joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48cbf0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c1678
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x4ea6c4]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0xc]
push eax
call fcn.0048b640
mov dword [esp + 0x30], 0
mov ecx, dword [esi + 0x24]
mov edx, dword [ecx]
mov edx, dword [edx + 0x40]
lea eax, [esp + 0xc]
push eax
call edx
test al, al
jne 0x48cc94
mov eax, dword [esp + 0x20]
cmp eax, 0x4eeec0
je 0x48cc56
push eax
call fcn.004ab965
add esp, 4
mov eax, dword [esp + 0x1c]
cmp eax, 0x4eeec0
je 0x48cc6a
push eax
call fcn.004ab965
add esp, 4
mov eax, dword [esp + 0x18]
cmp eax, 0x4eeec0
je 0x48cc7e
push eax
call fcn.004ab965
add esp, 4
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esp + 0x18]
mov edi, dword [eax]
mov esi, dword [ebp + 8]
call fcn.00401c50
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [esi + 8]
push ecx
add eax, 8
push eax
push edx
call fcn.004af7b0
mov eax, dword [esp + 0x2c]
add esp, 0xc
cmp eax, 0x4eeec0
je 0x48cccd
push eax
call fcn.004ab965
add esp, 4
mov eax, dword [esp + 0x1c]
cmp eax, 0x4eeec0
je 0x48cce1
push eax
call fcn.004ab965
add esp, 4
mov eax, dword [esp + 0x18]
cmp eax, 0x4eeec0
je 0x48ccf5
push eax
call fcn.004ab965
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x48ce90
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4c1650
mov eax, dword fs:[0]
push eax
sub esp, 0x44
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ea6c4]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x6c]
mov eax, dword [esp + 0x68]
xor ebp, ebp
mov dword [esp + 0x60], ebp
cmp dword [eax + 0x18], 8
jb 0x48ced0
mov eax, dword [eax + 4]
jmp 0x48ced3
add eax, 4
push ebp
push 0x80
push 3
push ebp
push 3
push Ordinal_4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x68], esi
je 0x48cf0d
lea edi, [esp + 0x1c]
lea eax, [esp + 0x68]
call fcn.0040c7a0
test al, al
jne 0x48cf23
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
mov edi, dword [esp + 0x1c]
lea esi, [esp + 0x28]
mov dword [esp + 0x28], vtable.GameMgr::GMBuffer_unsigned_char_.0
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebp
call fcn.00401c50
mov byte [esp + 0x60], 1
mov ebp, dword [esp + 0x30]
test ebp, ebp
je 0x48cf86
mov ecx, dword [esp + 0x68]
push 0
lea eax, [esp + 0x1c]
push eax
push edi
push ebp
push ecx
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x48cf7d
cmp dword [esp + 0x18], 0
seta al
test al, al
jne 0x48cfa7
push ebp
call fcn.004ab965
add esp, 4
mov edx, dword [esp + 0x68]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
mov esi, ebx
call fcn.00401c50
mov eax, dword [ebx + 4]
cmp edi, eax
ja 0x48cfb7
mov eax, edi
mov dword [ebx + 0xc], eax
lea eax, [esp + 0x38]
call fcn.00491940
mov eax, dword [ebx + 8]
push 0
push eax
push ebp
lea eax, [esp + 0x44]
push eax
mov eax, edi
call fcn.004919c0
test al, al
lea ecx, [esp + 0x28]
jne 0x48d002
call fcn.00401bb0
lea esi, [esp + 0x68]
call fcn.0040c6a0
xor al, al
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
call fcn.00401bb0
mov ecx, dword [esp + 0x68]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
Function at 0x48d220
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4c1618
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
mov eax, dword [0x4ea6c4]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x20], ebx
mov eax, dword [edi + 0x20]
cmp eax, ebx
je 0x48d26f
mov eax, dword [eax + 8]
cmp eax, ebx
je 0x48d263
push eax
call fcn.004ab965
add esp, 4
mov eax, dword [edi + 0x20]
push eax
call fcn.004abbe4
add esp, 4
mov dword [edi + 0x20], ebx
mov byte [edi + 0x24], bl
cmp dword [edi + 0x1c], 8
jb 0x48d280
mov eax, dword [edi + 8]
jmp 0x48d283
lea eax, [edi + 8]
push ebx
push ebx
push 3
push ebx
push ebx
push Ordinal_4
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x14], ebp
je 0x48d3d5
mov esi, edi
call fcn.0048d3f0
mov eax, dword [edi + 0x20]
cmp eax, ebx
je 0x48d3a5
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
lea ecx, [esp + 0x14]
push ecx
push 2
push eax
push ebp
mov dword [esp + 0x24], ebx
call esi
test eax, eax
je 0x48d3a5
mov ecx, dword [esp + 0x10]
cmp ecx, ebx
seta al
cmp al, bl
je 0x48d3a5
cmp ecx, 2
jne 0x48d3a5
mov eax, dword [edi + 0x20]
add eax, ecx
je 0x48d3a5
push ebx
lea edx, [esp + 0x14]
push edx
push ecx
push eax
push ebp
mov dword [esp + 0x24], ebx
call esi
test eax, eax
je 0x48d3a5
mov ecx, dword [esp + 0x10]
cmp ecx, ebx
seta al
cmp al, bl
je 0x48d3a5
cmp ecx, 2
jne 0x48d3a5
mov eax, dword [edi + 0x20]
push ecx
add eax, 4
lea esi, [esp + 0x14]
lea ecx, [esp + 0x18]
call fcn.0040c710
test al, al
je 0x48d3a5
cmp dword [esp + 0x10], 2
jne 0x48d3a5
mov eax, dword [edi + 0x20]
movzx eax, word [eax + 4]
xor ecx, ecx
mov edx, 0x10
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004ab8e2
mov ecx, dword [edi + 0x20]
mov dword [ecx + 8], eax
mov eax, dword [edi + 0x20]
movzx edx, word [eax + 4]
mov eax, dword [eax + 8]
add esp, 4
shl edx, 4
push edx
lea ecx, [esp + 0x18]
call fcn.0040c710
test al, al
je 0x48d39c
mov eax, dword [edi + 0x20]
movzx ecx, word [eax + 4]
shl ecx, 4
cmp dword [esp + 0x10], ecx
jne 0x48d39c
mov byte [edi + 0x24], 1
jmp 0x48d3ce
mov esi, edi
call fcn.0048d440
jmp 0x48d3ce
mov eax, dword [edi + 0x20]
cmp eax, ebx
je 0x48d3c8
mov eax, dword [eax + 8]
cmp eax, ebx
je 0x48d3bc
push eax
call fcn.004ab965
add esp, 4
mov edx, dword [edi + 0x20]
push edx
call fcn.004abbe4
add esp, 4
mov dword [edi + 0x20], ebx
mov byte [edi + 0x24], bl
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x4aa250
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
je 0x4aa314
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004ae7e1
add esp, 4
mov edx, dword [ebp - 0xc]
lea eax, [edx + eax + 1]
shl eax, 1
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4aa2a2
xor eax, eax
jmp 0x4aa317
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + eax*2 - 2]
cmp edx, 0x5c
je 0x4aa2d8
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov word [ecx + eax*2], 0x5c
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], 0
jmp 0x4aa2ea
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004ae7e1
add esp, 4
cmp dword [ebp - 4], eax
jae 0x4aa314
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov esi, dword [ebp + 8]
mov cx, word [esi + ecx*2]
mov word [eax + edx*2], cx
jmp 0x4aa2e1
mov eax, dword [ebp - 8]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4abc64
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4ea6c4]
jne 0x4abc6e
repz ret
jmp fcn.004afb15

Function at 0x4aef6a
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x4ea6e8]
je 0x4aef85
inc edi
cmp edi, 0x17
jb 0x4aef76
cmp edi, 0x17
jae 0x4af105
push ebp
push 3
call fcn.004b74c6
cmp eax, 1
pop ecx
je 0x4af0d1
push 3
call fcn.004b74c6
test eax, eax
pop ecx
jne 0x4aefb9
cmp dword [0x4ea540], 1
je 0x4af0d1
cmp ebx, 0xfc
je 0x4af104
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x4edd28
push ebp
call fcn.004aedf4
add esp, 0xc
test eax, eax
je 0x4aefef
push esi
push esi
push esi
push esi
push esi
call fcn.004ac10f
add esp, 0x14
push 0x104
mov esi, 0x4edd41
push esi
push 0
mov byte [0x4ede45], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4af033
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.004aedf4
add esp, 0xc
test eax, eax
je 0x4af033
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.004ac10f
add esp, 0x14
push esi
call fcn.004aed00
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4af078
push esi
call fcn.004aed00
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x4ee03c
push 0x4ca164
sub ecx, eax
push ecx
push eax
call fcn.004b7413
add esp, 0x14
test eax, eax
je 0x4af078
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.004ac10f
add esp, 0x14
jmp 0x4af07a
xor esi, esi
push 0x4ca160
push ebx
push ebp
call fcn.004b73a2
add esp, 0xc
test eax, eax
je 0x4af09a
push esi
push esi
push esi
push esi
push esi
call fcn.004ac10f
add esp, 0x14
push dword [edi*8 + 0x4ea6ec]
push ebx
push ebp
call fcn.004b73a2
add esp, 0xc
test eax, eax
je 0x4af0bc
push esi
push esi
push esi
push esi
push esi
call fcn.004ac10f
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.004b71e5
add esp, 0xc
jmp 0x4af104
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x4af104
cmp ebp, 0xffffffff
je 0x4af104
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x4ea6ec]
push dword [esi]
call fcn.004aed00
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4b71e5
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004af21d
xor ebx, ebx
cmp dword [0x4ee870], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x4b72bb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4b739b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x4b739b
push eax
call fcn.004af1af
mov dword [esp], 0x4ca520
push edi
mov dword [0x4ee870], eax
call esi
push eax
call fcn.004af1af
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4ee874], eax
call esi
push eax
call fcn.004af1af
mov dword [0x4ee878], eax
lea eax, [ebp - 0xc]
push eax
call fcn.004b00ed
test eax, eax
pop ecx
pop ecx
je 0x4b7289
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004ac10f
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x4b72bb
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004af1af
cmp eax, ebx
pop ecx
mov dword [0x4ee880], eax
je 0x4b72bb
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004af1af
pop ecx
mov dword [0x4ee87c], eax
mov eax, dword [0x4ee87c]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x4b7340
cmp dword [0x4ee880], ecx
je 0x4b7340
push eax
call fcn.004af226
push dword [0x4ee880]
mov esi, eax
call fcn.004af226
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x4b7340
cmp edi, ebx
je 0x4b7340
call esi
cmp eax, ebx
je 0x4b730d
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4b730d
test byte [ebp - 0x18], 1
jne 0x4b7340
lea eax, [ebp - 0x10]
push eax
call fcn.004b0124
test eax, eax
pop ecx
je 0x4b7328
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004ac10f
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x4b7337
or dword [ebp + 0x10], 0x200000
jmp 0x4b737b
or dword [ebp + 0x10], 0x40000
jmp 0x4b737b
mov eax, dword [0x4ee874]
cmp eax, dword [ebp - 8]
je 0x4b737b
push eax
call fcn.004af226
cmp eax, ebx
pop ecx
je 0x4b737b
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4b737b
mov eax, dword [0x4ee878]
cmp eax, dword [ebp - 8]
je 0x4b737b
push eax
call fcn.004af226
cmp eax, ebx
pop ecx
je 0x4b737b
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4ee870]
call fcn.004af226
cmp eax, ebx
pop ecx
je 0x4b739b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4b739d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4bda11
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x4bda4e
cmp dword [ebp + 0x14], edi
je 0x4bda4e
cmp ecx, edi
jne 0x4bda55
call fcn.004acb13
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.004ac20b
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x4bda69
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x4bda8a
cmp ebx, 0xffffffff
je 0x4bda79
push ebx
push edi
push ecx
call fcn.004ae6c0
add esp, 0xc
cmp esi, edi
je 0x4bda36
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x4bda36
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x4bdaa6
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x4bdaad
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x4bdb9e
test word [esi + 0xc], 0x10c
je 0x4bdb01
mov eax, dword [esi + 4]
test eax, eax
je 0x4bdb01
jl 0x4bdbff
cmp ebx, eax
mov edi, ebx
jb 0x4bdad2
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x4bdba6
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.004abbe9
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x4bdb96
cmp ebx, dword [ebp - 0xc]
jb 0x4bdb6e
cmp dword [ebp - 0xc], 0
je 0x4bdb2b
mov ecx, SysReAllocString
xor edx, edx
cmp ebx, ecx
jbe 0x4bdb20
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x4bdb27
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x4bdb36
mov eax, SysReAllocString
cmp ebx, eax
ja 0x4bdb36
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x4bdbd2
push eax
push dword [ebp - 8]
push esi
call fcn.004b8e4b
pop ecx
push eax
call fcn.004bec09
add esp, 0xc
test eax, eax
je 0x4bdc11
cmp eax, 0xffffffff
je 0x4bdbff
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x4bdb96
push esi
call fcn.004be528
cmp eax, 0xffffffff
pop ecx
je 0x4bdc03
cmp dword [ebp - 4], 0
je 0x4bdbd2
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x4bdab5
mov eax, dword [ebp + 0x14]
jmp 0x4bda50
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x4bdbbd
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.004ae6c0
add esp, 0xc
call fcn.004acb13
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x4bda46
cmp dword [ebp + 0xc], 0xffffffff
je 0x4bdbe8
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.004ae6c0
add esp, 0xc
call fcn.004acb13
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x4bda46
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x4bda50
or dword [esi + 0xc], 0x10
jmp 0x4bdc03