joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e3ad0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cff2b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
push dword [ebp + 8]
mov dword [ebp - 0x10], esi
lea ecx, [esi + 4]
call fcn.004e3510
lea ecx, [esi + 8]
mov dword [ebp - 4], 0
mov dword [esi], vtable.sync_o::mutex.0
call fcn.004dc420
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi + 4], eax
test eax, eax
jne 0x4e3b30
push str.CreateMutex
lea ecx, [esi + 4]
call fcn.004e3370
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4e3b52
push 0x6194fc
lea ecx, [esi + 8]
call fcn.004dd080
test al, al
je 0x4e3b52
mov byte [esi + 0x20], 1
push 0
push 0
push 0
push 0
push 4
push 6
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x4e3c30
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.004f4750
mov dword [esi], vtable.tcp_socket.0
mov byte [esi + 0x3c], 1
mov eax, dword [0x653fa8]
test eax, eax
jne 0x4e3c75
lea eax, [esp + 8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
inc dword [0x653fa8]
mov eax, esi
pop esi
add esp, 0x194
ret
inc eax
mov dword [0x653fa8], eax
mov eax, esi
pop esi
add esp, 0x194
ret

Function at 0x4e3cb0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cff48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
mov bh, byte [ebp + 8]
xor eax, eax
push esi
test bh, bh
mov esi, ecx
push edi
sete al
lea ecx, [ebp - 0x24]
push str.changing_socket_mode_to
mov dword [ebp + 8], eax
call fcn.004dc100
mov eax, str.non_blocking
mov dword [ebp - 4], 0
test bh, bh
lea ecx, [ebp - 0x24]
mov edi, str.blocking
cmove edi, eax
push edi
call fcn.004dd1c0
lea ecx, [ebp - 0x24]
call fcn.004dc430
push eax
lea eax, [ebp + 8]
push eax
push 0x8004667e
push dword [esi + 0x38]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
push eax
mov ecx, esi
call fcn.004e4210
mov bl, al
test bl, bl
je 0x4e3d4b
mov edx, dword [esi + 0x24]
test edx, edx
je 0x4e3d48
mov ecx, dword [edx]
push edi
push str.socket_mode_is_set_to__s_n
push edx
call dword [ecx + 0x18]
add esp, 0xc
mov byte [esi + 0x3c], bh
mov eax, dword [ebp - 0x10]
cmp eax, 0x10
jb 0x4e3d60
inc eax
lea ecx, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
call fcn.0040ee30
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x4e3e10
Capabilities:
Get socket status

Disassembly:
sub esp, 0x210
push ebx
push esi
mov esi, dword [esp + 0x21c]
mov eax, 0x10624dd3
mul esi
push edi
shr edx, 6
mov edi, ecx
imul eax, edx, 0x3e8
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], edx
push ecx
push 0
sub esi, eax
mov dword [esp + 0x124], 1
imul eax, esi, 0x3e8
lea ecx, [esp + 0x124]
push ecx
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], eax
mov eax, dword [edi + 0x38]
mov dword [esp + 0x12c], eax
mov dword [esp + 0x28], eax
inc eax
push eax
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x4e3e99
lea eax, [esp + 0x14]
push eax
push dword [edi + 0x38]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x4e3e99
xor bl, bl
jmp 0x4e3e9b
mov bl, 1
lea eax, [esp + 0x118]
push eax
push dword [edi + 0x38]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x4e3ec1
test bl, bl
jne 0x4e3ec1
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x210
ret 4
pop edi
pop esi
mov al, 1
pop ebx
add esp, 0x210
ret 4

Function at 0x4e3ed0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
push ebx
push esi
mov esi, dword [esp + 0x118]
mov eax, 0x10624dd3
mul esi
push edi
shr edx, 6
mov ebx, ecx
imul eax, edx, 0x3e8
mov dword [esp + 0x14], 1
mov dword [esp + 0xc], edx
mov edi, dword [ebx + 0x38]
mov dword [esp + 0x18], edi
sub esi, eax
imul eax, esi, 0x3e8
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push 0
lea eax, [esp + 0x1c]
push eax
push 0
lea eax, [edi + 1]
push eax
call dword [sym.imp.WS2_32.dll_select]
lea eax, [esp + 0x14]
push eax
push dword [ebx + 0x38]
call sub.WS2_32.dll___WSAFDIsSet
neg eax
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
add esp, 0x10c
ret 4

Function at 0x4e4080
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x10
push esi
push edi
push dword [esp + 0x24]
mov eax, 2
mov edi, ecx
mov word [esp + 0xc], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0xa], ax
call fcn.004df1e0
mov esi, dword [esp + 0x20]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], edx
test esi, esi
je 0x4e4122
mov ecx, str.BROADCAST
mov eax, esi
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4e40e0
test dl, dl
je 0x4e40dc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4e40e0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4e40c0
xor eax, eax
jmp 0x4e40e5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4e40f3
mov dword [esp + 0xc], 0xffffffff
jmp 0x4e40fe
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [esp + 0xc], eax
push 0x10
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x24]
push 0
push dword [eax + 0xc]
push dword [eax + 8]
push dword [edi + 0x38]
call dword [sym.imp.WS2_32.dll_sendto]
pop edi
pop esi
add esp, 0x10
ret 0xc
mov eax, dword [esp + 0x1c]
push 0
push dword [eax + 0xc]
push dword [eax + 8]
push dword [edi + 0x38]
call dword [sym.imp.WS2_32.dll_send]
pop edi
pop esi
add esp, 0x10
ret 0xc
Function at 0x4e4140
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
mov ebx, ecx
push edi
push esi
mov dword [esp + 0x14], 0x10
call fcn.005021d8
add esp, 4
mov ebp, eax
call fcn.004df1e0
mov dword [ebx + 0x10], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
mov dword [ebx + 0x14], edx
push eax
push 0
push esi
push ebp
push dword [ebx + 0x38]
call dword [sym.imp.WS2_32.dll_recvfrom]
mov edi, eax
test edi, edi
jne 0x4e419f
mov eax, dword [ebx + 0x24]
test eax, eax
je 0x4e41d3
mov ecx, dword [eax]
push str.Connection_has_been_gracefully_closed_n
push eax
call dword [ecx + 0x18]
add esp, 8
jmp 0x4e41d3
push str.receiving_from_socket
push edi
mov ecx, ebx
call fcn.004e4210
test al, al
jne 0x4e41c8
mov ecx, dword [ebx + 0x24]
test ecx, ecx
je 0x4e41d3
mov eax, dword [ecx]
push edi
push str.recvfrom___return__d_n
push ecx
call dword [eax + 8]
add esp, 0xc
jmp 0x4e41d3
mov ecx, dword [esp + 0x28]
push edi
push ebp
call fcn.004dde30
push ebp
call fcn.00501fb5
mov esi, dword [esp + 0x34]
add esp, 4
test esi, esi
je 0x4e41fd
push dword [esp + 0x18]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
sub esi, eax
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [esi + eax - 1], cl
test cl, cl
jne 0x4e41f0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc

Function at 0x4e4510
Capabilities:
Terminate thread

Disassembly:
push esi
push dword [esp + 8]
mov esi, ecx
call fcn.004e44c0
test al, al
je 0x4e4526
mov al, 1
pop esi
ret 8
push ebx
push dword [esp + 0x10]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
mov ecx, esi
setne bl
call fcn.004e4480
mov al, bl
pop ebx
pop esi
ret 8

Function at 0x4e4760
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cffdf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
lea eax, [ebp - 0x3c]
push esi
push eax
call fcn.004df5e0
add esp, 4
push 0x5e7f00
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 0
call fcn.004dc420
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.004e08f0
add esp, 0xc
push eax
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 1
call fcn.004dc160
mov eax, dword [ebp - 0x10]
mov byte [ebp - 4], 0
cmp eax, 0x10
jb 0x4e47cf
inc eax
lea ecx, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
call fcn.0040ee30
push 0x5e7f04
lea ecx, [ebp - 0x3c]
call fcn.004dc430
push eax
call fcn.0059be30
mov esi, eax
add esp, 8
test esi, esi
je 0x4e480b
push dword [ebp + 0xc]
call fcn.004df8e0
push eax
push dword [ebp + 8]
push str.Thread__s_catch_unexpected_error__n_s_n
push esi
call fcn.0040e130
push esi
call fcn.0059bc17
add esp, 0x18
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4e83b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d025e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
mov eax, 1
xor ecx, ecx
mov dword [ebp - 0x10], esi
mov edx, 8
mul edx
push edi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005021d8
xorps xmm0, xmm0
mov dword [esi + 0x54], eax
add esp, 4
movq qword [eax], xmm0
mov dword [esi + 0x58], 1
push dword [ebp + 0x18]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0
call fcn.004f3c60
mov eax, dword [ebp + 0xc]
test eax, eax
mov edi, dword [ebp - 0x1c]
cmove eax, edi
mov byte [ebp - 4], 1
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov al, byte [ebp + 0x14]
mov byte [esi + 0x50], al
mov eax, dword [ebp + 0x10]
push 0x50
mov dword [esi + 8], eax
call fcn.005021d8
push 0x50
push 0
push eax
mov dword [esi + 0x14], eax
call fcn.005889a0
push 0x50
mov dword [esi + 0x3c], 0x14
mov dword [esi + 0x28], 0
call fcn.005021d8
push 0x50
push 0
push eax
mov dword [esi + 0x18], eax
call fcn.005889a0
push 0x10
mov dword [esi + 0x40], 0x14
mov dword [esi + 0x2c], 0
call fcn.005021d8
xorps xmm0, xmm0
mov dword [esi + 0x20], eax
push 0x28
movups xmmword [eax], xmm0
mov dword [esi + 0x48], 4
mov dword [esi + 0x34], 0
call fcn.005021d8
xorps xmm0, xmm0
mov dword [esi + 0x1c], eax
push 0x28
movups xmmword [eax], xmm0
movups xmmword [eax + 0x10], xmm0
movq qword [eax + 0x20], xmm0
mov dword [esi + 0x44], 0xa
mov dword [esi + 0x30], 0
call fcn.005021d8
xorps xmm0, xmm0
mov dword [esi + 0x24], eax
add esp, 0x2c
movups xmmword [eax], xmm0
movups xmmword [eax + 0x10], xmm0
movq qword [eax + 0x20], xmm0
mov dword [esi + 0x4c], 0xa
mov dword [esi + 0x38], 0
mov dword [esi + 0x5c], 0
mov eax, dword [ebp + 0xc]
mov ecx, esi
mov dword [esi + 0x64], 1
mov byte [esi + 0x60], 0
mov byte [esi + 0x68], 0
mov dword [esi], 0
mov dword [esi + 4], 0
push dword [ebp + 0x10]
test eax, eax
je 0x4e851c
push eax
jmp 0x4e8521
push str._root___
call fcn.004e87b0
cmp byte [ebp - 0x14], 0
je 0x4e8549
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4e853c
push eax
call fcn.00501fb5
add esp, 4
test edi, edi
je 0x4e8549
push edi
call fcn.00501fb5
add esp, 4
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4e9450
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d02df
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
push edi
push 0
mov edi, ecx
call fcn.004ebb30
mov esi, eax
mov eax, 1
test esi, esi
cmove esi, eax
push esi
call fcn.005021d8
push esi
mov ebx, eax
push 0
push ebx
mov dword [ebp - 0x14], ebx
call fcn.005889a0
add esp, 0x10
mov dword [ebp - 0x10], esi
push ebx
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.004ebb30
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e94b1
sub ecx, edx
cmp byte [ecx + ebx - 1], 0x2d
jne 0x4e94d3
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e94c6
sub ecx, edx
mov byte [ecx + ebx - 1], al
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e94d8
sub ecx, edx
mov ecx, ebx
lea edx, [ecx + 1]
je 0x4e9500
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e94e8
push dword [ebp + 8]
push 0x5e8644
jmp 0x4e950f
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e9500
push dword [ebp + 8]
push 0x5e8648
sub ecx, edx
lea eax, [ecx + ebx]
push eax
call fcn.0040e160
add esp, 0xc
lea ecx, [ebx - 1]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4e9520
mov eax, dword [str..xmltmp]
mov dword [ecx], eax
mov eax, dword [0x5e8650]
push ebx
mov dword [ecx + 4], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
mov esi, eax
call fcn.00501fb5
mov ecx, dword [ebp - 0xc]
add esp, 4
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4e9730
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d030b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov eax, dword [ecx + 0x14]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
lea edx, [ebx*4]
cmp dword [edx + eax], 0
mov dword [ebp + 8], edx
je 0x4e977b
mov eax, 1
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
push esi
push edi
push 0
call fcn.004ebb30
mov esi, eax
mov eax, 1
test esi, esi
cmove esi, eax
push esi
call fcn.005021d8
push esi
mov edi, eax
push 0
push edi
mov dword [ebp - 0x18], edi
call fcn.005889a0
add esp, 0x10
mov dword [ebp - 0x14], esi
mov esi, dword [ebp - 0x10]
mov ecx, esi
push edi
mov dword [ebp - 4], 0
call fcn.004ebb30
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e97c1
sub ecx, edx
cmp byte [edi + ecx - 1], 0x2d
jne 0x4e97e3
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e97d6
sub ecx, edx
mov byte [ecx + edi - 1], al
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e97e8
sub ecx, edx
mov ecx, edi
lea edx, [ecx + 1]
je 0x4e9807
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e97f8
push ebx
push 0x5e8644
jmp 0x4e9814
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e9807
push ebx
push 0x5e8648
sub ecx, edx
lea eax, [ecx + edi]
push eax
call fcn.0040e160
add esp, 0xc
lea ecx, [edi - 1]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4e9825
mov eax, dword [str..xmltmp]
mov dword [ecx], eax
mov eax, dword [0x5e8650]
push 0x5e8654
push edi
mov dword [ecx + 4], eax
call fcn.0059be30
add esp, 8
test eax, eax
jne 0x4e9854
xor esi, esi
jmp 0x4e98b0
push eax
call fcn.0059bc17
add esp, 4
lea ecx, [ebp - 0x34]
push 0
push 0
push 0
push edi
call fcn.004efef0
push 0
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 1
call fcn.004f09f0
cmp eax, 2
jne 0x4e9883
xor esi, esi
jmp 0x4e98a8
lea ecx, [ebp - 0x34]
call fcn.004f10d0
mov ecx, dword [esi + 0x14]
mov edx, dword [ebp + 8]
push esi
mov dword [edx + ecx], eax
mov ecx, eax
call fcn.004edb10
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, 1
lea ecx, [ebp - 0x34]
call fcn.004f0110
push edi
call fcn.00501fb5
mov ecx, dword [ebp - 0xc]
add esp, 4
mov eax, esi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4eb6c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5d048f
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, ecx
call fcn.004e98d0
cmp dword [ebp + 0x1c], 0
jne 0x4eb74b
mov esi, dword [ebp + 0x18]
mov edi, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
test esi, esi
je 0x4eb70b
push dword [ebp + 0x20]
mov ecx, esi
push 0
push edi
push 0
push eax
call fcn.004e7d70
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push ebx
push eax
call fcn.004ec7e0
add esp, 0x18
test esi, esi
je 0x4eb84b
push dword [ebp + 0x20]
mov ecx, esi
push 0
push edi
push 1
push dword [ebp + 8]
call fcn.004e7d70
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x1c
mov ecx, ebx
call fcn.004ea070
test eax, eax
mov dword [ebp - 0x10], eax
mov esi, eax
mov ecx, 1
cmove esi, ecx
push esi
call fcn.005021d8
push esi
mov edi, eax
push 0
push edi
mov dword [ebp - 0x1c], edi
call fcn.005889a0
add esp, 0x10
mov dword [ebp - 0x18], esi
mov eax, dword [ebp + 0x18]
mov esi, dword [ebp + 0x1c]
mov dword [ebp - 4], 0
test eax, eax
je 0x4eb79c
push dword [ebp + 0x20]
mov ecx, eax
push esi
push 1
push 0
push edi
call fcn.004e7d70
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push ebx
push edi
call fcn.004ec7e0
mov ecx, dword [ebp + 0x18]
add esp, 0x18
test ecx, ecx
je 0x4eb7c5
push dword [ebp + 0x20]
push esi
push 1
push 1
push edi
call fcn.004e7d70
mov esi, dword [ebp - 0x10]
mov eax, 1
add esi, 0x64
cmove esi, eax
push esi
call fcn.005021d8
push esi
mov ebx, eax
push 0
push ebx
mov dword [ebp - 0x14], ebx
call fcn.005889a0
add esp, 0x10
mov dword [ebp - 0x10], esi
mov esi, edi
mov byte [ebp - 4], 1
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x4eb7f6
sub esi, ecx
mov ecx, dword [ebp + 0x1c]
push 0
mov edx, dword [ecx]
lea eax, [esi + 0x64]
push eax
push ebx
push 0
push esi
push edi
call dword [edx + 4]
mov ecx, dword [ebp + 0x14]
test ecx, ecx
jne 0x4eb82a
push dword [ebp + 8]
push eax
push 1
push ebx
call fcn.0059ce08
add esp, 0x10
jmp 0x4eb83c
cmp ecx, 1
jne 0x4eb83c
push eax
push ebx
push dword [ebp + 8]
call fcn.00588420
add esp, 0xc
push ebx
call fcn.00501fb5
push edi
call fcn.00501fb5
add esp, 8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x4ebbd0
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
lea ecx, [edi + 1]
nop word [eax + eax]
mov al, byte [edi]
inc edi
test al, al
jne 0x4ebbe0
sub edi, ecx
mov eax, 1
mov edx, 2
lea edi, [edi*2 + 0x64]
test edi, edi
mov esi, edi
cmove esi, eax
xor ecx, ecx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005021d8
lea ecx, [esi + esi]
mov ebx, eax
push ecx
push 0
push ebx
call fcn.005889a0
add esp, 0x10
push edi
push ebx
push 0xffffffffffffffff
push dword [esp + 0x20]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, ebx
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4ebc40
push dword [esp + 0x10]
sub eax, edx
sar eax, 1
add eax, eax
push eax
push 1
push ebx
call fcn.0059ce08
push ebx
call fcn.00501fb5
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x4f05a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5d08d3
push eax
mov dword fs:[0], esp
sub esp, 0x10
cmp byte [ebp + 0x14], 0
push ebx
je 0x4f05d1
push 0x5e8838
push dword [ebp + 8]
call fcn.0059be19
jmp 0x4f05de
push 0x5e8654
push dword [ebp + 8]
call fcn.0059be30
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x4f05f6
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push esi
push edi
push 2
push 0
push ebx
call fcn.0059c11c
push ebx
call fcn.0059c715
push 0
mov esi, eax
push 0
push ebx
mov dword [ebp + 0x14], esi
call fcn.0059c11c
add esp, 0x1c
cmp dword [ebp + 0xc], 0
jne 0x4f0683
push 8
call fcn.00501ce1
mov edi, eax
add esp, 4
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
mov eax, 1
test edi, edi
je 0x4f0661
add esi, 0x20
cmove esi, eax
push esi
call fcn.005021d8
push esi
push 0
push eax
mov dword [edi], eax
call fcn.005889a0
mov dword [edi + 4], esi
add esp, 0x10
mov esi, dword [ebp + 0x14]
jmp 0x4f0663
xor edi, edi
push ebx
push esi
push 1
push dword [edi]
mov dword [ebp - 4], 0xffffffff
call fcn.0059cb20
push ebx
call fcn.0059bc17
add esp, 0x14
jmp 0x4f0730
lea eax, [esi + 0x20]
mov ecx, 1
test eax, eax
mov dword [ebp - 0x10], eax
mov esi, eax
cmove esi, ecx
push esi
call fcn.005021d8
push esi
push 0
push eax
mov dword [ebp - 0x1c], eax
call fcn.005889a0
mov dword [ebp - 0x18], esi
push 8
mov dword [ebp - 4], 1
call fcn.00501ce1
mov edi, eax
add esp, 0x14
mov dword [ebp - 0x14], edi
mov byte [ebp - 4], 2
test edi, edi
je 0x4f06ee
mov esi, dword [ebp - 0x10]
mov eax, 1
test esi, esi
cmove esi, eax
push esi
call fcn.005021d8
push esi
push 0
push eax
mov dword [edi], eax
call fcn.005889a0
add esp, 0x10
mov dword [edi + 4], esi
jmp 0x4f06f0
xor edi, edi
mov esi, dword [ebp + 0x14]
push ebx
push esi
push 1
push dword [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.0059cb20
push ebx
call fcn.0059bc17
mov ecx, dword [ebp + 0xc]
add esp, 0x14
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ecx]
push 0
push esi
push dword [edi]
push 0
push esi
push ebx
call dword [eax + 8]
push ebx
mov dword [ebp - 4], 0xffffffff
call fcn.00501fb5
add esp, 4
mov eax, dword [edi]
mov dword [ebp - 0x10], eax
cmp byte [eax], 0xff
jne 0x4f07c1
cmp byte [eax + 1], 0xfe
jne 0x4f07c1
push 8
call fcn.00501ce1
mov ebx, eax
add esp, 4
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 3
test ebx, ebx
je 0x4f0788
lea esi, [esi*4 + 0x20]
mov eax, 1
test esi, esi
cmove esi, eax
push esi
call fcn.005021d8
push esi
push 0
push eax
mov dword [ebx], eax
call fcn.005889a0
add esp, 0x10
mov dword [ebx + 4], esi
jmp 0x4f078a
xor ebx, ebx
mov eax, dword [ebp + 0x14]
push 0
push 0
lea eax, [eax*4 + 0x20]
push eax
push dword [ebx]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [edi]
call fcn.00501fb5
push 8
push edi
call fcn.00501d14
add esp, 0xc
mov edi, ebx
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4f07e0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5d08e5
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4f08af
push 0x1c
call fcn.00501ce1
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
je 0x4f0824
mov ecx, eax
call fcn.004efee0
mov esi, eax
jmp 0x4f0826
xor esi, esi
push 0
push 0
push 1
push edi
mov ecx, esi
call fcn.004f0a30
push 0
mov ecx, esi
call fcn.004f09f0
cmp eax, 2
jne 0x4f086a
test esi, esi
je 0x4f0858
mov ecx, esi
call fcn.004f0110
push 0x1c
push esi
call fcn.00501d14
add esp, 8
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.004f1150
test eax, eax
je 0x4f0842
push 0
mov ecx, esi
call fcn.004f1150
mov ecx, eax
call fcn.004e9bc0
mov edi, eax
test esi, esi
je 0x4f089d
mov ecx, esi
call fcn.004f0110
push 0x1c
push esi
call fcn.00501d14
add esp, 8
mov eax, edi
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push ebx
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
test ebx, ebx
jne 0x4f08df
call dword [sym.imp.USER32.dll_CloseClipboard]
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
mov esi, edi
lea eax, [esi + 1]
nop dword [eax]
mov cl, byte [esi]
inc esi
test cl, cl
jne 0x4f08f0
sub esi, eax
mov eax, 1
add esi, 0x64
cmove esi, eax
push esi
call fcn.005021d8
push esi
push 0
push eax
mov dword [ebp - 0x14], eax
call fcn.005889a0
add esp, 0x10
mov dword [ebp - 0x10], esi
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 4], 0
sub ecx, edi
nop dword [eax + eax]
mov al, byte [edi]
lea edi, [edi + 1]
mov byte [ecx + edi - 1], al
test al, al
jne 0x4f0930
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
push 0x1c
call fcn.00501ce1
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
je 0x4f0966
mov ecx, eax
call fcn.004efee0
mov esi, eax
jmp 0x4f0968
xor esi, esi
mov ebx, dword [ebp - 0x14]
mov ecx, esi
push 0
push 0
push 1
push ebx
call fcn.004f0a30
push 0
mov ecx, esi
call fcn.004f09f0
cmp eax, 2
jne 0x4f09a1
test esi, esi
je 0x4f099d
mov ecx, esi
call fcn.004f0110
push 0x1c
push esi
call fcn.00501d14
add esp, 8
xor edi, edi
jmp 0x4f09c9
push 0
mov ecx, esi
call fcn.004f1150
mov ecx, eax
call fcn.004e9bc0
mov edi, eax
test esi, esi
je 0x4f09c9
mov ecx, esi
call fcn.004f0110
push 0x1c
push esi
call fcn.00501d14
add esp, 8
push ebx
call fcn.00501fb5
mov ecx, dword [ebp - 0xc]
add esp, 4
mov eax, edi
mov dword fs:[0], ecx
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret