joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4be900
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x22c
push 0
lea eax, [ebp - 0x230]
push eax
call fcn.0063a460
add esp, 0xc
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x238], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x230], 0x22c
lea ecx, [ebp - 0x248]
call fcn.00421b20
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp - 0x23c]
push edx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4be9a2
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x248]
call fcn.004cb350
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp - 0x23c]
push edx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4be979
mov eax, dword [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x234], 0
jmp 0x4be9ca
mov ecx, dword [ebp - 0x234]
add ecx, 1
mov dword [ebp - 0x234], ecx
lea ecx, [ebp - 0x248]
call fcn.004cbac0
cmp dword [ebp - 0x234], eax
jae 0x4beaa0
lea ecx, [ebp + 8]
call fcn.0040d3c0
push eax
call fcn.00641e0e
add esp, 4
mov esi, eax
mov edx, dword [ebp - 0x234]
push edx
lea ecx, [ebp - 0x248]
call fcn.004c6750
add eax, 0x24
push eax
call fcn.00641e0e
add esp, 4
cmp esi, eax
jne 0x4bea9b
lea ecx, [ebp + 8]
call fcn.0040d3c0
push eax
mov eax, dword [ebp - 0x234]
push eax
lea ecx, [ebp - 0x248]
call fcn.004c6750
add eax, 0x24
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x4bea9b
mov ecx, dword [ebp - 0x234]
push ecx
lea ecx, [ebp - 0x248]
call fcn.004c6750
mov edx, dword [eax + 8]
push edx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
je 0x4bea9b
push 0
mov eax, dword [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 0x238]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x238], 0
jmp 0x4be9bb
lea ecx, [ebp - 0x248]
call fcn.004c6650
lea ecx, [ebp + 8]
call fcn.00413870
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret
Function at 0x4bf4c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1068
call fcn.00613c30
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
lea ecx, [ebp + 8]
call fcn.0040d3c0
push eax
call fcn.005b0540
add esp, 4
test eax, eax
jne 0x4bf511
mov dword [ebp - 0x101c], 0
lea ecx, [ebp + 8]
call fcn.00413870
lea ecx, [ebp + 0xc]
call fcn.00413870
mov eax, dword [ebp - 0x101c]
jmp 0x4bf65f
push 0x44
push 0
lea eax, [ebp - 0x1068]
push eax
call fcn.0063a460
add esp, 0xc
push 0x44
push 0
lea ecx, [ebp - 0x1068]
push ecx
call fcn.0063a460
add esp, 0xc
mov dword [ebp - 0x1068], 0x44
lea edx, [ebp - 0x1068]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 0x103c], 1
xor eax, eax
mov word [ebp - 0x1038], ax
xor ecx, ecx
mov dword [ebp - 0x1018], ecx
mov dword [ebp - 0x1014], ecx
mov dword [ebp - 0x1010], ecx
mov dword [ebp - 0x100c], ecx
push 0x10
push 0
lea edx, [ebp - 0x1018]
push edx
call fcn.0063a460
add esp, 0xc
mov dword [ebp - 0x1024], 0x800
push 0x1000
push 0
lea eax, [ebp - 0x1004]
push eax
call fcn.0063a460
add esp, 0xc
lea ecx, [ebp + 0xc]
call fcn.0040d3c0
push eax
lea ecx, [ebp + 8]
call fcn.0040d3c0
push eax
push 0x697b9c
lea ecx, [ebp - 0x1004]
push ecx
call fcn.004c6010
add esp, 0x10
lea edx, [ebp - 0x1018]
push edx
lea eax, [ebp - 0x1068]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x1004]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x1008], eax
cmp dword [ebp - 0x1008], 0
je 0x4bf63d
cmp dword [ebp + 0x10], 0
jbe 0x4bf623
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x1018]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x1014]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x1018]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1008]
mov dword [ebp - 0x1020], eax
lea ecx, [ebp + 8]
call fcn.00413870
lea ecx, [ebp + 0xc]
call fcn.00413870
mov eax, dword [ebp - 0x1020]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret
Function at 0x4bf950
Capabilities:
Check if file exists
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0063a460
add esp, 0xc
push 0
push 0x1a
lea ecx, [ebp - 0x20c]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor edx, edx
mov byte [ebp - 0x415], dl
lea ecx, [ebp - 0x415]
call fcn.004c8c30
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4bf9c8
mov eax, 1
jmp 0x4bfa61
mov dword [ebp - 0x420], 1
mov dword [ebp - 0x41c], 0x104
push 0x208
push 0
lea edx, [ebp - 0x414]
push edx
call fcn.0063a460
add esp, 0xc
xor eax, eax
mov byte [ebp - 0x416], al
lea ecx, [ebp - 0x41c]
push ecx
lea edx, [ebp - 0x414]
push edx
lea eax, [ebp - 0x420]
push eax
push 0x697c44
lea ecx, [ebp - 0x416]
call fcn.004c7a00
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x4bfa33
xor eax, eax
jmp 0x4bfa61
xor ecx, ecx
mov byte [ebp - 0x417], cl
lea ecx, [ebp - 0x417]
call fcn.004c6a70
push eax
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret
Function at 0x4bfe30
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.004becd0
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4bfe64
jmp 0x4bffe9
mov dword [ebp - 0x21c], 0
mov cx, word [0x697d94]
mov word [ebp - 0x20c], cx
push 0x206
push 0
lea edx, [ebp - 0x20a]
push edx
call fcn.0063a460
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.birdwpmain.exe
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4bfef7
xor ecx, ecx
mov byte [ebp - 0x20d], cl
lea ecx, [ebp - 0x20d]
call fcn.004c86a0
push eax
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4bff29
xor ecx, ecx
mov byte [ebp - 0x20e], cl
lea ecx, [ebp - 0x20e]
call fcn.004c8220
push eax
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call fcn.005b0540
add esp, 4
test eax, eax
jne 0x4bff5a
push 0
push ecx
mov ecx, esp
lea edx, [ebp - 0x20c]
push edx
call fcn.004131e0
call fcn.004bd1d0
add esp, 8
jmp 0x4bffe9
cmp dword [0x6e8788], 0
jg 0x4bff68
jmp 0x4bffe9
mov eax, dword [0x6e8788]
sub eax, 1
mov dword [0x6e8788], eax
push str.__no_check_update
lea ecx, [ebp - 0x214]
call fcn.004131e0
cmp dword [ebp + 8], 0
je 0x4bffba
mov ecx, dword [ebp + 8]
push ecx
call fcn.00641e0e
add esp, 4
test eax, eax
je 0x4bffba
push 0x697ddc
lea ecx, [ebp - 0x214]
call fcn.004318c0
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x214]
call fcn.004318c0
push 5
push 0
lea ecx, [ebp - 0x214]
call fcn.0040d3c0
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x697de0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x214]
call fcn.00413870
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret
Function at 0x4c0250
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x6e878c], 0xffffffff
je 0x4c0276
mov eax, dword [0x6e878c]
jmp 0x4c0308
mov dword [0x6e878c], 0
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0063a460
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.UtilsBeautifyDeskBeautify.dll
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4c02dc
jmp 0x4c0303
lea edx, [ebp - 0x20c]
push edx
call fcn.00603960
add esp, 4
test eax, eax
jne 0x4c02f1
jmp 0x4c0303
mov dword [0x6e878c], 1
xor eax, eax
jne 0x4c0276
mov eax, dword [0x6e878c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret
Function at 0x4c0bf0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0063a460
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x697574
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4c0c6c
lea edx, [ebp - 0x20c]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push str.component_contents.dat
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004131e0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret

Function at 0x4c0d40
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
push 0
lea eax, [ebp - 0x20c]
push eax
call fcn.0063a460
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.utilsBeautify
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4c0dbc
lea edx, [ebp - 0x20c]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push str._beautify_contents.dat
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004131e0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret
Function at 0x4c0df0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4c0e18
xor eax, eax
jmp 0x4c0f94
mov ecx, dword [ebp + 0xc]
call fcn.0047d9f0
mov dword [ebp - 0x40], 0
push 1
lea ecx, [ebp - 0x108]
call fcn.004c6180
push 0x40
push 0x21
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x108]
call fcn.004cae50
mov edx, dword [ebp - 0x108]
mov eax, dword [edx + 4]
lea ecx, [ebp + eax - 0x108]
call fcn.004c6770
movzx ecx, al
test ecx, ecx
je 0x4c0f80
push 2
push 0
push 0
lea ecx, [ebp - 0x108]
call fcn.004cb760
lea edx, [ebp - 0x120]
push edx
lea ecx, [ebp - 0x108]
call fcn.004cbc30
mov ecx, eax
call fcn.0047b300
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jle 0x4c0f6e
mov eax, dword [ebp - 0x38]
add eax, 1
push eax
call fcn.00613615
add esp, 4
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x38]
add edx, 1
push edx
push 0
mov eax, dword [ebp - 0x3c]
push eax
call fcn.0063a460
add esp, 0xc
push 0
push 0
push 0
lea ecx, [ebp - 0x108]
call fcn.004cb760
mov eax, dword [ebp - 0x38]
cdq
push edx
push eax
mov ecx, dword [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x108]
call fcn.004cb370
mov edx, dword [ebp - 0x108]
mov eax, dword [edx + 4]
lea ecx, [ebp + eax - 0x108]
call fcn.004c6770
movzx ecx, al
test ecx, ecx
je 0x4c0f5a
push 0x697634
lea ecx, [ebp - 0x34]
call fcn.00421970
mov edx, dword [ebp - 0x3c]
push edx
lea ecx, [ebp - 0x1c]
call fcn.00421970
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x1c]
push edx
call fcn.005e0b60
add esp, 0xc
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x1c]
call fcn.00421c30
lea ecx, [ebp - 0x34]
call fcn.00421c30
cmp dword [ebp - 0x48], 0
je 0x4c0f5a
mov dword [ebp - 0x40], 1
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
push ecx
call fcn.0061361e
add esp, 4
jmp 0x4c0f75
mov dword [ebp - 0x40], 1
lea ecx, [ebp - 0x108]
call fcn.004caa00
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x50], edx
lea ecx, [ebp - 0x108]
call fcn.004c9350
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret

Function at 0x4c9d80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
xor eax, eax
jne 0x4c9d89
mov dword [ebp - 4], 0
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4c9dbe
call fcn.004c9520
jmp 0x4c9dd4
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
je 0x4c9dd2
push 0x26
call fcn.0040e7f0
add esp, 4
jmp 0x4c9dd4
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x4ca0c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x38], 0
je 0x4ca0e7
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x4ca0ee
mov al, 1
jmp 0x4ca1c2
call fcn.00425110
push eax
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x3c], eax
call fcn.00425110
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.0047e610
add esp, 8
movzx eax, al
test eax, eax
je 0x4ca12a
xor al, al
jmp 0x4ca1c2
mov dword [ebp - 0x48], 0x20
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x40
push ecx
mov edx, dword [ebp - 0x2c]
mov ecx, dword [edx + 0x38]
call fcn.004cbf70
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x4ca166
cmp dword [ebp - 0x30], 1
je 0x4ca16d
cmp dword [ebp - 0x30], 3
je 0x4ca1bc
jmp 0x4ca1c0
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x3d], 0
mov ecx, dword [ebp - 0x44]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x34], ecx
je 0x4ca19c
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x34]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.0064d751
add esp, 0x10
cmp dword [ebp - 0x34], eax
je 0x4ca19c
xor al, al
jmp 0x4ca1c2
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x4ca1b0
mov dword [ebp - 0x38], 1
jmp 0x4ca1b7
mov dword [ebp - 0x38], 0
mov al, byte [ebp - 0x38]
jmp 0x4ca1c2
mov al, 1
jmp 0x4ca1c2
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret
Function at 0x4caf50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov dword [ebp - 0x2c], ecx
call fcn.00425110
mov dword [ebp - 0x44], eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x44]
push ecx
call fcn.0047e610
add esp, 8
movzx edx, al
test edx, edx
je 0x4caf95
lea eax, [ebp + 8]
push eax
call fcn.0047ebd0
add esp, 4
jmp 0x4cb116
mov ecx, dword [ebp - 0x2c]
call fcn.0047ef80
test eax, eax
je 0x4cafd7
mov ecx, dword [ebp - 0x2c]
call fcn.0047ef80
mov esi, eax
mov ecx, dword [ebp - 0x2c]
call fcn.0047e5c0
cmp esi, eax
jae 0x4cafd7
lea ecx, [ebp + 8]
push ecx
call fcn.0047f750
add esp, 4
mov bl, al
mov ecx, dword [ebp - 0x2c]
call fcn.0047d170
mov byte [eax], bl
mov eax, dword [ebp + 8]
jmp 0x4cb116
mov edx, dword [ebp - 0x2c]
cmp dword [edx + 0x4c], 0
jne 0x4cafea
call fcn.00425110
jmp 0x4cb116
mov ecx, dword [ebp - 0x2c]
call fcn.004ca6d0
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x38], 0
jne 0x4cb039
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x4c]
push edx
lea eax, [ebp + 8]
push eax
call fcn.0047f750
add esp, 4
movzx ecx, al
push ecx
call fcn.004c3880
add esp, 8
movzx edx, al
test edx, edx
je 0x4cb029
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
jmp 0x4cb031
call fcn.00425110
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
jmp 0x4cb116
mov dword [ebp - 0x50], 0x20
lea ecx, [ebp + 8]
push ecx
call fcn.0047f750
add esp, 4
mov byte [ebp - 0x2e], al
lea edx, [ebp - 0x48]
push edx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x4c]
push edx
lea eax, [ebp - 0x2d]
push eax
lea ecx, [ebp - 0x2e]
push ecx
mov edx, dword [ebp - 0x2c]
add edx, 0x40
push edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x38]
call fcn.004caf10
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x4cb111
cmp dword [ebp - 0x34], 1
jle 0x4cb094
cmp dword [ebp - 0x34], 3
je 0x4cb0e1
jmp 0x4cb111
mov ecx, dword [ebp - 0x48]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x38], ecx
je 0x4cb0c6
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.0064d751
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x4cb0c6
call fcn.00425110
jmp 0x4cb116
mov ecx, dword [ebp - 0x2c]
mov byte [ecx + 0x3d], 1
lea edx, [ebp - 0x2e]
cmp dword [ebp - 0x4c], edx
je 0x4cb0da
mov eax, dword [ebp + 8]
jmp 0x4cb116
call fcn.00425110
jmp 0x4cb116
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
movzx edx, byte [ebp - 0x2e]
push edx
call fcn.004c3880
add esp, 8
movzx eax, al
test eax, eax
je 0x4cb104
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x40], ecx
jmp 0x4cb10c
call fcn.00425110
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
jmp 0x4cb116
call fcn.00425110
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret 4
Function at 0x4cc0d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, 1
test eax, eax
je 0x4cc1f6
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x38], 0
je 0x4cc108
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0047fa00
jmp 0x4cc20a
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
call fcn.0047c710
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0
jl 0x4cc19c
jg 0x4cc130
cmp dword [ebp + 0xc], 0
jbe 0x4cc19c
cmp dword [ebp - 8], 0
jl 0x4cc19c
jg 0x4cc13e
cmp dword [ebp - 0xc], 0
jbe 0x4cc19c
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [ebp - 8]
jg 0x4cc15c
jl 0x4cc150
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 0xc]
jae 0x4cc15c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 4]
call fcn.0047e910
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.00424ff0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0x10]
sbb eax, dword [ebp - 8]
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0047e880
cmp dword [ebp + 0x10], 0
jl 0x4cc1e6
jg 0x4cc1aa
cmp dword [ebp + 0xc], 0
jbe 0x4cc1e6
mov edx, dword [ebp - 4]
cmp dword [edx + 0x4c], 0
je 0x4cc1e6
mov ecx, dword [ebp - 4]
call fcn.004ca6d0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.0064440b
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp + 0x10]
jmp 0x4cc20a
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.0047fa00
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4cc210
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, 1
test eax, eax
je 0x4cc32e
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x38], 0
je 0x4cc248
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0047fb20
jmp 0x4cc342
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
call fcn.0047d140
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0
jl 0x4cc2dc
jg 0x4cc270
cmp dword [ebp + 0xc], 0
jbe 0x4cc2dc
cmp dword [ebp - 8], 0
jl 0x4cc2dc
jg 0x4cc27e
cmp dword [ebp - 0xc], 0
jbe 0x4cc2dc
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [ebp - 8]
jg 0x4cc29c
jl 0x4cc290
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 0xc]
jae 0x4cc29c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.0047ef80
push eax
call fcn.00424ff0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0x10]
sbb eax, dword [ebp - 8]
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
call fcn.0047ef40
cmp dword [ebp + 0x10], 0
jl 0x4cc31e
jg 0x4cc2ea
cmp dword [ebp + 0xc], 0
jbe 0x4cc31e
mov edx, dword [ebp - 4]
cmp dword [edx + 0x4c], 0
je 0x4cc31e
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.0064d751
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp + 0x10]
jmp 0x4cc342
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.0047fb20
mov esp, ebp
pop ebp
ret 0xc