joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47e390
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push edi
mov edi, dword [eax + 0x614]
mov ecx, edi
mov eax, dword [eax + 0x618]
cmp edi, eax
cmovge ecx, eax
cmovle edi, eax
mov dword [ebp - 4], ecx
cmp edi, ecx
je 0x47e422
sub edi, ecx
push ebx
add edi, edi
push esi
lea eax, [edi + 2]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [ebp + 8]
mov esi, eax
mov eax, dword [ebp - 4]
push edi
mov ecx, dword [ecx + 0x5dc]
lea ecx, [ecx + eax*2]
push ecx
push esi
call fcn.0062b2c0
add esp, 0xc
xor eax, eax
mov word [edi + esi], ax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp + 8]
push dword [eax + 0x438]
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push ebx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x47e480
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x6feae4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x11
mov esi, ecx
call dword [sym.imp.USER32.dll_GetKeyState]
mov dx, word [ebp + 8]
and eax, 0x8000
movzx ecx, dx
dec ecx
cmp ecx, 0x19
ja case.0x47e4b8.2
movzx ecx, byte [ecx + 0x47e630]
jmp dword [ecx*4 + 0x47e614]
test dword [esi + 0x5fc], 0x800
jne 0x47e5fb
test eax, eax
jne 0x47e5fb
mov eax, dword [esi + 0x614]
mov ecx, dword [esi]
cmp eax, dword [esi + 0x618]
je 0x47e4f3
push esi
call dword [ecx + 0x1c8]
jmp 0x47e5fb
push 0
push 0xffffffffffffffff
push esi
call dword [ecx + 0x21c]
mov ecx, dword [esi + 0x618]
test ecx, ecx
mov edx, dword [esi]
lea eax, [ecx - 1]
cmove eax, ecx
push eax
push dword [esi + 0x614]
push esi
call dword [edx + 0x21c]
mov ecx, esi
call fcn.0047d840
mov eax, dword [esi]
push esi
call dword [eax + 0x1c8]
jmp 0x47e5fb
test byte [esi + 0x5fc], 0x20
jne 0x47e5fb
mov eax, dword [esi]
push esi
call dword [eax + 0x1c4]
jmp 0x47e5fb
test byte [esi + 0x5fc], 0x20
jne 0x47e5fb
mov eax, dword [esi]
push esi
call dword [eax + 0x1c0]
jmp 0x47e5fb
test dword [esi + 0x5fc], 0x800
jne 0x47e5fb
mov eax, dword [esi]
push esi
call dword [eax + 0x1bc]
jmp 0x47e5fb
test dword [esi + 0x5fc], 0x820
jne 0x47e5fb
mov eax, dword [esi]
push esi
call dword [eax + 0x1cc]
jmp 0x47e5fb
test dword [esi + 0x5fc], 0x800
jne 0x47e5fb
mov ecx, esi
call fcn.0047e200
jmp 0x47e5fb
mov eax, dword [esi + 0x5fc]
test eax, 0x2000
je 0x47e5cd
cmp dx, 0x30
jb 0x47e5c7
cmp dx, 0x39
jbe 0x47e5cd
cmp dx, 0x2d
jne 0x47e5fb
test eax, 0x800
jne 0x47e5fb
cmp dx, 0x20
jb 0x47e5fb
cmp dx, 0x7f
je 0x47e5fb
xor eax, eax
mov word [ebp - 8], dx
push 1
mov word [ebp - 6], ax
mov ecx, esi
push 1
lea eax, [ebp - 8]
push eax
push 1
call fcn.0047dbb0
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.0060963b
mov esp, ebp
pop ebp
ret 4
Function at 0x48b600
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x6feae4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x11
mov esi, ecx
call dword [sym.imp.USER32.dll_GetKeyState]
mov dx, word [ebp + 8]
and eax, 0x8000
movzx ecx, dx
dec ecx
cmp ecx, 0x17
ja case.0x48b638.2
movzx ecx, byte [ecx + 0x48b824]
jmp dword [ecx*4 + 0x48b800]
test dword [esi + 0x7e8], 0x1004
je 0x48b7ec
mov eax, dword [esi + 0x7e8]
test al, 4
je 0x48b7ec
mov ecx, esi
test eax, 0x800
je 0x48b687
push 0
call fcn.0048a320
push 0
mov ecx, esi
call fcn.0048a1c0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0060963b
mov esp, ebp
pop ebp
ret 4
push 1
push 1
push 0x6e27dc
jmp 0x48b7e5
mov eax, dword [esi + 0x7e8]
and eax, 0x804
cmp eax, 4
jne 0x48b7ec
push 1
push 1
push 0x6e61f8
jmp 0x48b7e3
test dword [esi + 0x7e8], 0x800
jne 0x48b7ec
test eax, eax
jne 0x48b7ec
mov eax, dword [esi + 0x800]
cmp eax, dword [esi + 0x804]
jne 0x48b6f5
mov eax, dword [esi]
push 0
push 0
push 0xffffffffffffffff
push esi
call dword [eax + 0x190]
push 1
mov ecx, esi
call fcn.0048a150
mov ecx, esi
call fcn.004896a0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0060963b
mov esp, ebp
pop ebp
ret 4
mov ecx, esi
call fcn.0048b840
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0060963b
mov esp, ebp
pop ebp
ret 4
test dword [esi + 0x7e8], 0x800
jne 0x48b7ec
mov ecx, esi
call fcn.0048b8e0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0060963b
mov esp, ebp
pop ebp
ret 4
test dword [esi + 0x7e8], 0x800
jne 0x48b7ec
mov ecx, esi
call fcn.0048b840
mov ecx, esi
call fcn.004896a0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0060963b
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi]
push 0
push 0xffffffffffffffff
push 0
push esi
call dword [eax + 0x190]
push 1
mov ecx, esi
call fcn.0048a230
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0060963b
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x7e8]
test eax, 0x2000
je 0x48b7be
cmp dx, 0x30
jb 0x48b7ec
cmp dx, 0x39
ja 0x48b7ec
test eax, 0x800
jne 0x48b7ec
cmp dx, 0x20
jb 0x48b7ec
cmp dx, 0x7f
je 0x48b7ec
xor eax, eax
mov word [ebp - 8], dx
push 1
mov word [ebp - 6], ax
lea eax, [ebp - 8]
push 1
push eax
mov ecx, esi
push 1
call fcn.0048ace0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0060963b
mov esp, ebp
pop ebp
ret 4
Function at 0x48b840
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, ecx
push edi
mov dword [ebp - 4], eax
mov edi, dword [eax + 0x800]
mov ecx, edi
mov eax, dword [eax + 0x804]
cmp edi, eax
cmovge ecx, eax
cmovle edi, eax
mov dword [ebp - 8], ecx
cmp edi, ecx
je 0x48b8d6
sub edi, ecx
push ebx
add edi, edi
push esi
lea eax, [edi + 2]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [ebp - 4]
mov esi, eax
mov eax, dword [ebp - 8]
push edi
mov ecx, dword [ecx + 0x7d0]
lea ecx, [ecx + eax*2]
push ecx
push esi
call fcn.0062b2c0
add esp, 0xc
xor eax, eax
mov word [edi + esi], ax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 4]
push dword [eax + 0x438]
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push ebx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x48b8e0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push esi
mov esi, ecx
test dword [esi + 0x7e8], 0x800
jne 0x48b92e
push edi
push dword [esi + 0x438]
call dword [sym.imp.USER32.dll_OpenClipboard]
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
test edi, edi
je 0x48b926
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 1
push 1
push eax
push 1
mov ecx, esi
call fcn.0048ace0
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop edi
pop esi
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
ret
Function at 0x491440
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 0x9d0]
cmp ebx, 0xffffffff
je 0x4915d1
test ebx, ebx
js 0x4915d1
mov ecx, dword [edi + 0x9d4]
cmp ebx, ecx
jge 0x4915d1
mov eax, dword [edi + 0x9e4]
mov eax, dword [eax + ebx*4]
mov dword [esp + 0x10], eax
test eax, eax
je 0x4915d1
test ebx, ebx
js 0x4915a8
cmp ebx, ecx
jge 0x4915a8
test eax, eax
je 0x4915a8
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
and eax, 0x8000
push 0x11
mov dword [esp + 0x18], eax
call esi
and eax, 0x8000
cmp dword [edi + 0x9cc], 0
je 0x491561
cmp dword [esp + 0x14], 0
jne 0x4914fa
test eax, eax
je 0x491561
mov eax, dword [esp + 0x10]
cmp dword [eax + 0xc], 0
je 0x49159a
mov dword [eax + 0xc], 0
mov dword [eax + 8], 1
jmp 0x4915a8
mov esi, dword [edi + 0x9d4]
cmp ebx, esi
jge 0x491596
mov edx, dword [edi + 0x9e4]
lea eax, [ebx*4]
mov ecx, ebx
add edx, eax
nop dword [eax]
mov eax, dword [edx]
cmp dword [eax + 0xc], 0
jne 0x491532
sub edx, 4
sub ecx, 1
jns 0x491520
jmp 0x491596
cmp ecx, 0xffffffff
je 0x491596
test ecx, ecx
js 0x4915a8
cmp ecx, esi
jge 0x4915a8
cmp ecx, ebx
jge 0x4915a8
mov eax, dword [edi + 0x9e4]
mov eax, dword [eax + ecx*4]
inc ecx
mov dword [eax + 0xc], 1
mov dword [eax + 8], 4
cmp ecx, ebx
jle 0x491543
jmp 0x4915a8
xor ecx, ecx
cmp dword [edi + 0x9d4], ecx
jle 0x491596
nop dword [eax + eax]
mov eax, dword [edi + 0x9e4]
mov eax, dword [eax + ecx*4]
cmp dword [eax + 0xc], 0
je 0x49158d
mov dword [eax + 0xc], 0
mov dword [eax + 8], 1
inc ecx
cmp ecx, dword [edi + 0x9d4]
jl 0x491570
mov eax, dword [esp + 0x10]
mov dword [eax + 0xc], 1
mov dword [eax + 8], 4
mov eax, dword [edi]
push edi
call dword [eax + 0x50]
push str.SYSPLUGIN
push eax
call dword [sym.imp.USER32.dll_GetPropW]
mov esi, eax
test esi, esi
je 0x4915d1
mov ecx, dword [edi]
push edi
call dword [ecx + 0x16c]
push edi
mov ecx, esi
call fcn.0046e630
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x49c640
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x6feae4]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
push str.SYSPLUGIN
push dword [edi + 0x438]
call dword [sym.imp.USER32.dll_GetPropW]
test eax, eax
je 0x49c6e1
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x49c6e1
mov eax, dword [ecx]
push ecx
call dword [eax + 0x2c]
test eax, eax
je 0x49c6e1
mov edx, dword [eax]
lea ecx, [edi + 0x4b0]
push 1
push ecx
push eax
call dword [edx + 0x2c]
test eax, eax
je 0x49c6e1
mov eax, dword [edi]
push edi
call dword [eax + 0x194]
push 0
push 0
push 1
push 0
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
push 1
push 0
mov dword [edi + 0x5c0], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x5c4], eax
lea eax, [ebp - 8]
push eax
push 0
push edi
push 0x49c460
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x5bc], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0060963b
mov esp, ebp
pop ebp
ret 4

Function at 0x49c8a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov eax, dword [esi]
call dword [eax + 0x54]
mov ecx, dword [esi]
mov ebx, eax
push 2
push esi
call dword [ecx + 0xcc]
mov ecx, dword [esi]
push esi
call dword [ecx + 0x50]
push str.SYSPLUGIN
push eax
call dword [sym.imp.USER32.dll_GetPropW]
mov edi, eax
test edi, edi
je 0x49c8e9
mov ecx, dword [esi]
push esi
call dword [ecx + 0x16c]
push esi
mov ecx, edi
call fcn.0046e630
cmp ebx, 4
jne 0x49c915
push 5
push 0
push 0
lea eax, [esi + 0x4b0]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
push 0
push 0x21
mov ecx, esi
call fcn.00469c40
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x49c950
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push 5
push 0
push 0
add eax, 0x4b0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop ebp
ret 4
Function at 0x4b1050
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65ef78
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x6feae4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x28]
call fcn.00449980
mov byte [ebp - 4], 1
push str..log
lea ecx, [ebp - 0x28]
call fcn.00449830
push 0x6ea9c8
lea ecx, [ebp + 8]
call fcn.00449830
lea ecx, [ebp - 0x40]
call fcn.004470b0
mov byte [ebp - 4], 2
push 0
push 0x104
lea ecx, [ebp - 0x40]
call fcn.00446f70
push 0
push 0x1a
push 0
lea ecx, [ebp - 0x40]
call fcn.00446fc0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push 0x104
lea ecx, [ebp + 8]
call fcn.004a5b40
push 0x104
lea ecx, [ebp - 0x28]
call fcn.004a5b40
lea ecx, [ebp - 0x28]
call fcn.00446fb0
push eax
push 0
lea ecx, [ebp - 0x40]
call fcn.00446fc0
push eax
push 0
lea ecx, [ebp - 0x28]
call fcn.00446fc0
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea ecx, [ebp + 8]
call fcn.00446fb0
push eax
push 0
lea ecx, [ebp - 0x40]
call fcn.00446fc0
push eax
push 0
lea ecx, [ebp + 8]
call fcn.00446fc0
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea ecx, [ebp + 8]
call fcn.00446fb0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4b1197
mov ecx, dword [ebp - 0x44]
mov byte [ecx], 1
lea ecx, [ebp - 0x28]
call fcn.00446fa0
add eax, 1
push eax
mov ecx, dword [ebp - 0x44]
add ecx, 4
call fcn.004a5b40
lea edx, [ebp - 0x28]
push edx
mov ecx, dword [ebp - 0x44]
add ecx, 4
call fcn.004b2440
push 0x40
push 0xa
mov eax, dword [ebp - 0x44]
add eax, 4
push eax
mov ecx, dword [ebp - 0x44]
add ecx, 0x20
call fcn.004b24f0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.00446fe0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.00446fe0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00446fe0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0060963b
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4b2920
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, 1
test eax, eax
je 0x4b2a3e
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x38], 0
je 0x4b2958
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0044a440
jmp 0x4b2a52
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
call fcn.0044b5d0
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0
jl 0x4b29ec
jg 0x4b2980
cmp dword [ebp + 0xc], 0
jbe 0x4b29ec
cmp dword [ebp - 8], 0
jl 0x4b29ec
jg 0x4b298e
cmp dword [ebp - 0xc], 0
jbe 0x4b29ec
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [ebp - 8]
jg 0x4b29ac
jl 0x4b29a0
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 0xc]
jae 0x4b29ac
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.0044b6c0
push eax
call fcn.00446e90
add esp, 0xc
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0x10]
sbb eax, dword [ebp - 8]
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0044b600
cmp dword [ebp + 0x10], 0
jl 0x4b2a2e
jg 0x4b29fa
cmp dword [ebp + 0xc], 0
jbe 0x4b2a2e
mov edx, dword [ebp - 4]
cmp dword [edx + 0x4c], 0
je 0x4b2a2e
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.00639252
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp + 0x10]
jmp 0x4b2a52
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.0044a440
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4b2a60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, 1
test eax, eax
je 0x4b2b86
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x38], 0
je 0x4b2a98
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0044a520
jmp 0x4b2b9a
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
call fcn.0044b620
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0
jl 0x4b2b2c
jg 0x4b2ac0
cmp dword [ebp + 0xc], 0
jbe 0x4b2b2c
cmp dword [ebp - 8], 0
jl 0x4b2b2c
jg 0x4b2ace
cmp dword [ebp - 0xc], 0
jbe 0x4b2b2c
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [ebp - 8]
jg 0x4b2aec
jl 0x4b2ae0
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 0xc]
jae 0x4b2aec
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 4]
call fcn.0044b6d0
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.00446e90
add esp, 0xc
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0x10]
sbb eax, dword [ebp - 8]
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0044b690
cmp dword [ebp + 0x10], 0
jl 0x4b2b76
jg 0x4b2b3a
cmp dword [ebp + 0xc], 0
jbe 0x4b2b76
mov edx, dword [ebp - 4]
cmp dword [edx + 0x4c], 0
je 0x4b2b76
mov ecx, dword [ebp - 4]
call fcn.004b3660
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.0063f553
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp + 0x10]
jmp 0x4b2b9a
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.0044a520
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4b3010
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x6feae4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov dword [ebp - 0x38], ecx
call fcn.00448280
mov dword [ebp - 0x4c], eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x4c]
push ecx
call fcn.00448250
add esp, 8
movzx edx, al
test edx, edx
je 0x4b3051
lea ecx, [ebp + 8]
call fcn.00448270
jmp 0x4b31d2
mov ecx, dword [ebp - 0x38]
call fcn.0044b6c0
test eax, eax
je 0x4b3093
mov ecx, dword [ebp - 0x38]
call fcn.0044b6c0
mov esi, eax
mov ecx, dword [ebp - 0x38]
call fcn.0044b650
cmp esi, eax
jae 0x4b3093
lea eax, [ebp + 8]
push eax
call fcn.00448230
add esp, 4
mov bl, al
mov ecx, dword [ebp - 0x38]
call fcn.0044b5f0
mov byte [eax], bl
mov eax, dword [ebp + 8]
jmp 0x4b31d2
mov ecx, dword [ebp - 0x38]
cmp dword [ecx + 0x4c], 0
jne 0x4b30a6
call fcn.00448280
jmp 0x4b31d2
mov ecx, dword [ebp - 0x38]
call fcn.004b3660
mov edx, dword [ebp - 0x38]
cmp dword [edx + 0x38], 0
jne 0x4b30f5
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x4c]
push ecx
lea edx, [ebp + 8]
push edx
call fcn.00448230
add esp, 4
movzx eax, al
push eax
call fcn.004b0ef0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x4b30e5
mov edx, dword [ebp + 8]
mov dword [ebp - 0x44], edx
jmp 0x4b30ed
call fcn.00448280
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
jmp 0x4b31d2
mov dword [ebp - 0x50], 0x20
lea eax, [ebp + 8]
push eax
call fcn.00448230
add esp, 4
mov byte [ebp - 0x2a], al
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x29]
push edx
lea eax, [ebp - 0x2a]
push eax
mov ecx, dword [ebp - 0x38]
add ecx, 0x40
push ecx
mov edx, dword [ebp - 0x38]
mov ecx, dword [edx + 0x38]
call fcn.004b3440
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jl 0x4b31cd
cmp dword [ebp - 0x3c], 1
jle 0x4b3150
cmp dword [ebp - 0x3c], 3
je 0x4b319d
jmp 0x4b31cd
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x28]
sub eax, ecx
mov dword [ebp - 0x40], eax
je 0x4b3182
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0x4c]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
push 1
lea edx, [ebp - 0x28]
push edx
call fcn.00639252
add esp, 0x10
cmp dword [ebp - 0x40], eax
je 0x4b3182
call fcn.00448280
jmp 0x4b31d2
mov eax, dword [ebp - 0x38]
mov byte [eax + 0x3d], 1
lea ecx, [ebp - 0x2a]
cmp dword [ebp - 0x34], ecx
je 0x4b3196
mov eax, dword [ebp + 8]
jmp 0x4b31d2
call fcn.00448280
jmp 0x4b31d2
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0x4c]
push eax
movzx ecx, byte [ebp - 0x2a]
push ecx
call fcn.004b0ef0
add esp, 8
movzx edx, al
test edx, edx
je 0x4b31c0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], eax
jmp 0x4b31c8
call fcn.00448280
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
jmp 0x4b31d2
call fcn.00448280
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0060963b
mov esp, ebp
pop ebp
ret 4
Function at 0x4b36f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x6feae4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x38], 0
je 0x4b3717
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x4b371e
mov al, 1
jmp 0x4b37f2
call fcn.00448280
push eax
mov eax, dword [ebp - 0x30]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x30]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x40], eax
call fcn.00448280
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x44]
push edx
call fcn.00448250
add esp, 8
movzx eax, al
test eax, eax
je 0x4b375a
xor al, al
jmp 0x4b37f2
mov dword [ebp - 0x48], 0x20
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x40
push ecx
mov edx, dword [ebp - 0x30]
mov ecx, dword [edx + 0x38]
call fcn.004b3aa0
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x4b3796
cmp dword [ebp - 0x34], 1
je 0x4b379d
cmp dword [ebp - 0x34], 3
je 0x4b37ec
jmp 0x4b37f0
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x3d], 0
mov ecx, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x38], ecx
je 0x4b37cc
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.00639252
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x4b37cc
xor al, al
jmp 0x4b37f2
mov ecx, dword [ebp - 0x30]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x4b37e0
mov dword [ebp - 0x3c], 1
jmp 0x4b37e7
mov dword [ebp - 0x3c], 0
mov al, byte [ebp - 0x3c]
jmp 0x4b37f2
mov al, 1
jmp 0x4b37f2
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0060963b
mov esp, ebp
pop ebp
ret

Function at 0x4b9550
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6feae4]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx edx, word [ebp - 0x28]
cmp edx, 9
je 0x4b9599
movzx eax, word [ebp - 0x28]
cmp eax, 6
jne 0x4b95a0
mov eax, 0x40
jmp 0x4b95a5
mov eax, 0x20
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0060963b
mov esp, ebp
pop ebp
ret