joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a818a
Capabilities:
Unmount volume via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push 0x104
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.004be790
add esp, 0xc
cmp dword [0x5425bc], 0
je 0x4a81f9
mov ecx, dword [ebp + 8]
mov edx, dword [ecx*4 + 0x543b34]
push edx
lea eax, [ebp - 0x108]
push eax
call fcn.004a8627
add esp, 8
test eax, eax
jne 0x4a81f7
mov ecx, dword [ebp + 8]
sub ecx, 1
imul ecx, ecx, 0xff
add ecx, 0x543ff0
push ecx
push 0x53f144
lea edx, [ebp - 0x108]
push edx
call fcn.004bec9d
add esp, 0xc
jmp 0x4a8248
mov eax, dword [ebp + 8]
movsx ecx, byte [eax + 0x543bb0]
cmp ecx, 0x43
jl 0x4a8229
mov edx, dword [ebp + 8]
movsx eax, byte [edx + 0x543bb0]
push eax
push 0x53f148
lea ecx, [ebp - 0x108]
push ecx
call fcn.004bec9d
add esp, 0xc
jmp 0x4a8248
mov edx, dword [ebp + 8]
movsx eax, byte [edx + 0x543bb0]
push eax
push 0x53f150
lea ecx, [ebp - 0x108]
push ecx
call fcn.004bec9d
add esp, 0xc
mov edx, dword [ebp + 0xc]
mov dword [edx], 0xffffffff
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov edx, dword [ebp + 0xc]
cmp dword [edx], 0xffffffff
jne 0x4a827e
xor eax, eax
jmp 0x4a82de
cmp dword [ebp + 0x10], 0
jne 0x4a828b
mov eax, 1
jmp 0x4a82de
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
push 0
push 0x90018
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax + 0x543b78]
cmp ecx, 1
jne 0x4a82d9
push 0
lea edx, [ebp - 4]
push edx
push 0
push 0
push 0
push 0
push 0x90020
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x4a8512
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 4], 0
push 0
push 0
push 3
push 0
push 3
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
je 0x4a8588
push 0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea edx, [ebp - 0x14]
push edx
push 0
push 0
push 0x2d1080
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4a857e
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
mov dword [ecx], edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4a858f
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push 0x104
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.004be790
add esp, 0xc
movsx ecx, byte [ebp + 8]
push ecx
push 0x53f168
lea edx, [ebp - 0x108]
push edx
call fcn.004bec9d
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 5
jne 0x4a85e1
xor eax, eax
jmp 0x4a8623
push 0x104
push 0
lea ecx, [ebp - 0x108]
push ecx
call fcn.004be790
add esp, 0xc
movsx edx, byte [ebp + 8]
push edx
push 0x53f16c
lea eax, [ebp - 0x108]
push eax
call fcn.004bec9d
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x108]
push edx
call fcn.004a8512
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x4a86d2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov dword [0x543eac], 0xff
mov dword [0x543ea8], 0xff
mov dword [ebp - 0x11c], 0
jmp 0x4a870a
mov eax, dword [ebp - 0x11c]
add eax, 1
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0x18
jge 0x4a8762
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ebp - 0x11c]
mov dword [ecx*8 + 0x543a78], edx
mov dword [ebp - 0x124], 0
jmp 0x4a8741
mov eax, dword [ebp - 0x124]
add eax, 1
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 4
jge 0x4a8760
mov ecx, dword [ebp - 0x11c]
mov edx, dword [ebp - 0x124]
mov byte [edx + ecx*8 + 0x543a7c], 0xff
jmp 0x4a8732
jmp 0x4a86fb
mov byte [ebp - 0x128], 0
push 0x104
push 0
lea eax, [ebp - 0x118]
push eax
call fcn.004be790
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4a87a1
mov dl, byte [ebp - 0x118]
mov byte [ebp - 0x128], dl
mov byte [ebp - 0x10], 0
push 0x104
push 0
lea eax, [ebp - 0x22c]
push eax
call fcn.004be790
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x22c]
push ecx
call fcn.004a5ec7
add esp, 8
mov dl, byte [ebp - 0x22c]
mov byte [ebp - 0x10], dl
mov dword [ebp - 0x11c], 0
jmp 0x4a87f3
mov eax, dword [ebp - 0x11c]
add eax, 1
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0x18
jge 0x4a889e
mov ecx, dword [ebp - 0x11c]
add ecx, 0x43
mov byte [ebp - 0x120], cl
push 8
push 0
lea edx, [ebp - 8]
push edx
call fcn.004be790
add esp, 0xc
lea eax, [ebp - 8]
push eax
mov cl, byte [ebp - 0x120]
push ecx
call fcn.004a858f
add esp, 8
test eax, eax
je 0x4a8899
mov edx, dword [ebp - 8]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jl 0x4a884d
jmp 0x4a87e4
cmp dword [ebp - 0x14], 0
jge 0x4a8855
jmp 0x4a87e4
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
mov al, byte [ebp - 0x120]
mov byte [edx + ecx*8 + 0x543a7c], al
movsx ecx, byte [ebp - 0x120]
movsx edx, byte [ebp - 0x128]
cmp ecx, edx
jne 0x4a8882
mov eax, dword [ebp - 0xc]
mov dword [0x543eac], eax
movsx ecx, byte [ebp - 0x120]
movsx edx, byte [ebp - 0x10]
cmp ecx, edx
jne 0x4a8899
mov eax, dword [ebp - 0xc]
mov dword [0x543ea8], eax
jmp 0x4a87e4
mov esp, ebp
pop ebp
ret
Function at 0x4a9818
Capabilities:
Print debug messages
Unmount volume via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa14
mov dword [ebp - 0xa10], 0
cmp dword [ebp + 8], 0xffffffff
jne 0x4a9843
push str._Inquiry_And_ReadFlashID_:_Device_handle_is_not_valid_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
jmp 0x4a9931
push 0
lea eax, [ebp - 0xa14]
push eax
push 0
push 0
push 0
push 0
push 0x90018
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0
lea edx, [ebp - 0xa14]
push edx
push 0
push 0
push 0
push 0
push 0x90020
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0xa00
lea ecx, [ebp - 0xa00]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0xa0c]
push eax
call fcn.004a9935
add esp, 0x10
mov dword [ebp - 0xa10], eax
push 0
lea ecx, [ebp - 0xa14]
push ecx
push 0
push 0
push 0
push 0
push 0x9001c
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0
lea eax, [ebp - 0xa14]
push eax
push 0
push 0
push 0
push 0
push 0x90028
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp dword [ebp - 0xa10], 0
je 0x4a992b
cmp dword [ebp + 0x10], 0x400
ja 0x4a9913
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0xa00]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004bee30
add esp, 0xc
jmp 0x4a992b
push 0x400
lea edx, [ebp - 0xa00]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.004bee30
add esp, 0xc
mov eax, dword [ebp - 0xa10]
mov esp, ebp
pop ebp
ret

Function at 0x4abef0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x98], 0
cmp dword [ebp - 0x90], 4
jne 0x4abf52
cmp dword [ebp - 0x8c], 0x5a
je 0x4abf50
mov dword [ebp - 0xa4], 1
jmp 0x4abf81
cmp dword [ebp - 0x90], 5
jne 0x4abf81
cmp dword [ebp - 0x8c], 0
jne 0x4abf6e
mov dword [ebp - 0x9c], 1
cmp dword [ebp - 0x8c], 1
jne 0x4abf81
mov dword [ebp - 0x98], 1
mov eax, dword [ebp - 0xa4]
mov esp, ebp
pop ebp
ret

Function at 0x4abf8b
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x98], 0
cmp dword [ebp - 0x90], 4
jne 0x4abfed
cmp dword [ebp - 0x8c], 0x5a
je 0x4abfeb
mov dword [ebp - 0xa4], 1
jmp 0x4ac01c
cmp dword [ebp - 0x90], 5
jne 0x4ac01c
cmp dword [ebp - 0x8c], 0
jne 0x4ac009
mov dword [ebp - 0x9c], 1
cmp dword [ebp - 0x8c], 1
jne 0x4ac01c
mov dword [ebp - 0x98], 1
mov eax, dword [ebp - 0x9c]
mov esp, ebp
pop ebp
ret
Function at 0x4ac0e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
push edi
cmp dword [0x5451ec], 0
je 0x4ac11e
mov edi, 0x53f2a8
lea edx, [ebp - 0x100]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4ac146
mov edi, 0x53f2d4
lea edx, [ebp - 0x100]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x100]
push edx
call fcn.004bea00
add esp, 8
lea eax, [ebp - 0x108]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x100]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x108], 0xffffffff
je 0x4ac1c6
mov dword [ebp - 0x104], 0xff
lea edx, [ebp - 0x104]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0
push str.CreateFileName
mov ecx, dword [ebp - 0x108]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10c], eax
mov edx, dword [ebp - 0x108]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4b231b
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x55c
mov dword [ebp - 0x558], 0
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push str._s_s
lea eax, [ebp - 0x108]
push eax
call fcn.004bec9d
add esp, 0x10
push 0x545200
mov ecx, dword [ebp - 4]
push ecx
call fcn.004be9f0
add esp, 8
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x310]
push eax
call fcn.004be9f0
add esp, 8
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x310]
push eax
push str._s_s_s
lea ecx, [ebp - 0x554]
push ecx
call fcn.004bec9d
add esp, 0x14
lea edx, [ebp - 0x450]
push edx
lea eax, [ebp - 0x554]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x55c], eax
cmp dword [ebp - 0x55c], 0xffffffff
jne 0x4b23c1
xor eax, eax
jmp 0x4b24bf
mov dword [ebp - 8], 0
mov dword [ebp - 0x558], 0
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.USER32.dll_CharUpperA]
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.USER32.dll_CharUpperA]
cmp dword [ebp - 8], 0
jne 0x4b2496
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004be9f0
add esp, 8
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.USER32.dll_CharUpperA]
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004bf3f0
add esp, 8
test eax, eax
je 0x4b2467
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x20c]
push eax
call fcn.004bf3f0
add esp, 8
test eax, eax
je 0x4b2467
lea ecx, [ebp - 0x310]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.004be9f0
add esp, 8
lea eax, [ebp - 0x424]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004bea00
add esp, 8
lea edx, [ebp - 0x450]
push edx
mov eax, dword [ebp - 0x55c]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4b2491
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x4b2491
mov dword [ebp - 8], 1
jmp 0x4b23e6
mov ecx, dword [ebp - 0x55c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0x14]
push eax
call fcn.004be9f0
add esp, 8
mov ecx, dword [ebp - 4]
push ecx
call fcn.004bf680
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x4c1a4b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x4c1a68
call fcn.004c26f5
mov dword [eax], 0x16
xor eax, eax
jmp 0x4c1ad1
xor ecx, ecx
push esi
mov edx, 0x8c
inc ecx
call fcn.004c85ca
mov esi, eax
test esi, esi
je 0x4c1abc
push esi
call fcn.004c5188
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x4c1a9a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x4c19b6
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x4c1ad0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.004bf16d
test ebx, ebx
pop ecx
je 0x4c1ace
push ebx
call fcn.004c271b
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4c5a96
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
jne 0x4c5ab4
xor eax, eax
jmp 0x4c5c22
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x547aa0]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x4c5ae7
push 2
push edi
push edi
push dword [ebp + 8]
call fcn.004ce642
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x4c5bb9
cmp dword [ebp + 0x10], edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edi
jbe 0x4c5bf1
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x41c]
mov dword [ebp - 8], edi
cmp ecx, dword [ebp + 0x10]
jae 0x4c5b42
mov edx, dword [ebp - 0xc]
inc dword [ebp - 0xc]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x4c5b33
inc dword [ebp - 0x14]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 8]
mov byte [eax], dl
inc eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x400
jl 0x4c5b16
mov edi, eax
lea eax, [ebp - 0x41c]
sub edi, eax
push 0
lea eax, [ebp - 0x18]
push eax
push edi
lea eax, [ebp - 0x41c]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4c5b82
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x10], eax
cmp eax, edi
jl 0x4c5b8b
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp + 0xc]
xor edi, edi
cmp eax, dword [ebp + 0x10]
jb 0x4c5b07
jmp 0x4c5b8d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
xor edi, edi
mov eax, dword [ebp - 0x10]
cmp eax, edi
jne 0x4c5c1d
cmp dword [ebp - 4], edi
je 0x4c5bf1
push 5
pop esi
cmp dword [ebp - 4], esi
jne 0x4c5be6
call fcn.004c26f5
mov dword [eax], 9
call fcn.004c2708
mov dword [eax], esi
jmp 0x4c5c18
push edi
lea ecx, [ebp - 0x18]
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4c5bdb
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], eax
jmp 0x4c5b8d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x4c5b8d
push dword [ebp - 4]
call fcn.004c271b
pop ecx
jmp 0x4c5c18
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x4c5c06
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0x1a
jne 0x4c5c06
xor eax, eax
jmp 0x4c5c20
call fcn.004c26f5
mov dword [eax], 0x1c
call fcn.004c2708
mov dword [eax], edi
or eax, 0xffffffff
jmp 0x4c5c20
sub eax, dword [ebp - 0x14]
pop esi
pop ebx
pop edi
leave
ret
Function at 0x4cafee
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.004bedf0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4cb089
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x5472ac]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x4cb089
cmp eax, 1
je 0x4cb0aa
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4cb089
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x4cb056
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x4cb085
xor eax, eax
inc eax
jmp 0x4cb0c9
cmp edi, eax
jae 0x4cb08d
xor eax, eax
jmp 0x4cb0c9
cmp eax, esi
jae 0x4cb094
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x5472ac]
jmp 0x4cb0ad
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4cb0d1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
xor eax, eax
cmp ecx, dword [eax*8 + 0x541ae0]
je 0x4cb0e9
inc eax
cmp eax, 0x12
jb 0x4cb0da
push esi
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x541ae0]
mov dword [ebp + 8], esi
jne 0x4cb22f
mov eax, dword [0x5472f8]
cmp eax, 1
push ebx
je 0x4cb1ff
test eax, eax
jne 0x4cb11e
cmp dword [0x541114], 1
je 0x4cb1ff
cmp ecx, 0xfc
je 0x4cb22e
push edi
push 6
pop ecx
mov esi, str.Runtime_Error__n_nProgram:
mov edi, 0x547530
rep movsd dword es:[edi], dword [esi]
push 0x104
mov ebx, 0x54754a
push ebx
movsw word es:[edi], word [esi]
push 0
mov byte [0x54764e], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4cb16c
push 5
pop ecx
mov esi, str._program_name_unknown_
mov edi, 0x54754a
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4cb171
sub eax, edx
inc eax
cmp eax, 0x3c
jbe 0x4cb1a4
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4cb185
sub eax, edx
push 3
lea eax, [eax + 0x54750f]
push 0x50c81c
push eax
call fcn.004cf840
add esp, 0xc
mov edx, 0x547530
mov edi, edx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4cb1ac
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x541ae4]
mov esi, 0x50c818
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4cb1c7
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4cb1d3
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x12010
mov ecx, eax
and ecx, 3
push str.Microsoft_Visual_C_Runtime_Library
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.004d13ac
add esp, 0xc
pop edi
jmp 0x4cb22e
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x4cb22e
mov esi, dword [esi + 0x541ae4]
mov ecx, esi
lea edx, [ecx + 1]
mov bl, byte [ecx]
inc ecx
test bl, bl
jne 0x4cb216
push 0
sub ecx, edx
lea edx, [ebp - 4]
push edx
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebx
pop esi
leave
ret
Function at 0x4cc447
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x4cc61b
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x547aa0]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x4cc61b
test cl, 0x48
je 0x4cc4b2
cmp byte [eax + 5], 0xa
je 0x4cc4b2
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4cc504
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x4cc4ec
call fcn.004c26f5
mov dword [eax], 9
call fcn.004c2708
mov dword [eax], esi
jmp 0x4cc4fc
cmp eax, 0x6d
je 0x4cc61b
push eax
call fcn.004c271b
pop ecx
or eax, 0xffffffff
jmp 0x4cc61d
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x4cc616
test eax, eax
je 0x4cc52b
cmp byte [ebx], 0xa
jne 0x4cc52b
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x4cc534
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x4cc610
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x4cc600
cmp al, 0xd
je 0x4cc566
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x4cc5f2
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x4cc580
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x4cc57b
add dword [ebp + 0x10], 2
jmp 0x4cc5d4
mov dword [ebp + 0x10], eax
jmp 0x4cc5ee
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4cc5a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4cc5ee
cmp dword [ebp - 0xc], 0
je 0x4cc5ee
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x4cc5c9
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x4cc5d4
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x4cc5f1
cmp ebx, dword [ebp + 0xc]
jne 0x4cc5d9
cmp byte [ebp - 1], 0xa
jne 0x4cc5d9
mov byte [ebx], 0xa
jmp 0x4cc5f1
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004c90ba
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x4cc5f2
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x4cc54a
jmp 0x4cc610
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x4cc610
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x4cc61d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret