joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49dde0
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x563e2d
mov eax, dword fs:[0]
push eax
sub esp, 0x834
mov eax, dword [0x5be984]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x810]
push 0x800
push 0
mov dword [ebp - 0x840], edi
push eax
mov dword [ebp - 0x834], 0
call fcn.004f0120
add esp, 0xc
lea eax, [ebp - 0x810]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
xor eax, eax
mov dword [ebp - 0x818], 0
mov dword [ebp - 0x814], 7
mov word [ebp - 0x828], ax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 7
mov dword [ebp - 4], 1
mov word [edi], ax
lea esi, [ebp - 0x810]
xorps xmm0, xmm0
mov dword [ebp - 0x834], 1
movlpd qword [ebp - 0x830], xmm0
cmp word [ebp - 0x810], ax
je 0x49dffc
mov ebx, dword [ebp - 0x82c]
mov eax, dword [ebp - 0x830]
mov dword [ebp - 0x82c], eax
mov eax, esi
lea edx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x49dec0
sub eax, edx
lea ecx, [ebp - 0x828]
sar eax, 1
push eax
push esi
call fcn.004048f0
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x49dfaa
lea eax, [ebp - 0x828]
push eax
call fcn.0049ea70
add esp, 4
test eax, eax
jne 0x49dfaa
cmp dword [ebp - 0x814], 8
lea ecx, [ebp - 0x83c]
push 0
push 0
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x49dfaa
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
call fcn.0049ef90
add esp, 4
test eax, eax
jne 0x49dfaa
mov ecx, dword [ebp - 0x838]
cmp ecx, ebx
jb 0x49dfaa
mov eax, dword [ebp - 0x83c]
ja 0x49df7c
cmp eax, dword [ebp - 0x82c]
jb 0x49dfaa
mov dword [ebp - 0x82c], eax
mov ebx, ecx
lea eax, [ebp - 0x828]
cmp edi, eax
je 0x49dfaa
cmp dword [ebp - 0x814], 8
mov ecx, edi
push dword [ebp - 0x818]
cmovae eax, dword [ebp - 0x828]
push eax
call fcn.004048f0
mov eax, dword [ebp - 0x818]
lea esi, [esi + eax*2]
add esi, 2
cmp word [esi], 0
jne 0x49deb4
mov edx, dword [ebp - 0x814]
cmp edx, 8
jb 0x49dffc
mov ecx, dword [ebp - 0x828]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x49dff2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x49e01a
push edx
push ecx
call fcn.004845fc
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00484a0d
mov esp, ebp
pop ebp
ret
call fcn.004faed4
int3
Function at 0x49ea70
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x563f3b
mov eax, dword fs:[0]
push eax
sub esp, 0x844
mov eax, dword [0x5be984]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, esi
mov ebx, dword [esi + 0x14]
cmp ebx, 8
jb 0x49eaad
mov eax, dword [esi]
mov edi, dword [esi + 0x10]
push 2
push 0x5744d4
push 0
push edi
push eax
call fcn.0049c1e0
add esp, 0x14
cmp eax, 1
je 0x49eaf0
mov eax, esi
cmp ebx, 8
jb 0x49ead1
mov eax, dword [esi]
push 2
push 0x5744dc
push 0
push edi
push eax
call fcn.0049c1e0
add esp, 0x14
cmp eax, 1
je 0x49eaf0
xor eax, eax
jmp 0x49ecb0
xor eax, eax
mov dword [ebp - 0x830], 0
mov word [ebp - 0x840], ax
mov eax, 2
cmp edi, eax
mov dword [ebp - 0x82c], 7
cmovb eax, edi
cmp ebx, 8
jb 0x49eb1e
mov esi, dword [esi]
push eax
push esi
lea ecx, [ebp - 0x840]
call fcn.004048f0
lea eax, [ebp - 0x840]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x828]
push 0x5744e4
push eax
call fcn.0049c110
push 0x800
lea eax, [ebp - 0x810]
mov dword [ebp - 0x850], 0
push 0
push eax
call fcn.004f0120
add esp, 0x18
lea eax, [ebp - 0x828]
cmp dword [ebp - 0x814], 8
cmovae eax, dword [ebp - 0x828]
push 0
push 0x80
push 3
push 0
push 1
push 0x20000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x49ebf1
push 0
lea eax, [ebp - 0x850]
mov dword [ebp - 0x84c], 0
push eax
push 0x800
lea eax, [ebp - 0x810]
mov dword [ebp - 0x848], 0
push eax
push 0xc
lea eax, [ebp - 0x84c]
mov dword [ebp - 0x80c], 0x800
push eax
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x49ec2b
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov edx, dword [ebp - 0x814]
cmp edx, 8
jb 0x49ec55
mov ecx, dword [ebp - 0x828]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x49ec4b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x49eccc
jmp 0x49ec4b
mov eax, dword [ebp - 0x7f4]
xor esi, esi
cmp eax, 4
je 0x49ec3d
cmp eax, 7
jne 0x49ec42
mov esi, 1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x49ebf3
push edx
push ecx
call fcn.004845fc
add esp, 8
mov edx, dword [ebp - 0x82c]
xor eax, eax
mov dword [ebp - 0x818], 0
mov dword [ebp - 0x814], 7
mov word [ebp - 0x828], ax
cmp edx, 8
jb 0x49ecae
mov ecx, dword [ebp - 0x840]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x49eca4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x49ecd1
push edx
push ecx
call fcn.004845fc
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00484a0d
mov esp, ebp
pop ebp
ret
call fcn.004faed4
call fcn.004faed4
int3
Function at 0x49ef90
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x5be984]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x49f0e3
push ebx
push esi
xor ebx, ebx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x49f05a
push ebx
push esi
call fcn.0051d649
add esp, 8
cmp eax, 0xffffffff
je 0x49f0ce
push 6
push esi
call fcn.0051d649
add esp, 8
cmp eax, 0xffffffff
je 0x49f0ce
push 0x208
lea eax, [ebp - 0x214]
push ebx
push eax
call fcn.004f0120
add esp, 0xc
lea eax, [ebp - 0x214]
push str.SM_testdir.dat
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push ebx
push 0x82
push 2
push ebx
push ebx
push 0x40000000
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x49f04d
push eax
mov ebx, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test ebx, ebx
je 0x49f0ce
lea ecx, [ebp - 0xc]
xorps xmm0, xmm0
mov eax, ecx
movlpd qword [ebp - 0xc], xmm0
mov edx, 4
sub esi, eax
lea eax, [edx + 0x7ffffffa]
test eax, eax
je 0x49f090
movzx eax, word [esi + ecx]
test ax, ax
je 0x49f090
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x49f072
lea eax, [ecx - 2]
test edx, edx
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x49f0bc
push 2
push 0x5744ac
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
pop ebx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00484a0d
mov esp, ebp
pop ebp
ret
pop ebx
mov eax, 2
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00484a0d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.00484a0d
mov esp, ebp
pop ebp
ret
Function at 0x4a2ba0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
xor eax, eax
mov dword [ebp - 0x54], 0x44
mov word [ebp - 0x12], ax
xorps xmm0, xmm0
mov ax, word [ebp + 0x10]
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
movlpd qword [ebp - 0x50], xmm0
push eax
push dword [ebp + 0xc]
movlpd qword [ebp - 0x48], xmm0
push 0
push 0
push 1
push 0
push 0
push dword [ebp + 8]
movlpd qword [ebp - 0x40], xmm0
push 0
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x30], xmm0
movlpd qword [ebp - 0x22], xmm0
movlpd qword [ebp - 0x1a], xmm0
movups xmmword [ebp - 0x10], xmm0
mov dword [ebp - 0x28], 0x81
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4a2c63
mov eax, dword [ebp + 0x14]
push esi
push edi
xor edi, edi
test eax, eax
je 0x4a2c27
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
mov esi, dword [ebp + 0x18]
test esi, esi
je 0x4a2c42
push esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x4a2c42
mov dword [esi], 1
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
xor eax, eax
cmp edi, 0x102
pop edi
setne al
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4a3450
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x5be984]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x4a347c
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00484a0d
mov esp, ebp
pop ebp
ret
push ebx
push esi
xor ebx, ebx
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x4a34f4
push 0x228
lea eax, [ebp - 0x22c]
push ebx
push eax
call fcn.004f0120
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4a34ed
nop
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.0051f9d9
add esp, 8
test eax, eax
je 0x4a34e7
lea eax, [ebp - 0x230]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4a34c0
jmp 0x4a34ed
mov ebx, dword [ebp - 0x228]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
pop ebx
xor ecx, ebp
pop edi
call fcn.00484a0d
mov esp, ebp
pop ebp
ret
Function at 0x4a60a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x564930
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x5be984]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [edi + 8]
mov dword [edi], vtable.base::ThreadPool.0
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [edi + 0x3c]
sub ebx, 1
mov byte [edi + 0x24], 1
mov dword [edi + 0x2c], 0
js 0x4a6125
nop dword [eax + eax]
mov eax, dword [edi + 0x38]
mov eax, dword [eax + ebx*4]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4a6120
lea esi, [eax + 0x24]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc], 0
add ecx, 0x40
call fcn.004e3f40
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub ebx, 1
jns 0x4a60f0
lea eax, [edi + 8]
mov dword [edi + 0x34], 0
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
cmp dword [edi + 0x30], 0
mov ebx, eax
je 0x4a61a4
call esi
mov ecx, dword [edi + 0x48]
sub eax, ebx
cmp eax, ecx
ja 0x4a6186
push ecx
lea ecx, [edi + 0x28]
call fcn.004e41e0
test al, al
je 0x4a6166
cmp dword [edi + 0x30], 0
jne 0x4a6146
jmp 0x4a61a4
mov esi, dword [edi + 0x3c]
sub esi, 1
js 0x4a61a4
nop
mov eax, dword [edi + 0x38]
mov ecx, dword [eax + esi*4]
test ecx, ecx
je 0x4a617f
call fcn.004e3ea0
sub esi, 1
jns 0x4a6170
jmp 0x4a61a4
mov esi, dword [edi + 0x3c]
sub esi, 1
js 0x4a61a4
nop
mov eax, dword [edi + 0x38]
mov ecx, dword [eax + esi*4]
test ecx, ecx
je 0x4a619f
call fcn.004e3ea0
sub esi, 1
jns 0x4a6190
push 0x64
mov byte [edi + 0x24], 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [edi + 0x38]
test eax, eax
je 0x4a61c0
push eax
call fcn.00484613
add esp, 4
lea ecx, [edi + 0x28]
call fcn.004e3d90
lea eax, [edi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea ecx, [edi + 4]
call fcn.004a1c40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b9400
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x567bd8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5be984]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ecx
call fcn.004c1c00
mov esi, dword [ebp + 8]
mov edi, eax
lea ecx, [edi + 0x10]
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], ecx
mov word [edi + 0xc], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
movups xmm0, xmmword [esi]
movups xmmword [ecx], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ecx + 0x10], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov eax, dword [esi + 0x18]
add ecx, 0x18
push fcn.004a8840
push fcn.004a8580
push 4
mov dword [ecx], eax
mov eax, dword [esi + 0x1c]
mov dword [ecx + 4], eax
lea eax, [esi + 0x20]
push 4
push eax
lea eax, [ecx + 8]
mov byte [ebp - 4], 1
push eax
mov dword [ebp + 8], ecx
call fcn.004853de
push fcn.004a8840
push fcn.004a8580
push 4
push 4
lea eax, [esi + 0x30]
push eax
mov eax, dword [ebp + 8]
add eax, 0x18
push eax
call fcn.004853de
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0x40]
mov dword [ecx + 0x28], eax
mov eax, dword [esi + 0x44]
mov dword [ecx + 0x2c], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4c1e80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5be984]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x4c1f21
cmp byte [esi + 0x3d], 0
je 0x4c1f21
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x4c1ed7
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x4c1ee9
sub eax, 1
je 0x4c1eed
sub eax, 2
je 0x4c1f21
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00484a0d
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4c1f0a
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0050d63e
add esp, 0x10
cmp edi, eax
jne 0x4c1ed7
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00484a0d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.00484a0d
mov esp, ebp
pop ebp
ret
Function at 0x4c4470
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x5be984]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x4c44a0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00484a0d
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x4c44dc
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x4c44dc
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00484a0d
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x4c45c1
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x4c4504
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4c4537
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.0052d9ba
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00484a0d
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x4c45c1
cmp eax, 1
jle 0x4c4594
cmp eax, 3
jne 0x4c45c1
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.004b9570
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00484a0d
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4c45b1
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0050d63e
add esp, 0x10
cmp edi, eax
jne 0x4c45c1
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x4c44c7
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00484a0d
mov esp, ebp
pop ebp
ret 4
Function at 0x4c5470
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x4c5494
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004202f0
pop edi
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi + 0x1c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov eax, dword [eax]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], eax
test eax, eax
je 0x4c54b5
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x4c54b7
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test ebx, ebx
jl 0x4c553f
jg 0x4c54ca
test esi, esi
je 0x4c553f
test ecx, ecx
jl 0x4c550c
jg 0x4c54d4
test eax, eax
je 0x4c550c
cmp ebx, ecx
jg 0x4c54e6
jl 0x4c54de
cmp esi, eax
jae 0x4c54e6
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.004ef620
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov eax, dword [edi + 0x2c]
add dword [ebp + 8], ecx
sub esi, ecx
sbb ebx, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x4c5512
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test ebx, ebx
jl 0x4c553f
jg 0x4c551c
test esi, esi
je 0x4c553f
cmp dword [edi + 0x4c], 0
je 0x4c553f
mov ecx, edi
call fcn.004c2bf0
push dword [edi + 0x4c]
push esi
push 1
push dword [ebp + 8]
call fcn.00522450
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
pop esi
sbb edx, ebx
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4c5560
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x4c5584
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004204a0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [eax]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x4c55a5
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x4c55a7
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x4c5624
jg 0x4c55ba
test esi, esi
je 0x4c5624
test ecx, ecx
jl 0x4c55fe
jg 0x4c55c4
test eax, eax
je 0x4c55fe
cmp edi, ecx
jg 0x4c55d6
jl 0x4c55ce
cmp esi, eax
jae 0x4c55d6
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.004ef620
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x4c5601
mov edx, dword [ebp + 8]
test edi, edi
jl 0x4c5624
jg 0x4c560b
test esi, esi
je 0x4c5624
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x4c5624
push eax
push esi
push 1
push edx
call fcn.0050d63e
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4cb3e0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56a308
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x5be984]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp + 8]
mov edi, dword [ecx + 0x30]
sub edi, dword [ecx + 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [ecx + 0x34]
sub eax, dword [ecx + 0x2c]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], eax
movups xmm0, xmmword [ebp - 0x20]
push 0
mov dword [ebp - 0x28], eax
movups xmmword [ebp - 0x20], xmm0
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push dword [ebp - 0x28]
mov dword [ebp - 0x44], eax
push edi
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push dword [ebp - 0x44]
mov dword [ebp - 0x38], eax
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
push 0
mov dword [ebp - 0x34], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x44]
neg eax
push 0
push eax
mov eax, dword [ebp - 0x20]
neg eax
mov dword [ebp - 4], 0
push eax
push esi
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
mov edi, dword [ebp - 0x2c]
lea ecx, [ebp - 0x20]
push ecx
push esi
mov ecx, edi
mov eax, dword [edi]
call dword [eax]
cmp esi, dword [ebp - 0x24]
jne 0x4cb4dd
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push esi
call dword [sym.imp.GDI32.dll_OffsetViewportOrgEx]
push esi
lea ecx, [edi + 0x10]
call fcn.004e77d0
mov eax, dword [sym.imp.GDI32.dll_SetViewportOrgEx]
push 0
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push esi
call eax
jmp 0x4cb51b
mov eax, dword [sym.imp.GDI32.dll_SetViewportOrgEx]
push 0
push 0
push 0
push esi
call eax
push esi
lea ecx, [edi + 0x10]
call fcn.004e77d0
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
sub eax, edx
mov ecx, dword [ebp - 0x20]
push 0xcc0020
push 0
push 0
push esi
push eax
mov eax, dword [ebp - 0x18]
sub eax, ecx
push eax
push edx
push ecx
push dword [ebp - 0x24]
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
push dword [ebp - 0x34]
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x4cb548
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
test esi, esi
je 0x4cb553
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00484a0d
mov esp, ebp
pop ebp
ret 8

Function at 0x4cb880
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x4cc040
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
lea ecx, [esi + 0x108]
call fcn.004daa60
push 6
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret