5e44
push edx
mov eax, dword [ebx + 8]
push eax
mov eax, dword [ebp + 8]
push 0x75f7d0
mov eax, dword [eax + 0x14]
push eax
call sub.msvcrt.dll_fprintf
jmp 0x4b5deb
push esi
push eax
mov eax, dword [ebp + 8]
push 0x75ff5b
mov ecx, dword [eax + 0x14]
push ecx
call sub.msvcrt.dll_fprintf
add esp, 0x10
jmp 0x4b5e2c
mov ebx, eax
jmp 0x4b5dcc
Function at 0x4b9f10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edi, eax
mov eax, dword [eax + 0x24]
test eax, eax
jle 0x4b9f67
dec eax
mov esi, dword [edi + 0x28]
mov edx, eax
mov dword [edi + 0x24], eax
shl edx, 4
mov eax, dword [edx + esi]
mov dword [edi + 0x14], eax
mov eax, dword [edx + esi + 4]
mov dword [edi + 0x38], eax
mov eax, dword [edx + esi + 8]
mov dword [edi + 0x18], eax
mov eax, dword [edi + 8]
mov eax, dword [eax + 0x14]
test eax, eax
jle 0x4b9f60
mov esi, dword [edx + esi + 0xc]
test esi, esi
je 0x4b9f74
lea ecx, [eax*4]
mov edi, dword [edi + 0x2c]
cld
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
mov dword [edi], 0xffffffff
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
push 0x1c
push 1
push str.exec_save:_allocation_failed
call sub.msvcrt.dll_fwrite
mov dword [edi], 0xfffffffa
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
Function at 0x4bab50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [ebp + 8], ecx
mov dword [ebp + 0xc], 0
pop ebp
jmp fcn.004ba460
Function at 0x4c0510
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, eax
mov ebx, edx
mov edi, dword [ebp + 8]
test edx, edx
je 0x4c0567
test edi, edi
jne 0x4c0570
xor eax, eax
mov al, byte [ebx]
cmp eax, 5
ja case.default.0x4c0531
jmp dword [eax*4 + 0x761ffc]
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
push 0xe
push 1
push str.Error_in_tree_n
call sub.msvcrt.dll_fwrite
nop
add esp, 0x10
test edi, edi
je 0x4c0567
push edi
push edi
push 0x761fc8
push esi
call fcn.00450cb0
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
push eax
push eax
push 0x761fca
push esi
call fcn.00450cb0
add esp, 0x10
jmp 0x4c0528
mov edx, dword [ebx + 0xc]
mov al, byte [edx]
sub eax, 3
cmp al, 1
jbe 0x4c0692
sub esp, 0xc
push 0
mov eax, esi
call fcn.004c0510
mov edx, dword [ebx + 0x14]
add esp, 0x10
test edx, edx
jne 0x4c06a3
mov eax, dword [ebx + 0x18]
cmp eax, 1
je 0x4c06ce
cmp eax, 0xffffffff
je 0x4c06c8
cmp eax, edx
je 0x4c06ed
test eax, eax
js 0x4c06d4
sub esp, 0xc
lea ebx, [ebp - 0x48]
push eax
push edx
push str._d__d
push 0x27
push ebx
call sub.msvcrt.dll__snprintf
add esp, 0x20
push eax
push eax
push ebx
mov byte [ebp - 0x21], 0
jmp 0x4c05f9
push eax
push eax
push str.empty
push esi
call fcn.00450cb0
jmp 0x4c0550
push eax
push eax
push str.forbidden
jmp 0x4c05f9
push eax
push eax
mov eax, dword [ebx + 0x14]
push eax
push esi
call fcn.00450c90
jmp 0x4c0550
mov edx, dword [ebx + 0xc]
mov al, byte [edx]
sub eax, 3
cmp al, 1
jbe 0x4c068b
sub esp, 0xc
push 0
mov eax, esi
call fcn.004c0510
pop ecx
pop eax
push 0x761fe4
jmp 0x4c065e
mov edx, dword [ebx + 0xc]
mov al, byte [edx]
sub eax, 3
cmp al, 1
jbe 0x4c0684
sub esp, 0xc
push 0
mov eax, esi
call fcn.004c0510
pop eax
pop edx
push 0x761fe8
push esi
call fcn.00450cb0
mov edx, dword [ebx + 0x14]
add esp, 0x10
mov al, byte [edx]
sub eax, 3
cmp al, 1
ja 0x4c069c
sub esp, 0xc
push 1
mov eax, esi
call fcn.004c0510
jmp 0x4c0550
sub esp, 0xc
push 1
jmp 0x4c0650
sub esp, 0xc
push 1
jmp 0x4c062f
sub esp, 0xc
push 1
jmp 0x4c0597
sub esp, 0xc
push 0
jmp 0x4c0678
mov eax, dword [ebx + 0x18]
cmp edx, 1
jne 0x4c05c1
cmp eax, 0xffffffff
jne 0x4c05c1
mov byte [ebp - 0x48], 0x2b
lea ebx, [ebp - 0x48]
mov byte [ebp - 0x47], 0
jmp 0x4c05e9
mov byte [ebp - 0x48], 0x2a
jmp 0x4c06bc
mov byte [ebp - 0x48], 0x3f
jmp 0x4c06bc
push edx
push str._d_inf
lea ebx, [ebp - 0x48]
push 0x27
push ebx
call sub.msvcrt.dll__snprintf
add esp, 0x10
jmp 0x4c05e9
push edx
push str._d
jmp 0x4c06da
Function at 0x4c67e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov edi, eax
mov eax, dword [eax + 0x4090]
mov dword [ebp - 0x10], 0
test eax, eax
je 0x4c6852
mov eax, dword [edi + 0x6c]
mov dword [ebp - 0x14], 0
test eax, eax
je 0x4c6852
lea eax, [edi + 0x4094]
mov dword [ebp - 0x18], eax
mov ebx, dword [edi + 0x40a0]
mov eax, dword [ebp - 0x18]
mov edx, ebx
call fcn.004c5cc0
mov edx, dword [ebp - 0x14]
mov esi, eax
xor eax, eax
mov al, byte [edi + edx + 0x88]
mov edx, ebx
push eax
mov eax, dword [ebp - 0x18]
call fcn.004c5ce0
mov edx, dword [ebp - 0x14]
mov eax, esi
xor byte [edi + edx + 0x88], al
inc edx
pop esi
mov dword [ebp - 0x14], edx
cmp dword [edi + 0x6c], edx
ja 0x4c6813
mov ebx, dword [edi + 0x6c]
lea eax, [edi + 0x88]
mov ecx, dword [edi + 0x20]
mov edx, dword [edi + 0x1c]
push ebx
push eax
push ecx
push edx
call dword [edi + 8]
add esp, 0x10
cmp eax, dword [edi + 0x6c]
je 0x4c6877
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [edi + 0x6c], 0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret