joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42dbc8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x42dbd6
xor eax, eax
pop ebp
ret
cmp dword [ebp + 0x10], 8
push esi
mov esi, dword [ebp + 8]
not esi
mov ecx, 0xff
jb 0x42dcaa
mov eax, dword [ebp + 0x10]
push ebx
shr eax, 3
push edi
xor ebx, ebx
mov bl, byte [edx]
mov edi, esi
shr edi, 8
sub dword [ebp + 0x10], 8
xor ebx, esi
and ebx, ecx
mov esi, dword [ebx*4 + 0x699f98]
xor ebx, ebx
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x699f98]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x699f98]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x699f98]
xor ebx, ebx
shr esi, 8
xor edi, esi
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x699f98]
xor ebx, ebx
shr edi, 8
xor esi, edi
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x699f98]
shr esi, 8
xor edi, esi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, edi
and ebx, ecx
mov esi, dword [ebx*4 + 0x699f98]
shr edi, 8
xor esi, edi
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
mov edi, dword [ebx*4 + 0x699f98]
shr esi, 8
xor esi, edi
inc edx
dec eax
jne 0x42dbf3
pop edi
pop ebx
cmp dword [ebp + 0x10], 0
je 0x42dcca
xor eax, eax
mov al, byte [edx]
xor eax, esi
and eax, ecx
mov eax, dword [eax*4 + 0x699f98]
shr esi, 8
xor esi, eax
inc edx
dec dword [ebp + 0x10]
jne 0x42dcb0
mov eax, esi
not eax
pop esi
pop ebp
ret
Function at 0x440b00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x71ccd4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [0x8086f0]
push esi
push eax
mov dword [edi + 0x154], 1
lea eax, [edi + 0x15c]
lea ebx, [edi + 0x154]
push eax
call fcn.006029d0
add esp, 0xc
mov dword [edi + 0x158], esi
add esi, 8
je 0x440bd2
mov eax, dword [edi]
test eax, eax
je 0x440b81
mov eax, dword [eax + 4]
cmp eax, 0xffffffff
je 0x440b81
test ebx, ebx
je 0x440b81
push 0
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0
push ecx
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x440b81
cmp dword [ebp - 8], esi
je 0x440bd2
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x440ba1
mov eax, dword [edi + 4]
cmp eax, 3
je 0x440b95
cmp eax, 1
jne 0x440ba1
lea eax, [edi + 0x54]
push eax
push dword [edi + 0x50]
call ecx
add esp, 8
mov esi, dword [edi]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0xffffffff
xor al, al
mov byte [esi], 0
mov dword [edi + 4], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c81cf
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005c81cf
mov esp, ebp
pop ebp
ret 8
Function at 0x453080
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0xc]
jbe 0x45309e
lea ecx, [ebp + 0xc]
push ecx
lea edx, [ebp + 8]
push edx
call fcn.00454b00
add esp, 8
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp + 8]
mov dword [ebp + ecx - 0x14], edx
mov eax, 4
shl eax, 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp + eax - 0x14], ecx
lea edx, [ebp - 0x14]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 8
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0xc]
jae 0x4530fb
imul edx, dword [ebp - 8], 0x1000193
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
movzx ecx, byte [eax]
xor ecx, dword [ebp - 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x4530d2
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x4c6d80
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x71ccd4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x28]
call fcn.0046f3b0
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x30]
call fcn.004c6cd0
push 0x681d24
mov ecx, dword [ebp + 8]
push ecx
call fcn.00614ae2
add esp, 8
mov dword [ebp - 0x2c], eax
push 0x80
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cvtss2sd xmm0, dword [ebp - 0x20]
sub esp, 8
movsd qword [esp], xmm0
cvtss2sd xmm0, dword [ebp - 0x24]
sub esp, 8
movsd qword [esp], xmm0
cvtss2sd xmm0, dword [ebp - 0x28]
sub esp, 8
movsd qword [esp], xmm0
push str.CenterPos__f__f__f_n
push 0
mov eax, dword [ebp - 0x2c]
push eax
call fcn.005336e0
add esp, 0x24
cvtss2sd xmm0, dword [ebp - 0x10]
sub esp, 8
movsd qword [esp], xmm0
cvtss2sd xmm0, dword [ebp - 0xc]
sub esp, 8
movsd qword [esp], xmm0
cvtss2sd xmm0, dword [ebp - 8]
sub esp, 8
movsd qword [esp], xmm0
push str.CameraSetting__f__f__f_n
push 0
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.005336e0
add esp, 0x24
cvtss2sd xmm0, dword [ebp - 0x14]
sub esp, 8
movsd qword [esp], xmm0
cvtss2sd xmm0, dword [ebp - 0x18]
sub esp, 8
movsd qword [esp], xmm0
cvtss2sd xmm0, dword [ebp - 0x1c]
sub esp, 8
movsd qword [esp], xmm0
push str.CmrPos__f__f__f_n
push 0
mov edx, dword [ebp - 0x2c]
push edx
call fcn.005336e0
add esp, 0x24
cvttss2si eax, dword [ebp - 0x14]
push eax
cvttss2si ecx, dword [ebp - 0x18]
push ecx
cvttss2si edx, dword [ebp - 0x1c]
push edx
cvttss2si eax, dword [ebp - 0x10]
push eax
cvttss2si ecx, dword [ebp - 0xc]
push ecx
cvttss2si edx, dword [ebp - 8]
push edx
cvttss2si eax, dword [ebp - 0x20]
push eax
cvttss2si ecx, dword [ebp - 0x24]
push ecx
cvttss2si edx, dword [ebp - 0x28]
push edx
push str.Line__x__dy__dz__ddistance__dpitch__drot__dup__dview__dcross__d__n
push 0
mov eax, dword [ebp - 0x2c]
push eax
call fcn.005336e0
add esp, 0x30
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.006149a7
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c81cf
mov esp, ebp
pop ebp
ret 4

Function at 0x4cd5a0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 0
call dword [sym.imp.USER32.dll_ChangeDisplaySettingsA]
push 0x40
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 6
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4d0600
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0x683dc0
push str.interface.cfg
call fcn.00614ae2
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4d0628
xor al, al
jmp 0x4d0653
mov eax, dword [ebp - 4]
push eax
push 0xc8
push 1
mov ecx, dword [ebp - 8]
add ecx, 0x2660
push ecx
call fcn.006159a0
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
call fcn.006149a7
add esp, 4
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x4d0660
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x265c], 0
jne 0x4d0677
jmp 0x4d06f0
push 0x683830
call dword [sym.imp.python27.dll_Py_BuildValue]
add esp, 4
push eax
push str.OnSaveInterfaceStatus
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x265c]
push edx
call fcn.005bf5e0
add esp, 0xc
push 0x68384c
push 0x683850
call fcn.00614ae2
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4d06c7
push str.Cannot_open_interface.cfg
call fcn.005190c0
add esp, 4
jmp 0x4d06f0
mov eax, dword [ebp - 8]
push eax
push 0xc8
push 1
mov ecx, dword [ebp - 4]
add ecx, 0x2660
push ecx
call fcn.00616f1d
add esp, 0x10
mov edx, dword [ebp - 8]
push edx
call fcn.006149a7
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x4d3360
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x71ccd4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x38], 0
je 0x4d3387
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x4d338e
mov al, 1
jmp 0x4d3469
call fcn.0044d950
push eax
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x3c], eax
call fcn.0044d950
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.004d46c0
add esp, 8
movzx eax, al
test eax, eax
je 0x4d33ca
xor al, al
jmp 0x4d3469
mov dword [ebp - 0x48], 0x20
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x40
push ecx
mov edx, dword [ebp - 0x2c]
mov ecx, dword [edx + 0x38]
call fcn.004d5c00
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x4d3406
cmp dword [ebp - 0x30], 1
je 0x4d340d
cmp dword [ebp - 0x30], 3
je 0x4d345c
jmp 0x4d3467
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x3d], 0
mov ecx, dword [ebp - 0x44]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x34], ecx
je 0x4d343c
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x34]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.00616f1d
add esp, 0x10
cmp dword [ebp - 0x34], eax
je 0x4d343c
xor al, al
jmp 0x4d3469
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x4d3450
mov dword [ebp - 0x38], 1
jmp 0x4d3457
mov dword [ebp - 0x38], 0
mov al, byte [ebp - 0x38]
jmp 0x4d3469
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x3d], 0
mov al, 1
jmp 0x4d3469
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c81cf
mov esp, ebp
pop ebp
ret
Function at 0x4d4c70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x71ccd4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov dword [ebp - 0x2c], ecx
call fcn.0044d950
mov dword [ebp - 0x44], eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x44]
push ecx
call fcn.004d46c0
add esp, 8
movzx edx, al
test edx, edx
je 0x4d4cb5
lea eax, [ebp + 8]
push eax
call fcn.004d4be0
add esp, 4
jmp 0x4d4e32
mov ecx, dword [ebp - 0x2c]
call fcn.004d5030
test eax, eax
je 0x4d4cf7
mov ecx, dword [ebp - 0x2c]
call fcn.004d5030
mov esi, eax
mov ecx, dword [ebp - 0x2c]
call fcn.004d46a0
cmp esi, eax
jae 0x4d4cf7
lea ecx, [ebp + 8]
push ecx
call fcn.004d5870
add esp, 4
mov bl, al
mov ecx, dword [ebp - 0x2c]
call fcn.004d3fa0
mov byte [eax], bl
mov eax, dword [ebp + 8]
jmp 0x4d4e32
mov edx, dword [ebp - 0x2c]
cmp dword [edx + 0x4c], 0
jne 0x4d4d0a
call fcn.0044d950
jmp 0x4d4e32
mov ecx, dword [ebp - 0x2c]
call fcn.004d3ff0
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x38], 0
jne 0x4d4d59
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x4c]
push edx
lea eax, [ebp + 8]
push eax
call fcn.004d5870
add esp, 4
movzx ecx, al
push ecx
call fcn.004d1460
add esp, 8
movzx edx, al
test edx, edx
je 0x4d4d49
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
jmp 0x4d4d51
call fcn.0044d950
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
jmp 0x4d4e32
mov dword [ebp - 0x50], 0x20
lea ecx, [ebp + 8]
push ecx
call fcn.004d5870
add esp, 4
mov byte [ebp - 0x2e], al
lea edx, [ebp - 0x48]
push edx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x4c]
push edx
lea eax, [ebp - 0x2d]
push eax
lea ecx, [ebp - 0x2e]
push ecx
mov edx, dword [ebp - 0x2c]
add edx, 0x40
push edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x38]
call fcn.004d4c30
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x4d4db0
cmp dword [ebp - 0x34], 1
je 0x4d4db0
cmp dword [ebp - 0x34], 3
je 0x4d4dfd
jmp 0x4d4e2d
mov ecx, dword [ebp - 0x48]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x38], ecx
je 0x4d4de2
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.00616f1d
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x4d4de2
call fcn.0044d950
jmp 0x4d4e32
mov ecx, dword [ebp - 0x2c]
mov byte [ecx + 0x3d], 1
lea edx, [ebp - 0x2e]
cmp dword [ebp - 0x4c], edx
je 0x4d4df6
mov eax, dword [ebp + 8]
jmp 0x4d4e32
call fcn.0044d950
jmp 0x4d4e32
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
movzx edx, byte [ebp - 0x2e]
push edx
call fcn.004d1460
add esp, 8
movzx eax, al
test eax, eax
je 0x4d4e20
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x40], ecx
jmp 0x4d4e28
call fcn.0044d950
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
jmp 0x4d4e32
call fcn.0044d950
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c81cf
mov esp, ebp
pop ebp
ret 4
Function at 0x4d5e20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], ecx
cmp dword [ebp + 0x10], 0
jg 0x4d5e40
jl 0x4d5e37
cmp dword [ebp + 0xc], 0
ja 0x4d5e40
xor eax, eax
xor edx, edx
jmp 0x4d5f77
mov eax, dword [ebp - 8]
cmp dword [eax + 0x38], 0
je 0x4d5e62
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
call fcn.004d5f80
jmp 0x4d5f77
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 8]
call fcn.004d37b0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x4d5ed1
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 4]
push edx
call fcn.0044acf0
add esp, 8
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 8]
call fcn.004d4930
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.0044d700
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 8]
call fcn.004d4880
mov eax, dword [ebp - 8]
cmp dword [eax + 0x4c], 0
je 0x4d5f68
mov ecx, dword [ebp - 8]
call fcn.004d3ff0
mov dword [ebp - 0x18], 0xfff
cmp dword [ebp - 4], 0xfff
jbe 0x4d5f41
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x4c]
push edx
push 0xfff
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.006159a0
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x10]
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
cmp dword [ebp - 0x10], 0xfff
je 0x4d5f3f
xor eax, eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x1c]
sbb edx, eax
mov eax, ecx
jmp 0x4d5f77
jmp 0x4d5eed
cmp dword [ebp - 4], 0
jbe 0x4d5f68
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.006159a0
add esp, 0x10
mov ecx, dword [ebp - 4]
sub ecx, eax
mov dword [ebp - 4], ecx
xor edx, edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
sbb ecx, edx
mov edx, ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4d84d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x71ccd4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov dword [ebp - 0x2c], ecx
lea eax, [ebp - 0x34]
push eax
push 3
mov ecx, dword [ebp - 0x2c]
call fcn.0053ae80
movzx ecx, al
test ecx, ecx
jne 0x4d8500
mov al, 1
jmp 0x4d8639
movzx esi, word [ebp - 0x33]
mov ecx, dword [ebp - 0x2c]
call fcn.0053add0
cmp esi, eax
jle 0x4d8517
mov al, 1
jmp 0x4d8639
lea edx, [ebp - 0x50]
push edx
push 7
mov ecx, dword [ebp - 0x2c]
call fcn.0053b060
movzx eax, al
test eax, eax
jne 0x4d8533
xor al, al
jmp 0x4d8639
movzx ecx, word [ebp - 0x4f]
sub ecx, 7
mov word [ebp - 0x24], cx
mov edx, dword [ebp - 0x4d]
mov dword [ebp - 0x40], edx
movzx eax, word [ebp - 0x24]
push eax
call fcn.005c86fb
add esp, 4
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
push edx
movzx eax, word [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x2c]
call fcn.0053b060
movzx ecx, al
test ecx, ecx
jne 0x4d858b
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
push eax
call fcn.005c8704
add esp, 4
xor al, al
jmp 0x4d8639
mov ecx, 0x792f60
call fcn.0044d5d0
push eax
call fcn.00519790
add esp, 4
mov ecx, dword [ebp - 0x40]
push ecx
call fcn.004ff990
add esp, 4
push eax
lea ecx, [ebp - 0x1c]
call fcn.0044b280
push 0x6845e4
lea ecx, [ebp - 0x1c]
call fcn.0044d5d0
push eax
call fcn.00614ae2
add esp, 8
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x4d85f5
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x44]
push eax
call fcn.005c8704
add esp, 4
mov byte [ebp - 0x1d], 0
lea ecx, [ebp - 0x1c]
call fcn.0044bc10
mov al, byte [ebp - 0x1d]
jmp 0x4d8639
mov ecx, dword [ebp - 0x30]
push ecx
push 1
movzx edx, word [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x28]
push eax
call fcn.00616f1d
add esp, 0x10
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.006149a7
add esp, 4
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
push eax
call fcn.005c8704
add esp, 4
mov byte [ebp - 0x1e], 1
lea ecx, [ebp - 0x1c]
call fcn.0044bc10
mov al, byte [ebp - 0x1e]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c81cf
mov esp, ebp
pop ebp
ret
Function at 0x4d9450
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 8], ecx
lea eax, [ebp - 0xc]
push eax
push 1
call dword [sym.imp.DevIL.dll_ilGenImages]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.DevIL.dll_ilBindImage]
push 0x600
call dword [sym.imp.DevIL.dll_ilEnable]
push 0x602
call dword [sym.imp.DevIL.dll_ilOriginFunc]
mov edx, dword [ebp + 8]
push edx
push 0
call dword [sym.imp.DevIL.dll_ilLoad]
movzx eax, al
test eax, eax
jne 0x4d94a8
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 2
xor al, al
jmp 0x4d95ba
push 0xde4
call dword [sym.imp.DevIL.dll_ilGetInteger]
cmp eax, 0x40
je 0x4d94c8
mov edx, dword [ebp + 0xc]
mov dword [edx], 3
xor al, al
jmp 0x4d95ba
push 0xde5
call dword [sym.imp.DevIL.dll_ilGetInteger]
cmp eax, 0x80
je 0x4d94ea
mov eax, dword [ebp + 0xc]
mov dword [eax], 4
xor al, al
jmp 0x4d95ba
lea ecx, [ebp - 0xc]
push ecx
push 1
call dword [sym.imp.DevIL.dll_ilDeleteImages]
call dword [sym.imp.DevIL.dll_ilShutDown]
push 0x68469c
mov edx, dword [ebp + 8]
push edx
call fcn.00614ae2
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4d951f
mov eax, dword [ebp + 0xc]
mov dword [eax], 2
push 2
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.00615d31
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
call fcn.006163cf
add esp, 4
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x380], eax
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.00615d31
add esp, 0xc
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x380]
push ecx
call fcn.005c86fb
add esp, 4
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov dword [edx + 0x388], eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x380]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x388]
push edx
call fcn.006159a0
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
call fcn.006149a7
add esp, 4
mov ecx, dword [ebp + 8]
push ecx
call fcn.0051f6a0
add esp, 4
mov edx, dword [ebp - 8]
mov dword [edx + 0x384], eax
mov al, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x4daa80
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x663e14
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x71ccd4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.004dcdc0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], vtable.CGuildMarkManager.0
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.004dcd80
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.0044b3b0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.00454e60
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x10]
add ecx, 0x1c
call fcn.0044b310
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
call fcn.004dcda0
mov byte [ebp - 4], 5
push str.mark
call fcn.00618f22
add esp, 4
mov dword [ebp - 0x14], 0
jmp 0x4dab2a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0x1900
jae 0x4dab48
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.00454a40
jmp 0x4dab21
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x4e1e70
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6642ed
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x71ccd4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
je 0x4e1fd8
lea ecx, [ebp - 0x28]
call fcn.0044b310
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.00519530
add esp, 4
push 0x224
push 0
lea ecx, [ebp - 0x24c]
push ecx
call fcn.00602f50
add esp, 0xc
mov dword [ebp - 0x24c], 0x224
lea edx, [ebp - 0x24c]
push edx
mov eax, dword [ebp - 0x254]
push eax
call sub.KERNEL32.dll_Module32First
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0
je 0x4e1fbc
lea ecx, [ebp - 0x28]
call fcn.0044d5d0
push eax
lea ecx, [ebp - 0x12c]
push ecx
call fcn.004e1e10
add esp, 8
test eax, eax
je 0x4e1f7e
lea edx, [ebp - 0x12c]
push edx
mov ecx, dword [ebp + 8]
call fcn.0044bd90
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x238]
mov dword [eax], ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x24d], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0044bc10
mov al, byte [ebp - 0x24d]
jmp 0x4e1fda
push 0x224
push 0
lea eax, [ebp - 0x24c]
push eax
call fcn.00602f50
add esp, 0xc
mov dword [ebp - 0x24c], 0x224
lea ecx, [ebp - 0x24c]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call sub.KERNEL32.dll_Module32Next
mov dword [ebp - 0x258], eax
jmp 0x4e1f10
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0044bc10
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c81cf
mov esp, ebp
pop ebp
ret