joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4757c0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x6422e3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.0046a130
lea eax, [esp + 0xc]
push eax
xor ebx, ebx
push 0x29
mov dword [esi], 0x655000
mov dword [esi + 0x148], ebx
mov ecx, dword [0x6a09fc]
push 0x5d
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x18], ebx
call fcn.004d67c0
mov ecx, dword [esp + 0xc]
push ebx
call fcn.0041ef50
push 0xa2
push 0xc2
push 0x79
push 0x65
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.user32.dll_SetRect]
mov ecx, dword [0x6a09fc]
push ebx
push 3
call fcn.004d6b60
mov ecx, dword [esp + 0x10]
push eax
push ebx
push ebx
lea edx, [esp + 0x28]
push edx
call fcn.0041f9b0
push 0x60
call fcn.00614bf2
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x30], 1
je 0x475874
mov ecx, eax
call fcn.0049ec40
mov edi, eax
jmp 0x475876
xor edi, edi
mov eax, dword [esp + 0xc]
push eax
mov ecx, edi
mov byte [esp + 0x34], bl
call fcn.0049f010
mov ecx, dword [0x6a07e4]
push edi
call fcn.004a0440
push edi
mov ecx, esi
call fcn.0046a740
mov ecx, dword [esp + 0xc]
cmp ecx, ebx
je 0x4758ac
mov edx, dword [ecx]
push 1
call dword [edx]
mov dword [esp + 0xc], ebx
mov dword [0x69f214], esi
cmp dword [esi + 0x48], 0x5d
je 0x4758ca
mov eax, dword [esi]
push esi
mov ecx, esi
mov dword [esi + 0x48], 0x5d
call dword [eax + 0xc0]
mov ecx, dword [esi + 0x4c]
mov eax, 0x29
cmp ecx, eax
je 0x4758e4
mov edx, dword [esi]
push esi
mov ecx, esi
mov dword [esi + 0x4c], eax
call dword [edx + 0xc0]
mov eax, dword [0x69f1cc]
cmp eax, 0x500
jg 0x475930
je 0x475920
cmp eax, 0x320
je 0x475910
cmp eax, 0x400
jne 0x475945
mov dword [esi + 0x2c], 0xf1
mov dword [esi + 0x30], 0x120
jmp 0x475945
mov dword [esi + 0x2c], 0xb2
mov dword [esi + 0x30], 0xe0
jmp 0x475945
mov dword [esi + 0x2c], 0x13a
mov dword [esi + 0x30], 0x171
jmp 0x475945
cmp eax, 0x640
jne 0x475945
mov dword [esi + 0x2c], 0x192
mov dword [esi + 0x30], 0x1cf
push ebx
mov ecx, esi
call fcn.0046a700
mov ecx, esi
mov dword [esi + 0xc4], ebx
call fcn.00475700
mov ecx, dword [esp + 0x28]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret

Function at 0x4782f0
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, ecx
xor eax, eax
lea ecx, [esi + 0x1a94]
jmp 0x478300
cmp dword [ecx], 0
jne 0x478327
inc eax
add ecx, 0x49
cmp eax, 3
jl 0x478300
mov dword [esi + 0x19ec], 2
mov ecx, dword [0x6a09dc]
push 2
call fcn.004d0ac0
pop esi
ret
imul eax, eax, 0x49
push edi
lea edi, [eax + esi + 0x1aab]
movsx eax, byte [edi]
push eax
mov ecx, esi
call fcn.004780e0
mov ecx, dword [esi + 4]
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [0x6a09dc]
push 3
call fcn.004d0ac0
mov eax, dword [esi + 0x1be4]
test eax, eax
jne 0x47837a
movsx eax, byte [edi]
mov ecx, dword [0x6a09e0]
push eax
call fcn.0045c4e0
mov ecx, dword [0x6a09dc]
call fcn.004d0aa0
test eax, eax
jl 0x478386
pop edi
mov ecx, 0x69ee60
pop esi
jmp fcn.00467d10
pop edi
pop esi
ret
Function at 0x47c280
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x642596
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov word [esi + 0x2c], bx
push edi
mov dword [esp + 0xc], esi
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
lea ecx, [esi + 0x50]
mov dword [esp + 0x18], ebx
call fcn.004136a0
lea edi, [esi + 0x19f4]
mov ecx, edi
mov byte [esp + 0x18], 1
call fcn.00468ea0
mov dword [edi + 4], eax
mov dword [edi + 8], ebx
mov eax, 1
mov dword [esi + 0x1b9c], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x30], 0xea60
mov word [esi + 0x2c], bx
mov dword [esi + 0x19d8], ebx
mov dword [esi + 0x19c0], ebx
mov dword [esi + 0x19c4], ebx
mov dword [esi + 0x19c8], ebx
mov dword [esi + 0x19cc], ebx
mov dword [esi + 0x19d0], ebx
mov dword [esi + 0x19dc], ebx
mov dword [esi + 0x19f0], ebx
mov dword [esi + 0x19e8], ebx
mov dword [esi + 0x1a00], ebx
mov dword [esi + 0x1a08], ebx
mov dword [esi + 0x1a04], ebx
mov dword [esi + 0x1a14], ebx
mov dword [esi + 0x1a18], ebx
mov dword [esi + 0x1a0c], ebx
mov dword [esi + 0x1a10], ebx
mov dword [esi + 0x1a2c], eax
mov dword [esi + 0x1a40], eax
mov dword [esi + 0x1a30], ebx
mov dword [esi + 0x1a34], ebx
mov dword [esi + 0x1a48], ebx
mov dword [esi + 0x1a3c], eax
mov dword [esi + 0x1a44], ebx
mov dword [esi + 0x1a50], ebx
mov dword [esi + 0x1a54], ebx
mov dword [esi + 0x1a58], ebx
mov dword [esi + 0x1a5c], ebx
mov dword [esi + 0x1a60], ebx
mov word [esi + 0x1a64], bx
mov dword [esi + 0x1a68], ebx
mov dword [esi + 0x1a6c], ebx
mov dword [esi + 0x1a70], ebx
mov dword [esi + 0x1a74], ebx
mov byte [esi + 0x1a78], bl
mov byte [esi + 0x1a79], bl
mov dword [esi + 0x1a80], ebx
mov dword [esi + 0x1a84], ebx
mov dword [esi + 0x1a88], ebx
mov dword [esi + 0x1a8c], ebx
mov dword [esi + 0x1a90], eax
mov dword [esi + 0x1bb4], ebx
mov dword [esi + 0x1bb0], eax
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 0x1bbc], ebx
mov dword [esi + 0x1bc4], ebx
mov dword [esi + 0x1bc8], ebx
mov dword [esi + 0x1bcc], ebx
mov dword [esi + 0x1bd0], ebx
mov dword [esi + 0x1bd4], ebx
mov dword [esi + 0x1bd8], ebx
mov dword [esi + 0x1bdc], ebx
mov dword [esi + 0x1be0], ebx
mov dword [esi + 0x1be4], ebx
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x1bf4], ebx
mov dword [esi + 0x1bf8], ebx
mov dword [esi + 0x1bfc], ebx
mov byte [esi + 0x19d4], bl
pop edi
mov dword [0x69f324], esi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x49ec40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x643e28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.00424010
xor edi, edi
lea ecx, [esi + 0x4c]
mov dword [esp + 0x14], edi
mov dword [esi], 0x655fb8
call fcn.00423e90
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x34], 0x80
mov dword [esi + 0x44], 0x19
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4a7540
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x14c]
test ecx, ecx
je 0x4a7552
call fcn.004a4590
mov ecx, dword [esi + 0x150]
test ecx, ecx
pop esi
je 0x4a7562
jmp fcn.004a8920
ret
Function at 0x4ca7b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [0x69f324]
push esi
mov esi, ecx
mov ecx, dword [eax + 0x1a40]
test ecx, ecx
je 0x4ca7cf
mov ecx, dword [0x94119c]
push ecx
push 0
push 0
jmp 0x4ca7e3
mov edx, dword [0x94119c]
mov eax, dword [0x941184]
mov ecx, dword [0x941180]
push edx
push eax
push ecx
mov ecx, 0x69f328
call fcn.005275d0
mov ecx, esi
call fcn.004ca2b0
pop esi
mov ecx, 0x69f328
jmp fcn.0052bdc0
Function at 0x4d1000
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x645a33
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.0046a130
lea eax, [esp + 0xc]
push eax
xor ebx, ebx
push 0x29
mov dword [esi], 0x6586b0
mov dword [esi + 0x148], ebx
mov ecx, dword [0x6a09fc]
push 0x5d
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x18], ebx
call fcn.004d67c0
mov ecx, dword [esp + 0xc]
push ebx
call fcn.0041ef50
push 0xa2
push 0xc2
push 0x79
push 0x65
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.user32.dll_SetRect]
mov ecx, dword [0x6a09fc]
push ebx
push 3
call fcn.004d6b60
mov ecx, dword [esp + 0x10]
push eax
push ebx
push ebx
lea edx, [esp + 0x28]
push edx
call fcn.0041f9b0
push 0x60
call fcn.00614bf2
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x30], 1
je 0x4d10b4
mov ecx, eax
call fcn.0049ec40
mov edi, eax
jmp 0x4d10b6
xor edi, edi
mov eax, dword [esp + 0xc]
push eax
mov ecx, edi
mov byte [esp + 0x34], bl
call fcn.0049f010
mov ecx, dword [0x6a07e4]
push edi
call fcn.004a0440
push edi
mov ecx, esi
call fcn.0046a740
mov ecx, dword [esp + 0xc]
cmp ecx, ebx
je 0x4d10ec
mov edx, dword [ecx]
push 1
call dword [edx]
mov dword [esp + 0xc], ebx
mov dword [0x6a09e4], esi
cmp dword [esi + 0x48], 0x5d
je 0x4d110a
mov eax, dword [esi]
push esi
mov ecx, esi
mov dword [esi + 0x48], 0x5d
call dword [eax + 0xc0]
mov ecx, dword [esi + 0x4c]
mov eax, 0x29
cmp ecx, eax
je 0x4d1124
mov edx, dword [esi]
push esi
mov ecx, esi
mov dword [esi + 0x4c], eax
call dword [edx + 0xc0]
mov eax, dword [0x69f1cc]
cmp eax, 0x500
jg 0x4d1170
je 0x4d1160
cmp eax, 0x320
je 0x4d1150
cmp eax, 0x400
jne 0x4d1185
mov dword [esi + 0x2c], 0x25b
mov dword [esi + 0x30], 0x22b
jmp 0x4d1185
mov dword [esi + 0x2c], 0x1cd
mov dword [esi + 0x30], 0x1b2
jmp 0x4d1185
mov dword [esi + 0x2c], 0x2fc
mov dword [esi + 0x30], 0x2c3
jmp 0x4d1185
cmp eax, 0x640
jne 0x4d1185
mov dword [esi + 0x2c], 0x3c8
mov dword [esi + 0x30], 0x36e
push ebx
mov ecx, esi
call fcn.0046a700
mov ecx, esi
mov dword [esi + 0xc4], ebx
call fcn.004d0f40
mov ecx, dword [esp + 0x28]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x4d3000
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x645ba1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword [esp + 0x2c]
push ebp
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x14], esi
call fcn.0042b320
xor ebp, ebp
mov dword [esi], 0x658990
mov dword [esp + 0x30], ebp
mov dword [esi + 0xcc], ebp
mov dword [esi + 0xd0], ebp
mov dword [esi + 0xd4], ebp
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [0x6a09fc]
push 0x1b8
push pe_nt_image_headers32
mov byte [esp + 0x3c], 1
mov dword [esp + 0x18], ebp
call fcn.004d67c0
mov ecx, dword [esp + 0xc]
push ebp
call fcn.0041ef50
push 0x2b
push pe_nt_image_headers32
push 0x26
push ebp
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.user32.dll_SetRect]
xor edi, edi
push ebx
mov edi, edi
mov ecx, dword [0x6a09fc]
push ebp
push 2
mov ebx, edi
call fcn.004d6b60
mov ecx, dword [esp + 0x14]
push eax
push edi
push ebp
lea eax, [esp + 0x2c]
push eax
call fcn.0041f9b0
add edi, 5
cmp edi, 0x1b3
jl 0x4d3090
push 0x34
mov edi, pe_nt_image_headers32
push edi
push 0x2a
push ebp
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.user32.dll_SetRect]
mov ecx, dword [0x6a09fc]
push ebp
push 2
call fcn.004d6b60
mov ecx, dword [esp + 0x14]
push eax
push ebx
push ebp
lea edx, [esp + 0x2c]
push edx
call fcn.0041f9b0
mov ecx, dword [esp + 0x10]
push 1
push 0xc0000000
push 0xffb99e6b
push 0x185
push 0xf3
push 0x1c
push 6
call fcn.0041f8f0
mov ecx, dword [esp + 0x10]
push 1
push 0xc0000000
push 0xff959595
push 0x12
push 0x44
push 5
push 0x54
call fcn.0041f8f0
push 0x60
call fcn.00614bf2
add esp, 4
mov dword [esp + 0x18], eax
cmp eax, ebp
mov byte [esp + 0x34], 2
je 0x4d3153
mov ecx, eax
call fcn.0049ec40
mov ebx, eax
jmp 0x4d3155
xor ebx, ebx
mov eax, dword [esp + 0x10]
push eax
mov ecx, ebx
mov byte [esp + 0x38], 1
call fcn.0049f010
mov ecx, dword [0x6a07e4]
push ebx
call fcn.004a0440
push ebx
mov ecx, esi
call fcn.0042aa60
mov ecx, dword [esp + 0x10]
cmp ecx, ebp
pop ebx
je 0x4d318d
mov edx, dword [ecx]
push 1
call dword [edx]
mov dword [esp + 0xc], ebp
cmp dword [esi + 0x48], edi
je 0x4d31a0
mov eax, dword [esi]
push esi
mov ecx, esi
mov dword [esi + 0x48], edi
call dword [eax + 0xc0]
mov ecx, dword [esi + 0x4c]
mov eax, 0x1b8
cmp ecx, eax
je 0x4d31ba
mov edx, dword [esi]
push esi
mov ecx, esi
mov dword [esi + 0x4c], eax
call dword [edx + 0xc0]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x38], eax
mov dword [0x6a09ec], esi
mov dword [esi + 0xec], ebp
mov dword [esi + 0xf0], ebp
mov dword [esi + 0xfc], ebp
mov dword [esi + 0xf4], ebp
mov dword [esi + 0xf8], ebp
mov dword [esi + 0xd8], ebp
mov dword [esi + 0xdc], ebp
mov dword [esi + 0xe0], ebp
mov dword [esi + 0xe4], ebp
mov dword [esi + 0xe8], ebp
pop edi
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x28
ret 4
Function at 0x4e27b0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
mov eax, dword [0x69f324]
push ebp
mov dword [esp + 0xc], eax
mov eax, dword [eax + 0x10ec]
push esi
mov esi, dword [eax]
cmp esi, eax
mov ebp, ecx
mov dword [esp + 0xc], 0
je 0x4e293d
push ebx
push edi
lea ebx, [ebx]
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0x1a8]
mov eax, dword [eax + 0x1ac]
mov edx, dword [ecx + 4]
mov bx, word [ecx + 0x12]
mov ecx, dword [eax + 8]
mov edi, dword [eax + 0x10]
mov eax, dword [ebp]
sub edi, ecx
mov ecx, ebp
mov dword [esp + 0x10], edx
call dword [eax + 0x40]
mov edx, dword [esp + 0x10]
mov ecx, eax
movzx eax, byte [edx + 5]
imul eax, eax, 0x1a
sub eax, edi
dec eax
cdq
sub eax, edx
mov edx, dword [esi + 8]
sar eax, 1
add ecx, eax
shr bl, 4
and bl, 0xf
movzx ax, bl
imul eax, eax, 0x1a
lea ecx, [ecx + eax + 0x6f]
mov word [edx + 8], cx
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0x1a8]
mov eax, dword [eax + 0x1ac]
mov bx, word [ecx + 0x12]
mov ecx, dword [eax + 0xc]
mov edi, dword [eax + 0x14]
mov edx, dword [ebp]
sub edi, ecx
mov ecx, ebp
call dword [edx + 0x48]
mov edx, dword [esp + 0x10]
mov ecx, eax
movzx eax, byte [edx + 6]
imul eax, eax, 0x1a
sub eax, edi
dec eax
cdq
sub eax, edx
mov edx, dword [esi + 8]
mov edi, dword [esp + 0x18]
sar eax, 1
add ecx, eax
mov bl, bh
and bl, 0xf
movzx ax, bl
imul eax, eax, 0x1a
lea ecx, [ecx + eax + 0x43]
mov word [edx + 0xa], cx
mov eax, dword [edi + 0x19e8]
test eax, eax
jne 0x4e291a
mov eax, dword [0x940f30]
test eax, eax
je 0x4e291a
mov eax, dword [0x940f34]
test eax, eax
jne 0x4e291a
mov eax, dword [0x940f24]
test eax, eax
jne 0x4e291a
mov ecx, dword [esi + 8]
call fcn.004380a0
test eax, eax
je 0x4e291a
mov eax, dword [esi + 8]
push 1
push eax
mov ecx, edi
call fcn.00478000
mov ecx, dword [edi + 0x19e8]
push ecx
push 0
lea ecx, [edi + 0x50]
call fcn.0040c260
cmp esi, dword [edi + 0x10ec]
mov ebx, dword [esi]
je 0x4e290e
mov edx, dword [esi + 4]
mov dword [edx], ebx
mov eax, dword [esi]
mov ecx, dword [esi + 4]
push esi
mov dword [eax + 4], ecx
call fcn.00615a1d
mov eax, dword [edi + 0x10f0]
add esp, 4
dec eax
mov dword [edi + 0x10f0], eax
mov esi, ebx
mov dword [esp + 0x14], 1
jmp 0x4e291c
mov esi, dword [esi]
cmp esi, dword [edi + 0x10ec]
jne 0x4e27e0
mov eax, dword [esp + 0x14]
test eax, eax
pop edi
pop ebx
je 0x4e293d
pop esi
mov eax, 1
pop ebp
add esp, 0xc
ret
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret
Function at 0x4e5a78
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6467a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.0046a130
push 0x8a
xor edi, edi
push 0x9b
push 0x61
push edi
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x38], edi
mov dword [esi], 0x659a40
mov dword [esi + 0x148], edi
mov dword [esi + 0x14c], edi
mov dword [esi + 0x150], edi
mov dword [esi + 0x154], edi
mov dword [esi + 0x158], edi
call dword [sym.imp.user32.dll_SetRect]
push 0x3a
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [0x6a09fc]
call fcn.004d6b80
push eax
mov ecx, esi
call fcn.0046a740
mov ecx, dword [esi + 0x48]
mov eax, 0x97
cmp ecx, eax
je 0x4e5afb
mov edx, dword [esi]
push esi
mov ecx, esi
mov dword [esi + 0x48], eax
call dword [edx + 0xc0]
mov ecx, dword [esi + 0x4c]
mov eax, 0x29
cmp ecx, eax
je 0x4e5b15
mov dword [esi + 0x4c], eax
mov eax, dword [esi]
push esi
mov ecx, esi
call dword [eax + 0xc0]
call fcn.0042d3e0
mov eax, dword [eax + 0xc]
sub eax, dword [esi + 0x48]
cdq
sub eax, edx
sar eax, 1
mov dword [esi + 0x2c], eax
call fcn.0042d3e0
mov eax, dword [eax + 0x10]
sub eax, dword [esi + 0x4c]
cdq
sub eax, edx
sar eax, 1
push edi
mov ecx, esi
mov dword [esi + 0x30], eax
call fcn.0046a700
mov ecx, esi
mov dword [0x8b47d0], esi
call fcn.004e5290
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x4e68e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x646893
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
call fcn.0046a130
lea eax, [esp + 0xc]
push eax
xor ebx, ebx
push 0x29
mov dword [esi], 0x659d58
mov dword [esi + 0x148], ebx
mov ecx, dword [0x6a09fc]
push 0x5d
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x18], ebx
call fcn.004d67c0
mov ecx, dword [esp + 0xc]
push ebx
call fcn.0041ef50
push 0xa2
push 0xc2
push 0x79
push 0x65
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.user32.dll_SetRect]
mov ecx, dword [0x6a09fc]
push ebx
push 3
call fcn.004d6b60
mov ecx, dword [esp + 0x10]
push eax
push ebx
push ebx
lea edx, [esp + 0x28]
push edx
call fcn.0041f9b0
push 0x60
call fcn.00614bf2
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x30], 1
je 0x4e6994
mov ecx, eax
call fcn.0049ec40
mov edi, eax
jmp 0x4e6996
xor edi, edi
mov eax, dword [esp + 0xc]
push eax
mov ecx, edi
mov byte [esp + 0x34], bl
call fcn.0049f010
mov ecx, dword [0x6a07e4]
push edi
call fcn.004a0440
push edi
mov ecx, esi
call fcn.0046a740
mov ecx, dword [esp + 0xc]
cmp ecx, ebx
je 0x4e69cc
mov edx, dword [ecx]
push 1
call dword [edx]
mov dword [esp + 0xc], ebx
mov dword [0x8b47e4], esi
cmp dword [esi + 0x48], 0x5d
je 0x4e69ea
mov eax, dword [esi]
push esi
mov ecx, esi
mov dword [esi + 0x48], 0x5d
call dword [eax + 0xc0]
mov ecx, dword [esi + 0x4c]
mov eax, 0x29
cmp ecx, eax
je 0x4e6a04
mov edx, dword [esi]
push esi
mov ecx, esi
mov dword [esi + 0x4c], eax
call dword [edx + 0xc0]
mov eax, dword [0x69f1cc]
cmp eax, 0x500
jg 0x4e6a50
je 0x4e6a40
cmp eax, 0x320
je 0x4e6a30
cmp eax, 0x400
jne 0x4e6a65
mov dword [esi + 0x2c], 0x2c1
mov dword [esi + 0x30], 0xe7
jmp 0x4e6a65
mov dword [esi + 0x2c], 0x21e
mov dword [esi + 0x30], 0xaa
jmp 0x4e6a65
mov dword [esi + 0x2c], 0x381
mov dword [esi + 0x30], 0x121
jmp 0x4e6a65
cmp eax, 0x640
jne 0x4e6a65
mov dword [esi + 0x2c], 0x469
mov dword [esi + 0x30], 0x16c
push ebx
mov ecx, esi
call fcn.0046a700
mov ecx, esi
mov dword [esi + 0xc4], ebx
call fcn.004e6810
mov ecx, dword [esp + 0x28]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x4f0ee0
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x646e98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
mov dword [edi + 4], 2
mov ecx, dword [0x65a3d8]
lea eax, [edi + 0x7538]
mov dword [eax], ecx
mov dl, byte [0x65a3dc]
xor esi, esi
push esi
push 0x80
mov byte [eax + 4], dl
mov ecx, dword [0x65a3d0]
push 3
lea eax, [edi + 0x7547]
mov dword [eax], ecx
mov dl, byte [0x65a3d4]
push esi
push 1
mov byte [eax + 4], dl
mov eax, dword [esp + 0x50]
push 0x80000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 0x10], ebx
jne 0x4f0f70
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
push ebp
mov dword [esp + 0x28], ebx
lea ecx, [esp + 0x18]
push ecx
push ebx
mov dword [esp + 0x40], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], esi
call dword [sym.imp.kernel32.dll_GetFileSize]
mov ebp, eax
push ebp
call fcn.00614c96
mov esi, eax
add esp, 4
mov dword [esp + 0x10], esi
mov dword [esp + 0x2c], esi
push 0
lea edx, [esp + 0x20]
push edx
push ebp
push esi
push ebx
mov byte [esp + 0x4c], 1
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x4f0fea
test esi, esi
je 0x4f0fc8
push esi
call fcn.00616a81
add esp, 4
test ebx, ebx
je 0x4f0fd3
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
pop ebp
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
mov ebx, dword [esi]
add ebx, 8
lea eax, [ebx + esi]
mov dword [esp + 0x20], eax
mov eax, dword [eax - 4]
push eax
call fcn.00614c96
mov esi, eax
add esp, 4
test esi, esi
jne 0x4f103b
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00616a81
mov eax, dword [esp + 0x18]
add esp, 4
test eax, eax
je 0x4f1024
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
pop ebp
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
mov dword [esp + 0x24], esi
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x40]
push edx
push esi
sub ebp, ebx
push ebp
push eax
mov byte [esp + 0x48], 2
mov dword [esp + 0x50], 0xf4240
call fcn.00558ca0
mov ecx, dword [esp + 0x50]
add esp, 0x10
push 1
push 0
push ecx
mov ecx, dword [0x8b481c]
push esi
call fcn.00558c10
mov eax, dword [esp + 0x40]
test eax, eax
jbe 0x4f10ac
nop
mov edx, dword [edi]
imul edx, edx, 0xf
push 0xf
lea eax, [edx + edi + 8]
push esi
push eax
call fcn.00616b50
mov eax, dword [esp + 0x4c]
mov ebp, dword [edi]
add esp, 0xc
sub eax, 0xf
inc ebp
add esi, 0xf
test eax, eax
mov dword [edi], ebp
mov dword [esp + 0x40], eax
ja 0x4f1080
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4f10bd
push eax
call fcn.00616a81
add esp, 4
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00616a81
mov eax, dword [esp + 0x18]
add esp, 4
test eax, eax
je 0x4f10d9
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov ecx, dword [esp + 0x30]
pop ebp
pop edi
pop esi
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 4
Function at 0x4f28c0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x1c
push edi
mov edi, dword [esp + 0x24]
push 0x1c
lea eax, [esp + 8]
push eax
push edi
call dword [sym.imp.kernel32.dll_VirtualQuery]
test eax, eax
jne 0x4f28df
pop edi
add esp, 0x1c
ret
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push esi
mov esi, dword [esp + 0xc]
push ecx
push edx
push esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4f28ff
pop esi
pop edi
add esp, 0x1c
ret
mov eax, dword [esi + 0x3c]
movzx ecx, word [eax + esi + 0x14]
add eax, esi
push ebx
push ebp
movzx ebp, word [eax + 6]
sub edi, esi
xor ebx, ebx
test ebp, ebp
lea ecx, [ecx + eax + 0x18]
jbe 0x4f2940
lea eax, [ecx + 0x10]
mov edi, edi
mov ecx, dword [eax]
mov edx, dword [eax - 8]
cmp ecx, edx
mov esi, dword [eax - 4]
ja 0x4f292e
mov ecx, edx
cmp edi, esi
jb 0x4f2938
add ecx, esi
cmp edi, ecx
jbe 0x4f294a
inc ebx
add eax, 0x28
cmp ebx, ebp
jb 0x4f2920
pop ebp
pop ebx
pop esi
xor eax, eax
pop edi
add esp, 0x1c
ret
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
inc ebx
pop ebp
mov dword [edx], ebx
sub edi, esi
pop ebx
mov dword [eax], edi
pop esi
mov eax, 1
pop edi
add esp, 0x1c
ret

Function at 0x4f2b30
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x408
mov eax, dword [0x68e698]
mov ecx, dword [esp + 0x40c]
mov dword [esp + 0x404], eax
push esi
lea eax, [esp + 0x414]
push eax
push ecx
lea edx, [esp + 0x10]
push edx
call fcn.0061814d
mov edx, dword [0x8bc44c]
add esp, 0xc
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push esi
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.kernel32.dll_WriteFile]
mov ecx, dword [esp + 0x408]
mov eax, esi
pop esi
call fcn.006162c0
add esp, 0x408
ret