joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ae034
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ae1e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
jne 0x4ae1c2
mov dl, 1
mov eax, dword [0x42a2c0]
call fcn.004360ec
mov edx, dword [ebp - 4]
mov dword [edx + 0x38], eax
mov eax, dword [ebp - 4]
add eax, 0x3c
xor edx, edx
call fcn.004069c0
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x4ae1b1
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004906c8
test al, al
je 0x4ae1a4
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x4ae1f0
lea eax, [ebp - 0x394]
call fcn.00413278
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x4ae1a4
xor eax, eax
push ebp
push 0x4ae19d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x4ae260
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x4ae186
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00406bc0
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x40]
jne 0x4ae186
mov eax, dword [ebp - 4]
add eax, 0x3c
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00406bc0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ae1a4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4ae0a7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
mov byte [eax + 0x29], 0
mov dl, 1
call fcn.00436028
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x38]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ae1e8
lea eax, [ebp - 0x3a0]
call fcn.004069b0
ret

Function at 0x4aed40
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4fd288]
cmp byte [eax + 0xad], 0
jne 0x4aedb2
cmp dword [0x4fd2a0], 0
jne 0x4aed72
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, dword [0x4f65c8]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x4fd2a0], eax
cmp dword [0x4fd29c], 0
jne 0x4aed8d
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x4fd29c], eax
cmp dword [0x4fd2a4], 0
jne 0x4aedb2
push esp
push 0
push 0
mov eax, dword [0x4f65c4]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x4fd2a4], eax
pop edx
ret
Function at 0x4af0d8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x4af0ef
add esp, 0xfffffff0
call fcn.00405324
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0043e674
mov eax, dword [0x4f7238]
cmp byte [eax], 0
jne 0x4af11c
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x17c], al
mov eax, dword [0x4f7550]
cmp word [eax + 2], 0
jne 0x4af136
mov eax, dword [0x4f7550]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004b11d0
mov eax, dword [0x4f7664]
cmp word [eax + 2], 0
jne 0x4af150
mov eax, dword [0x4f7664]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004b13e0
mov byte [ebx + 0x35], 0
mov dl, 1
mov eax, dword [0x448ff0]
call fcn.0044f2c4
mov esi, eax
mov dword [ebx + 0x3c], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x4b1990
mov dl, 1
mov eax, dword [0x427cf8]
call fcn.00404dc0
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x427cf8]
call fcn.00404dc0
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x44d488]
call fcn.0045879c
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x4af330
mov eax, dword [0x4f73f0]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.00458c30
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4b1c78
mov dl, 1
mov eax, dword [0x427cf8]
call fcn.00404dc0
mov dword [ebx + 0x98], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x4f73f0]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.004130c4
test eax, eax
je 0x4af261
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00412ea8
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.004130a8
test eax, eax
je 0x4af279
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00406bc0
push ebx
push 0x4b0ba0
call fcn.004a4d2c
mov dword [ebx + 0x178], eax
mov byte [ebx + 0xd0], 0
mov eax, dword [0x4f7238]
cmp byte [eax], 0
jne 0x4af2ca
mov eax, ebx
call fcn.004af4a4
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
mov byte [ebx + 0xd1], 0
mov byte [ebx + 0xdc], 0
xor eax, eax
mov dword [ebx + 0xd4], eax
mov byte [ebx + 0xd3], 0
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.004b1ea4
mov eax, ebx
call fcn.004b2ad8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4af327
call fcn.0040537c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4af778
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x4af81a
cmp dword [ebx + 0x94], 0
jne 0x4af814
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4af6c4
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4af814
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x4af7da
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4af814
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00432ac8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4af7e9
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4afa38
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x4fd288]
cmp dword [eax + 0x170], 0
je 0x4afb9d
test bl, bl
jne 0x4afaeb
cmp dword [esi + 0x9c], 0
jne 0x4afae0
mov eax, esi
call fcn.004b2928
push eax
push 0x4af944
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x4afab1
mov eax, dword [0x4fd288]
cmp byte [eax + 0xd3], 0
je 0x4afab1
mov eax, dword [esi + 0xd8]
call fcn.00407fe4
mov edi, eax
cmp edi, 0
jl 0x4afab1
push 0
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4afa9a
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4afae0
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00432ac8
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4afac0
inc dword [esi + 0x9c]
jmp 0x4afb9d
cmp dword [esi + 0x9c], 0
jle 0x4afb9d
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x4afb9d
cmp dword [esi + 0x44], 0
je 0x4afb48
mov eax, dword [0x4fd288]
cmp byte [eax + 0xd3], 0
je 0x4afb48
mov eax, dword [esi + 0xd8]
call fcn.00407fe4
mov edi, eax
cmp edi, 0
jl 0x4afb48
push 5
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4afb31
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4afb77
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00432ac8
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4afb57
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd8]
mov ecx, 1
mov edx, dword [0x4a2c04]
call fcn.004081a4
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4b07ec
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4b0857
cmp byte [ebx + 0xd3], 0
jne 0x4b0857
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00406afc
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x4b0844
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4b0864
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004069c0
jmp 0x4b0864
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004069c0
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x4b208c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4b20fa
mov eax, esi
call fcn.0048a748
test al, al
je 0x4b20fa
mov eax, dword [ebx + 0x84]
call fcn.0048a39c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4b20fa
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x4b20ee
push 0
mov eax, dword [ebx + 0x84]
call fcn.0048a39c
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00481374
jmp 0x4b20fa
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004b1ec4
pop esi
pop ebx
ret
Function at 0x4b66c4
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4b66f2
mov eax, ebx
call fcn.004b7178
cmp dword [ebx + 0x40], 0
je 0x4b66eb
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4b6763
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4b6755
cmp dword [ebx + 8], 0
je 0x4b6714
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4b6726
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4b6755
cmp dword [ebx + 8], 0
je 0x4b6707
cmp eax, 3
je 0x4b6739
dec eax
jne 0x4b6707
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4b6707
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4b6707
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4b6781
cmp dword [ebx + 0x14], 0xcc
je 0x4b6781
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004b678c
pop ebx
ret

Function at 0x4cd6d4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
lea eax, [ebp - 0x30]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
dec ecx
js 0x4cd725
lea eax, [ebp - 0x30]
cmp word [eax + 0x20], 3
je 0x4cd70c
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x4cd6fc
jmp 0x4cd725
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x4cd70d
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e24bc
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x4fd2f4
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x4e24de
shr eax, 1
xor eax, 0xedb88320
jmp 0x4e24e0
shr eax, 1
dec edx
jne 0x4e24cc
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4e24c5
mov byte [0x4fd6f4], 1
pop esi
pop ebx
ret

Function at 0x4e24fc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x4fd6f4], 0
jne 0x4e2513
call fcn.004e24bc
mov eax, edi
dec eax
test eax, eax
jl 0x4e253b
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4fd2f4]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4e251d
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4e52e4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x4e537e.0
jmp dword [ecx*4 + 0x4e5317]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4e5349
sub dl, 8
je 0x4e5358
jmp case.0x4e537e.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4e4f8c
jmp case.0x4e537e.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4e4fe4
jmp case.0x4e537e.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x4e537e.0
movzx ecx, byte [ecx + 0x4e5385]
jmp dword [ecx*4 + 0x4e5396]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4e5090
jmp case.0x4e537e.0
cmp dl, 3
jne 0x4e53c3
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4e50e8
jmp case.0x4e537e.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4e50a4
jmp case.0x4e537e.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4e512c
jmp case.0x4e537e.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4e53ee
sub dl, 8
je 0x4e53fa
jmp case.0x4e537e.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4e5158
jmp case.0x4e537e.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4e51c4
jmp case.0x4e537e.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x4e5419
sub dl, 8
je 0x4e5425
jmp case.0x4e537e.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4e5280
jmp case.0x4e537e.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x4e52a8
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0x10], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 0xc], esi
add edx, dword [eax + 0x44c]
mov dword [ebp - 0x14], edx
mov esi, ecx
test esi, esi
jb 0x4e54c7
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004e4490
test eax, eax
je 0x4e54c7
mov eax, ebx
call fcn.004e54d0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
call dword [ebp - 0x20]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0x10], eax
sub dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 0xc], eax
dec esi
jne 0x4e5460
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4e54d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x4e5501
dec al
je 0x4e553c
dec al
je 0x4e5581
dec al
je 0x4e55ea
jmp 0x4e5674
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x4e5674
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4e5511
jmp 0x4e5674
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4e5674
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x4e554c
jmp 0x4e5674
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4e5674
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4e55b0
xor ebp, ebp
jmp 0x4e55c0
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4e55c9
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4e5591
jmp 0x4e5674
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x4e5674
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x4e5643
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004e2544
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4e55fe
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x1000a410
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x1000a4f6
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x1000a4e5
jg 0x1000a450
test edx, edx
je 0x1000a4e5
nop dword [eax]
call fcn.1000ba40
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x1000a4a4
jg 0x1000a467
test esi, esi
je 0x1000a4a4
cmp ebx, eax
jg 0x1000a477
jl 0x1000a471
cmp edi, esi
jae 0x1000a477
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.10022000
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x1000a4c9
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
movzx eax, byte [eax]
push eax
call dword [edx + 0xc]
cmp eax, 0xffffffff
je 0x1000a4df
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x1000a450
jl 0x1000a4df
test edi, edi
jne 0x1000a450
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x1000a518
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x1000a51a
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x1000a598
jg 0x1000a52d
test esi, esi
je 0x1000a598
test eax, eax
jl 0x1000a57c
jg 0x1000a537
test ebx, ebx
je 0x1000a57c
cmp edi, eax
jg 0x1000a547
jl 0x1000a541
cmp esi, ebx
jae 0x1000a547
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.10022000
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [esp + 0x14]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x1000a598
jg 0x1000a57f
test esi, esi
je 0x1000a598
jmp 0x1000a57f
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x1000a598
push eax
push esi
push 1
push edx
call fcn.100283f3
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc