joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48f720
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
push dword [0xc828d8]
call fcn.004abf94
mov esi, eax
test esi, esi
je 0x48f7fa
cmp dword [ebp + 0xc], 0
je 0x48f76c
push 4
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x48f75d
cmp dword [esi + 0x1c], 0
jne 0x48f75d
push eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x48f7fa
test byte [ebp + 0x10], 3
je 0x48f787
push 4
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindow]
push eax
push dword [ebp + 0x10]
push dword [esi]
call fcn.0049085a
cmp dword [esi + 0x3c], 0xffffffff
push ebx
je 0x48f7ac
xor ebx, ebx
cmp dword [esi + 0x3c], 0x1000000
sete bl
xor ecx, ecx
cmp dword [esi + 0x3c], 0x20000000
sete cl
or dword [esi + 0x3c], 0xffffffff
jmp 0x48f7c0
push dword [esi]
call dword [sym.imp.USER32.dll_IsZoomed]
push dword [esi]
mov ebx, eax
call dword [sym.imp.USER32.dll_IsIconic]
mov ecx, eax
test dword [ebp + 0x10], 0x2000000
je 0x48f7dd
test ebx, ebx
je 0x48f7d1
push 8
jmp 0x48f7e3
neg ecx
sbb ecx, ecx
and ecx, 3
add ecx, 4
jmp 0x48f7f0
test ebx, ebx
je 0x48f7e6
push 3
pop ecx
jmp 0x48f7f0
xor eax, eax
test ecx, ecx
setne al
lea ecx, [eax + 1]
push ecx
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebx
pop esi
pop ebp
ret 0xc
Function at 0x4909ed
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
push edi
xor edi, edi
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, dword [esp + 0x3c]
mov ebx, eax
and dword [esp + 0x10], edi
push str.PB_WindowID
push ebp
call dword [sym.imp.USER32.dll_GetPropW]
mov esi, eax
push 9
pop eax
test esi, esi
je 0x490a85
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x490a82
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x14], eax
jne 0x490a82
lea eax, [esi - 1]
push eax
push dword [0xc828d8]
call fcn.004abf94
mov edi, eax
mov dword [esp + 0x10], 1
xor eax, eax
push 9
cmp dword [edi + 0x10], eax
jle 0x490a84
mov edx, dword [edi + 4]
xor ecx, ecx
pop esi
cmp word [ecx + edx + 2], si
jne 0x490a79
mov esi, 0xfa01
push 9
cmp word [ecx + edx + 4], si
je 0x490b6c
pop esi
inc eax
add ecx, 6
cmp eax, dword [edi + 0x10]
jl 0x490a5f
push 9
pop eax
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
test ebx, ebx
je 0x490b2b
push eax
call esi
test al, al
jns 0x490b2b
push 0x11
call esi
test al, al
js 0x490b2b
push 0x10
call esi
test al, al
js 0x490b2b
push 0x12
call esi
test al, al
js 0x490b2b
push 0x10
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
cmp dword [esp + 0x10], 0
jne 0x490b2b
push 5
lea eax, [esp + 0x1c]
push str.RichE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
je 0x490aff
push 4
lea eax, [esp + 0x1c]
push str.RICHE
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
jne 0x490b16
push 0
push 0
push 0x44e
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, 0x800
je 0x490b76
lea eax, [esp + 0x18]
push str.Scintilla
push eax
call sub.MSVCRT.dll_wcscmp
pop ecx
pop ecx
test eax, eax
je 0x490b76
test ebp, ebp
je 0x490b4f
push 0x11
call esi
test al, al
js 0x490b47
push 0x10
call esi
test al, al
js 0x490b47
push 0x12
call esi
test al, al
jns 0x490b4f
push 1
push ebp
call fcn.00490b82
test ebx, ebx
je 0x490b63
push str.PB_Hotkey
push ebx
call dword [sym.imp.USER32.dll_GetPropW]
test eax, eax
jne 0x490b76
test edi, edi
je 0x490b76
mov eax, dword [edi + 8]
jmp 0x490b78
and dword [esp + 0x14], 0
jmp 0x490a84
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4

Function at 0x490e79
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x490ea2
test byte [esp + 8], 2
je 0x490e96
push pe_nt_image_headers32
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x490ea4
xor eax, eax
ret 8
Function at 0x490eb5
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x490ffd
xor ecx, ecx
cmp word [eax], cx
je 0x490ffd
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x490f0e
cmp eax, 3
jne 0x490f48
cmp word [esp + 0xa], 0x3a
jne 0x490f48
cmp eax, 2
jne 0x490f2c
lea eax, [esp + 8]
push 0x546e3c
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x490ffd
push 0xfffffffffffffffe
pop edi
jmp 0x490ffd
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x490f5d
cmp ax, bx
jne 0x490f67
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x490f50
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x490fa6
test byte [esp + 0x21c], 0x10
je 0x490f8d
push 0xfffffffffffffffe
pop edi
jmp 0x490f9d
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x490ffb
cmp word [esp + 0x10], bp
jne 0x490fb4
cmp word [esp + 0x12], bp
je 0x490fd3
cmp word [esp + 0x10], bx
jne 0x490fc2
cmp word [esp + 0x12], bx
je 0x490fd3
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x490ffb
cmp word [esp + 0x12], ax
jne 0x490ffb
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x490fe8
test al, 0x10
je 0x490ffb
jmp 0x490ff8
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x490ffb
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4
Function at 0x4912f1
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
cmp dword [ebp + 8], 0
je 0x491369
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [ebp - 4], ax
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcslen
lea ecx, [ebp - 0x20c]
add esp, 0x10
lea eax, [ecx + eax*2]
jmp 0x49134a
movzx ecx, word [eax - 2]
cmp ecx, 0x20
je 0x491347
cmp ecx, 0x5c
je 0x491347
cmp ecx, 0x2f
jne 0x491354
add eax, 0xfffffffe
lea ecx, [ebp - 0x20c]
cmp eax, ecx
ja 0x491334
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x49136b
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x491411
Capabilities:
Check if file exists

Disassembly:
xor eax, eax
push ebp
mov ebp, eax
mov eax, dword [0xc820b4]
push esi
test eax, eax
jne 0x491436
push fcn.0049153e
push 0x10
push 0x258
call fcn.004ac067
mov dword [0xc820b4], eax
push dword [esp + 0xc]
push eax
call fcn.004abfd3
mov esi, eax
test esi, esi
je 0x491537
push edi
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x491458
mov edi, 0x52fbb4
push ebx
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x491468
xor eax, eax
cmp word [ebx], ax
jne 0x49146d
mov ebx, 0x546e24
push edi
call sub.MSVCRT.dll_wcslen
push ebx
mov dword [esp + 0x24], eax
call sub.MSVCRT.dll_wcslen
add eax, dword [esp + 0x24]
pop ecx
pop ecx
lea eax, [eax*2 + 4]
push eax
xor eax, eax
push eax
push dword [0xc06444]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x18], eax
test eax, eax
je 0x49151e
push edi
push eax
call sub.MSVCRT.dll_wcscpy
mov eax, dword [esp + 0x24]
pop ecx
pop ecx
test eax, eax
je 0x4914ce
cmp word [edi + eax*2 - 2], 0x5c
mov edi, dword [esp + 0x18]
je 0x4914d2
push 0x546e3c
push edi
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
jmp 0x4914d2
mov edi, dword [esp + 0x18]
push ebx
push edi
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esi + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x4914f6
xor eax, eax
mov ebp, esi
mov dword [esi + 4], eax
jmp 0x49150c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x49150a
mov dword [esi + 4], 1
mov ebp, esi
xor eax, eax
push edi
push eax
push dword [0xc06444]
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebp, ebp
jne 0x491535
cmp dword [esp + 0x14], 0xffffffff
je 0x491529
mov esi, dword [esp + 0x14]
push esi
push dword [0xc820b4]
call fcn.004abf45
pop ebx
pop edi
pop esi
mov eax, ebp
pop ebp
ret 0xc

Function at 0x491695
Capabilities:
Copy file

Disassembly:
cmp dword [esp + 4], 0
je 0x4916b5
cmp dword [esp + 8], 0
je 0x4916b5
push 0
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x4916b7
xor eax, eax
ret 8

Function at 0x4916ff
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x491715
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x491718
or eax, 0xffffffff
ret 4
Function at 0x49171b
Capabilities:
Set file attributes

Disassembly:
xor eax, eax
cmp dword [esp + 4], eax
je 0x491729
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
ret 8

Function at 0x49172c
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x491801
push ebx
push edi
push pe_nt_image_headers32
push 3
push edi
push 3
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x491800
push esi
mov esi, dword [ebp + 0x10]
push esi
call fcn.00494186
push esi
mov word [ebp - 0x20], ax
call fcn.004941ac
push esi
mov word [ebp - 0x1e], ax
call fcn.004941ce
push esi
mov word [ebp - 0x1c], ax
call fcn.004941ef
push esi
mov word [ebp - 0x1a], ax
call fcn.00494210
push esi
mov word [ebp - 0x18], ax
call fcn.00494231
push esi
mov word [ebp - 0x16], ax
call fcn.00494252
mov word [ebp - 0x14], ax
xor eax, eax
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
cmp dword [ebp + 0xc], 1
mov eax, edi
mov ecx, edi
pop esi
jne 0x4917df
lea eax, [ebp - 8]
jmp 0x4917ed
cmp dword [ebp + 0xc], 2
jne 0x4917ea
lea ecx, [ebp - 8]
jmp 0x4917ed
lea edi, [ebp - 8]
push ecx
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x491a10
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x491a4c
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4

Function at 0x492390
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
mov dword [esp + 4], 0
test esi, esi
je 0x4923f5
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4923ed
push dword [esp + 0x10]
push dword [0xc82d1c]
call fcn.004abf94
test eax, eax
je 0x4923e3
cmp dword [eax + 4], 0
je 0x4923d2
push edi
push esi
push eax
call fcn.00492aa0
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea ecx, [esp + 0xc]
push ecx
push edi
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
pop edi
xor eax, eax
pop esi
pop ecx
ret 0xc
xor eax, eax
pop esi
pop ecx
ret 0xc
Function at 0x4924d0
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
cmp dword [esi + 0x14], 0
jne 0x4924f1
push esi
call fcn.00491a10
mov dword [esi + 0x14], 1
mov dword [esi + 0xc], 0
mov ebx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
mov eax, dword [esi + 0x10]
cmp ebx, edi
jl 0x492565
add eax, dword [esi + 4]
mov ecx, edi
sub eax, ebx
dec ecx
je 0x492552
dec ecx
je 0x49253d
sub ecx, 2
je 0x49252a
push edi
push eax
push dword [esp + 0x1c]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [eax]
mov eax, dword [esp + 0x14]
mov dword [eax], ecx
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov cx, word [eax]
mov eax, dword [esp + 0x14]
mov word [eax], cx
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [esp + 0x14]
mov dl, byte [eax]
mov eax, edi
mov byte [ecx], dl
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
push ebp
mov ebp, dword [esp + 0x18]
sub eax, ebx
add eax, dword [esi + 4]
push ebx
push eax
push ebp
call sub.MSVCRT.dll_memcpy
mov eax, dword [esi + 8]
add esp, 0xc
sub edi, ebx
add ebp, ebx
push 0
cmp edi, eax
jl 0x4925aa
lea eax, [esp + 0x18]
push eax
push edi
push ebp
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
pop ebp
pop edi
mov dword [esi + 0xc], 0
add eax, ebx
pop esi
pop ebx
ret 0xc
lea ecx, [esp + 0x18]
push ecx
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
cmp edi, eax
jle 0x4925cb
mov edi, eax
push edi
push dword [esi + 4]
push ebp
call sub.MSVCRT.dll_memcpy
sub dword [esi + 0xc], edi
lea eax, [ebx + edi]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x4925f0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push 0x1000
push 0
push dword [0xc06444]
mov dword [esp + 0x14], 0x1000
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x492774
mov cl, byte [esp + 3]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x28]
push esi
push edi
mov esi, edx
mov edi, edi
cmp ebp, 0xffffffff
je 0x49263e
test ebp, ebp
je 0x4926e0
dec ebp
cmp dword [ebx + 4], 0
je 0x492657
push 1
lea eax, [esp + 0x17]
push eax
push ebx
call fcn.004924d0
mov dword [esp + 0x14], eax
jmp 0x492671
push 0
lea eax, [esp + 0x18]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
mov cl, byte [esp + 0x13]
cmp eax, 1
jne 0x4926e0
test cl, cl
je 0x492685
mov byte [esi], cl
inc esi
mov cl, byte [esp + 0x13]
mov eax, dword [esp + 0x18]
mov edi, esi
mov edx, dword [esp + 0x20]
dec eax
sub edi, edx
cmp edi, eax
jle 0x4926c0
mov eax, dword [esp + 0x18]
add eax, 0x1000
push eax
push edx
push 8
push dword [0xc06444]
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov cl, byte [esp + 0x13]
mov edx, eax
mov dword [esp + 0x20], edx
lea esi, [edi + edx]
test cl, cl
je 0x4926e0
cmp dword [esp + 0x2c], 0
jne 0x492630
cmp cl, 0xd
je 0x4926e7
cmp cl, 0xa
jne 0x492630
dec esi
jmp 0x492757
cmp dword [esp + 0x2c], 0
jne 0x492757
cmp cl, 0xa
jne 0x4926ef
dec esi
jmp 0x492757
cmp cl, 0xd
jne 0x492757
dec esi
cmp dword [ebx + 4], 0
je 0x49270e
push 1
lea eax, [esp + 0x17]
push eax
push ebx
call fcn.004924d0
mov dword [esp + 0x14], eax
jmp 0x492724
push 0
lea eax, [esp + 0x18]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x492757
cmp dword [ebx + 4], 0
je 0x492736
inc dword [ebx + 0xc]
jmp 0x492757
push 1
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], 0xffffffff
push eax
push 0xffffffffffffffff
push dword [ebx]
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x34]
mov ecx, esi
sub ecx, dword [esp + 0x20]
pop edi
mov dword [eax], ecx
mov eax, dword [esp + 0x1c]
mov byte [esi], 0
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
xor eax, eax
add esp, 0x14
ret 0x10
Function at 0x492780
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
push 0x1000
push 0
push dword [0xc06444]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov dword [esp + 8], ecx
test ecx, ecx
je 0x49292d
mov ax, word [esp]
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x2c]
push esi
push edi
mov edi, ecx
mov dword [esp + 0x20], 0x1000
mov dword [esp + 0x1c], 0x7ff
cmp ebp, 0xffffffff
je 0x4927d4
test ebp, ebp
je 0x49288d
dec ebp
cmp dword [ebx + 4], 0
je 0x4927ed
push 2
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.004924d0
mov dword [esp + 0x14], eax
jmp 0x492807
push 0
lea eax, [esp + 0x18]
push eax
push 2
lea eax, [esp + 0x1c]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
cmp eax, 2
mov ax, word [esp + 0x10]
jne 0x49288d
test ax, ax
je 0x492821
mov word [edi], ax
add edi, 2
mov ax, word [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov esi, edi
mov edx, dword [esp + 0x1c]
sub esi, ecx
sar esi, 1
cmp esi, edx
jle 0x492868
mov eax, dword [esp + 0x20]
add edx, 0x800
add eax, 0x1000
mov dword [esp + 0x1c], edx
push eax
push ecx
push 8
push dword [0xc06444]
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, eax
mov ax, word [esp + 0x10]
mov dword [esp + 0x18], ecx
lea edi, [ecx + esi*2]
test ax, ax
je 0x49288d
cmp dword [esp + 0x30], 0
jne 0x4927c6
cmp ax, 0xd
je 0x492894
cmp ax, 0xa
jne 0x4927c6
sub edi, 2
jmp 0x49290c
cmp dword [esp + 0x30], 0
jne 0x49290c
cmp ax, 0xa
jne 0x49289f
sub edi, 2
jmp 0x49290c
cmp ax, 0xd
jne 0x49290c
sub edi, 2
cmp dword [ebx + 4], 0
je 0x4928c1
push 2
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.004924d0
mov dword [esp + 0x14], eax
jmp 0x4928d7
push 0
lea eax, [esp + 0x18]
push eax
push 2
lea eax, [esp + 0x1c]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp word [esp + 0x10], 0xa
je 0x49290c
cmp dword [ebx + 4], 0
je 0x4928eb
add dword [ebx + 0xc], 2
jmp 0x49290c
push 1
lea eax, [esp + 0x28]
mov dword [esp + 0x24], 0xfffffffe
push eax
push 0xfffffffffffffffe
push dword [ebx]
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x38]
mov ecx, edi
sub ecx, dword [esp + 0x18]
sar ecx, 1
mov dword [eax], ecx
xor eax, eax
mov word [edi], ax
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
xor eax, eax
add esp, 0x18
ret 0x10
Function at 0x492940
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push 0x1000
push 0
push dword [0xc06444]
mov dword [esp + 0x10], 0x1000
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x492a90
mov eax, dword [esp + 0x1c]
mov cl, byte [esp + 3]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, edx
cmp edi, 0xffffffff
je 0x49298c
test edi, edi
je 0x4929fd
dec edi
push esi
push ebp
call fcn.00492c20
mov dword [esp + 0x20], eax
test eax, eax
jne 0x49299f
xor cl, cl
jmp 0x4929a1
mov cl, byte [esi]
mov edx, dword [esp + 0x1c]
add esi, eax
mov eax, dword [esp + 0x14]
mov ebx, esi
sub ebx, edx
mov byte [esp + 0x13], cl
add eax, 0xfffffffb
cmp ebx, eax
jle 0x4929e4
mov eax, dword [esp + 0x14]
add eax, 0x1000
push eax
push edx
push 8
push dword [0xc06444]
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov cl, byte [esp + 0x13]
mov edx, eax
mov dword [esp + 0x1c], edx
lea esi, [ebx + edx]
mov eax, dword [esp + 0x2c]
test cl, cl
je 0x4929fd
test eax, eax
jne 0x492982
cmp cl, 0xd
je 0x492a01
cmp cl, 0xa
jne 0x492982
dec esi
jmp 0x492a73
test eax, eax
jne 0x492a73
cmp cl, 0xa
jne 0x492a09
dec esi
jmp 0x492a73
cmp cl, 0xd
jne 0x492a73
dec esi
cmp dword [ebp + 4], 0
je 0x492a28
push 1
lea eax, [esp + 0x17]
push eax
push ebp
call fcn.004924d0
mov dword [esp + 0x20], eax
jmp 0x492a3f
push 0
lea eax, [esp + 0x24]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x492a73
cmp dword [ebp + 4], 0
je 0x492a51
inc dword [ebp + 0xc]
jmp 0x492a73
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0xffffffff
push eax
push 0xffffffffffffffff
push dword [ebp]
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x34]
mov ecx, esi
sub ecx, dword [esp + 0x1c]
pop edi
mov dword [eax], ecx
mov eax, dword [esp + 0x18]
mov byte [esi], 0
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
xor eax, eax
add esp, 0x14
ret 0x10
Function at 0x492aa0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp dword [esi + 0x1c], 0
jne 0x492ba7
cmp dword [esi + 0x14], 1
jne 0x492aeb
mov eax, dword [esi + 0xc]
lea ecx, [esp + 0xc]
push 1
neg eax
cdq
push ecx
push eax
push dword [esi]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
push edi
mov edi, dword [esp + 0x20]
cmp eax, edi
jle 0x492b68
mov ecx, dword [esi + 8]
add ecx, dword [esi + 4]
sub ecx, eax
mov eax, edi
dec eax
je 0x492b53
dec eax
je 0x492b3c
sub eax, 2
je 0x492b27
push edi
push dword [esp + 0x20]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov ax, word [eax]
mov word [ecx], ax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov al, byte [eax]
mov byte [ecx], al
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
push esi
call fcn.00491a10
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x492b95
push 0
lea eax, [esp + 0xc]
push eax
push edi
push dword [esp + 0x28]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0xc
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
push edi
push dword [esp + 0x20]
add ecx, eax
jmp 0x492b11
xor eax, eax
pop esi
add esp, 0xc
ret 0xc