joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4efbe0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x1c]
push eax
push ecx
mov eax, ebp
mov esi, edi
call fcn.004efb70
test eax, eax
jne 0x4efd16
mov eax, 0x14
call fcn.00457920
mov esi, eax
test esi, esi
je 0x4efc70
mov edx, dword [edi]
mov dword [esp + 0x20], edx
call fcn.00495bc0
lea ebx, [esi + 8]
xor edi, edi
mov eax, ebx
mov dword [esi], vtable.BinaryMetadata.0
call fcn.00487150
mov eax, dword [esp + 0x20]
mov dword [esi + 0x10], eax
mov dword [esi], vtable.ytEXIFMetadata.0
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov eax, dword [ebp + 4]
push edi
lea eax, [eax + eax + 8]
mov ecx, ebx
call fcn.00487200
mov edi, eax
test edi, edi
jne 0x4efd0b
mov ebx, dword [esi + 0xc]
test ebx, ebx
jne 0x4efc7d
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [ebp]
mov eax, dword [esp + 0x18]
mov dword [ebx], ecx
mov edx, dword [ebp + 4]
mov dword [ebx + 4], edx
mov ebp, dword [ebp + 4]
mov edi, dword [eax + 0x10]
add ebx, 8
add ebp, ebp
cmp dword [edi + 0x14], 0
je 0x4efcc0
mov eax, ebp
call fcn.00410220
cmp eax, ebp
je 0x4efcf0
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
mov edi, 2
call eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov eax, dword [edi + 4]
test eax, eax
je 0x4efcdc
push eax
push 1
push ebp
push ebx
call fcn.0060860a
add esp, 0x10
test eax, eax
je 0x4efcdc
xor edi, edi
jmp 0x4efcec
cmp dword [edi + 4], 0
je 0x4efce9
mov edi, 2
jmp 0x4efcec
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x4efd0b
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x14]
mov eax, dword [esp + 0x24]
push esi
push edx
push ecx
call fcn.004f0a90
mov edi, eax
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x4efd20
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x1c]
push eax
push ecx
mov eax, ebp
mov esi, edi
call fcn.004f0100
test eax, eax
jne 0x4efe5b
mov eax, 0x14
call fcn.00457920
mov esi, eax
test esi, esi
je 0x4efdb3
mov edx, dword [edi]
mov dword [esp + 0x20], edx
call fcn.00495bc0
lea ebx, [esi + 8]
xor edi, edi
mov eax, ebx
mov dword [esi], vtable.BinaryMetadata.0
call fcn.00487150
mov eax, dword [esp + 0x20]
mov dword [esi + 0x10], eax
mov dword [esi], vtable.ytEXIFMetadata.0
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov eax, dword [ebp + 4]
push edi
lea eax, [eax*4 + 8]
mov ecx, ebx
call fcn.00487200
mov edi, eax
test edi, edi
jne 0x4efe50
mov ebx, dword [esi + 0xc]
test ebx, ebx
jne 0x4efdc0
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [ebp]
mov eax, dword [esp + 0x18]
mov dword [ebx], ecx
mov edx, dword [ebp + 4]
mov dword [ebx + 4], edx
mov ebp, dword [ebp + 4]
mov edi, dword [eax + 0x10]
add ebp, ebp
add ebx, 8
add ebp, ebp
cmp dword [edi + 0x14], 0
je 0x4efe05
mov eax, ebp
call fcn.00410220
cmp eax, ebp
je 0x4efe35
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
mov edi, 2
call eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov eax, dword [edi + 4]
test eax, eax
je 0x4efe21
push eax
push 1
push ebp
push ebx
call fcn.0060860a
add esp, 0x10
test eax, eax
je 0x4efe21
xor edi, edi
jmp 0x4efe31
cmp dword [edi + 4], 0
je 0x4efe2e
mov edi, 2
jmp 0x4efe31
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x4efe50
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x14]
mov eax, dword [esp + 0x24]
push esi
push edx
push ecx
call fcn.004f0a90
mov edi, eax
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x4efe70
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x1c]
push eax
push ecx
mov eax, ebp
mov esi, edi
call fcn.004eb8c0
test eax, eax
jne 0x4effad
mov eax, 0x14
call fcn.00457920
mov esi, eax
test esi, esi
je 0x4eff03
mov edx, dword [edi]
mov dword [esp + 0x20], edx
call fcn.00495bc0
lea ebx, [esi + 8]
xor edi, edi
mov eax, ebx
mov dword [esi], vtable.BinaryMetadata.0
call fcn.00487150
mov eax, dword [esp + 0x20]
mov dword [esi + 0x10], eax
mov dword [esi], vtable.ytEXIFMetadata.0
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov eax, dword [ebp + 4]
push edi
lea eax, [eax*8 + 8]
mov ecx, ebx
call fcn.00487200
mov edi, eax
test edi, edi
jne 0x4effa2
mov ebx, dword [esi + 0xc]
test ebx, ebx
jne 0x4eff10
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [ebp]
mov eax, dword [esp + 0x18]
mov dword [ebx], ecx
mov edx, dword [ebp + 4]
mov dword [ebx + 4], edx
mov ebp, dword [ebp + 4]
mov edi, dword [eax + 0x10]
add ebp, ebp
add ebp, ebp
add ebx, 8
add ebp, ebp
cmp dword [edi + 0x14], 0
je 0x4eff57
mov eax, ebp
call fcn.00410220
cmp eax, ebp
je 0x4eff87
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
mov edi, 2
call eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov eax, dword [edi + 4]
test eax, eax
je 0x4eff73
push eax
push 1
push ebp
push ebx
call fcn.0060860a
add esp, 0x10
test eax, eax
je 0x4eff73
xor edi, edi
jmp 0x4eff83
cmp dword [edi + 4], 0
je 0x4eff80
mov edi, 2
jmp 0x4eff83
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x4effa2
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x14]
mov eax, dword [esp + 0x24]
push esi
push edx
push ecx
call fcn.004f0a90
mov edi, eax
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x4effc0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x1c]
push eax
push ecx
mov eax, ebp
mov esi, edi
call fcn.004efb00
test eax, eax
jne 0x4f00f3
mov eax, 0x14
call fcn.00457920
mov esi, eax
test esi, esi
je 0x4f004f
mov edx, dword [edi]
mov dword [esp + 0x20], edx
call fcn.00495bc0
lea ebx, [esi + 8]
xor edi, edi
mov eax, ebx
mov dword [esi], vtable.BinaryMetadata.0
call fcn.00487150
mov eax, dword [esp + 0x20]
mov dword [esi + 0x10], eax
mov dword [esi], vtable.ytEXIFMetadata.0
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov eax, dword [ebp + 4]
push edi
add eax, 8
mov ecx, ebx
call fcn.00487200
mov edi, eax
test edi, edi
jne 0x4f00e8
mov ebx, dword [esi + 0xc]
test ebx, ebx
jne 0x4f005c
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [ebp]
mov eax, dword [esp + 0x18]
mov dword [ebx], ecx
mov edx, dword [ebp + 4]
mov dword [ebx + 4], edx
mov edi, dword [eax + 0x10]
mov ebp, dword [ebp + 4]
add ebx, 8
cmp dword [edi + 0x14], 0
je 0x4f009d
mov eax, ebp
call fcn.00410220
cmp eax, ebp
je 0x4f00cd
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
mov edi, 2
call eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov eax, dword [edi + 4]
test eax, eax
je 0x4f00b9
push eax
push 1
push ebp
push ebx
call fcn.0060860a
add esp, 0x10
test eax, eax
je 0x4f00b9
xor edi, edi
jmp 0x4f00c9
cmp dword [edi + 4], 0
je 0x4f00c6
mov edi, 2
jmp 0x4f00c9
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x4f00e8
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x14]
mov eax, dword [esp + 0x24]
push esi
push edx
push ecx
call fcn.004f0a90
mov edi, eax
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x4f0170
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x1c]
push eax
push ecx
mov eax, ebp
call fcn.004ef0f0
test eax, eax
jne 0x4f02ac
mov eax, 0x14
call fcn.00457920
mov esi, eax
test esi, esi
je 0x4f01fe
mov edx, dword [edi]
mov dword [esp + 0x20], edx
call fcn.00495bc0
lea ebx, [esi + 8]
xor edi, edi
mov eax, ebx
mov dword [esi], vtable.BinaryMetadata.0
call fcn.00487150
mov eax, dword [esp + 0x20]
mov dword [esi + 0x10], eax
mov dword [esi], vtable.ytEXIFMetadata.0
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov eax, dword [ebp + 4]
push edi
lea eax, [eax + eax + 8]
mov ecx, ebx
call fcn.00487200
mov edi, eax
test edi, edi
jne 0x4f02a1
mov ebx, dword [esi + 0xc]
test ebx, ebx
jne 0x4f020b
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [ebp]
mov eax, dword [esp + 0x18]
mov dword [ebx], ecx
mov edx, dword [ebp + 4]
mov dword [ebx + 4], edx
mov ebp, dword [ebp + 4]
mov edi, dword [eax + 0x10]
add ebx, 8
add ebp, ebp
cmp dword [edi + 0x14], 0
je 0x4f024e
mov eax, ebp
call fcn.00410220
cmp eax, ebp
je 0x4f027e
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
mov edi, 2
call eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov eax, dword [edi + 4]
test eax, eax
je 0x4f026a
push eax
push 1
push ebp
push ebx
call fcn.0060860a
add esp, 0x10
test eax, eax
je 0x4f026a
xor edi, edi
jmp 0x4f027a
cmp dword [edi + 4], 0
je 0x4f0277
mov edi, 2
jmp 0x4f027a
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x4f02a1
mov edx, dword [esi + 0xc]
call fcn.004dc4b0
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x14]
mov eax, dword [esp + 0x24]
push esi
push edx
push ecx
call fcn.004f0a90
mov edi, eax
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x4f02c0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x1c]
push eax
push ecx
mov eax, ebp
call fcn.004f0410
test eax, eax
jne 0x4f0401
mov eax, 0x14
call fcn.00457920
mov esi, eax
test esi, esi
je 0x4f0351
mov edx, dword [edi]
mov dword [esp + 0x20], edx
call fcn.00495bc0
lea ebx, [esi + 8]
xor edi, edi
mov eax, ebx
mov dword [esi], vtable.BinaryMetadata.0
call fcn.00487150
mov eax, dword [esp + 0x20]
mov dword [esi + 0x10], eax
mov dword [esi], vtable.ytEXIFMetadata.0
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov eax, dword [ebp + 4]
push edi
lea eax, [eax*4 + 8]
mov ecx, ebx
call fcn.00487200
mov edi, eax
test edi, edi
jne 0x4f03f6
mov ebx, dword [esi + 0xc]
test ebx, ebx
jne 0x4f035e
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [ebp]
mov eax, dword [esp + 0x18]
mov dword [ebx], ecx
mov edx, dword [ebp + 4]
mov dword [ebx + 4], edx
mov ebp, dword [ebp + 4]
mov edi, dword [eax + 0x10]
add ebp, ebp
add ebx, 8
add ebp, ebp
cmp dword [edi + 0x14], 0
je 0x4f03a3
mov eax, ebp
call fcn.00410220
cmp eax, ebp
je 0x4f03d3
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
mov edi, 2
call eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov eax, dword [edi + 4]
test eax, eax
je 0x4f03bf
push eax
push 1
push ebp
push ebx
call fcn.0060860a
add esp, 0x10
test eax, eax
je 0x4f03bf
xor edi, edi
jmp 0x4f03cf
cmp dword [edi + 4], 0
je 0x4f03cc
mov edi, 2
jmp 0x4f03cf
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x4f03f6
mov edx, dword [esi + 0xc]
call fcn.004dc4b0
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x14]
mov eax, dword [esp + 0x24]
push esi
push edx
push ecx
call fcn.004f0a90
mov edi, eax
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x4f0490
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x1c]
push eax
push ecx
mov eax, ebp
call fcn.004f0730
test eax, eax
jne 0x4f05d3
mov eax, 0x14
call fcn.00457920
mov esi, eax
test esi, esi
je 0x4f0521
mov edx, dword [edi]
mov dword [esp + 0x20], edx
call fcn.00495bc0
lea ebx, [esi + 8]
xor edi, edi
mov eax, ebx
mov dword [esi], vtable.BinaryMetadata.0
call fcn.00487150
mov eax, dword [esp + 0x20]
mov dword [esi + 0x10], eax
mov dword [esi], vtable.ytEXIFMetadata.0
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov eax, dword [ebp + 4]
push edi
lea eax, [eax*8 + 8]
mov ecx, ebx
call fcn.00487200
mov edi, eax
test edi, edi
jne 0x4f05c8
mov ebx, dword [esi + 0xc]
test ebx, ebx
jne 0x4f052e
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [ebp]
mov eax, dword [esp + 0x18]
mov dword [ebx], ecx
mov edx, dword [ebp + 4]
mov dword [ebx + 4], edx
mov ebp, dword [ebp + 4]
mov edi, dword [eax + 0x10]
add ebp, ebp
add ebp, ebp
add ebx, 8
add ebp, ebp
cmp dword [edi + 0x14], 0
je 0x4f0575
mov eax, ebp
call fcn.00410220
cmp eax, ebp
je 0x4f05a5
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
mov edi, 2
call eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov eax, dword [edi + 4]
test eax, eax
je 0x4f0591
push eax
push 1
push ebp
push ebx
call fcn.0060860a
add esp, 0x10
test eax, eax
je 0x4f0591
xor edi, edi
jmp 0x4f05a1
cmp dword [edi + 4], 0
je 0x4f059e
mov edi, 2
jmp 0x4f05a1
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x4f05c8
mov edx, dword [esi + 0xc]
call fcn.004dc4b0
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x14]
mov eax, dword [esp + 0x24]
push esi
push edx
push ecx
call fcn.004f0a90
mov edi, eax
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x4f05e0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x1c]
push eax
push ecx
mov eax, ebp
call fcn.004ef410
test eax, eax
jne 0x4f0719
mov eax, 0x14
call fcn.00457920
mov esi, eax
test esi, esi
je 0x4f066d
mov edx, dword [edi]
mov dword [esp + 0x20], edx
call fcn.00495bc0
lea ebx, [esi + 8]
xor edi, edi
mov eax, ebx
mov dword [esi], vtable.BinaryMetadata.0
call fcn.00487150
mov eax, dword [esp + 0x20]
mov dword [esi + 0x10], eax
mov dword [esi], vtable.ytEXIFMetadata.0
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov eax, dword [ebp + 4]
push edi
add eax, 8
mov ecx, ebx
call fcn.00487200
mov edi, eax
test edi, edi
jne 0x4f070e
mov ebx, dword [esi + 0xc]
test ebx, ebx
jne 0x4f067a
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [ebp]
mov eax, dword [esp + 0x18]
mov dword [ebx], ecx
mov edx, dword [ebp + 4]
mov dword [ebx + 4], edx
mov edi, dword [eax + 0x10]
mov ebp, dword [ebp + 4]
add ebx, 8
cmp dword [edi + 0x14], 0
je 0x4f06bb
mov eax, ebp
call fcn.00410220
cmp eax, ebp
je 0x4f06eb
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
mov edi, 2
call eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov eax, dword [edi + 4]
test eax, eax
je 0x4f06d7
push eax
push 1
push ebp
push ebx
call fcn.0060860a
add esp, 0x10
test eax, eax
je 0x4f06d7
xor edi, edi
jmp 0x4f06e7
cmp dword [edi + 4], 0
je 0x4f06e4
mov edi, 2
jmp 0x4f06e7
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x4f070e
mov edx, dword [esi + 0xc]
call fcn.004dc4b0
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x14]
mov eax, dword [esp + 0x24]
push esi
push edx
push ecx
call fcn.004f0a90
mov edi, eax
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x4f2740
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x670b48
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebp
push esi
push edi
mov eax, dword [0x6d7160]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x44]
test ebp, ebp
je 0x4f2865
mov edi, dword [esp + 0x40]
mov esi, dword [ebx + 0x2c]
call fcn.004dabf0
test al, al
jne 0x4f2865
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x48]
push ecx
mov edi, ebp
mov byte [esp + 0x4c], 0x2f
call fcn.004fa4c0
add esp, 8
test eax, eax
je 0x4f2865
cmp byte [eax + ebp], 0x2f
jne 0x4f2865
lea edx, [esp + 0x18]
lea edi, [eax + ebp + 1]
push edx
lea eax, [esp + 0x48]
push eax
mov byte [esp + 0x4c], 0
call fcn.004fa4c0
add esp, 8
test eax, eax
je 0x4f2865
cmp byte [eax + edi], 0
jne 0x4f2865
mov esi, dword [esp + 0x40]
cmp esi, dword [ebx + 0x60]
je 0x4f27f1
mov edi, ebx
call fcn.004f62d0
mov dword [ebx + 0x60], esi
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x24], 2
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
lea esi, [ebx + 0x64]
mov dword [esp + 0x38], 0
mov eax, dword [esi + 4]
test al, 1
jne 0x4f2854
shr eax, 1
lea ecx, [eax - 1]
test eax, ecx
jne 0x4f282e
push esi
call fcn.004db630
test eax, eax
je 0x4f2854
mov ecx, dword [esi + 4]
shr ecx, 1
shl ecx, 4
add ecx, dword [esi]
lea eax, [esp + 0x1c]
call fcn.00402700
mov eax, dword [esi + 4]
mov edx, eax
and edx, 0xfffffffe
add edx, 2
and eax, 1
xor edx, eax
mov dword [esi + 4], edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.00402500
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x2c
ret 8
Function at 0x4fe580
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
test edi, edi
jbe 0x4fe5d4
push ebx
push ebp
mov eax, dword [esi + edx*4]
mov ecx, eax
shr ecx, 0x18
add ecx, 1
mov ebx, eax
and ebx, 0xffff00ff
imul ebx, ecx
mov ebp, eax
and ebp, 0xff00
imul ebp, ecx
xor ebx, ebp
mov ebp, eax
and ebp, 0xff00ff
imul ebp, ecx
and ebx, 0xff0000
xor ebx, ebp
shr ebx, 8
and eax, 0xff000000
or ebx, eax
mov dword [esi + edx*4], ebx
add edx, 1
cmp edx, edi
jb 0x4fe588
pop ebp
pop ebx
ret

Function at 0x4fea10
Capabilities:
Read file on windows

Disassembly:
push ebx
push edi
mov edi, ecx
test edi, edi
mov ebx, eax
je 0x4fea8b
mov eax, dword [edi + 0x14]
test eax, eax
jne 0x4fea2f
cmp dword [edi + 4], eax
setne cl
test cl, cl
je 0x4fea8b
test eax, eax
je 0x4fea4b
mov eax, esi
call fcn.00410220
sub eax, esi
neg eax
sbb eax, eax
and eax, 2
xor ecx, ecx
test eax, eax
sete cl
pop edi
mov al, cl
pop ebx
ret
mov eax, dword [edi + 4]
test eax, eax
je 0x4fea71
push eax
push 1
push esi
push ebx
call fcn.0060860a
add esp, 0x10
test eax, eax
je 0x4fea71
xor eax, eax
xor ecx, ecx
test eax, eax
sete cl
pop edi
mov al, cl
pop ebx
ret
cmp dword [edi + 4], 0
mov eax, 2
jne 0x4fea7f
mov eax, dword [edi + 0xc]
xor ecx, ecx
test eax, eax
sete cl
pop edi
mov al, cl
pop ebx
ret
push 0
push esi
push ebx
call fcn.0060c930
add esp, 0xc
pop edi
xor al, al
pop ebx
ret
Function at 0x50db50
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, eax
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x50db9f
mov eax, dword [edi + 0x1c]
mov ebx, 2
cmp eax, ebx
jb 0x50db76
mov esi, dword [edi + 0x18]
lea edx, [esi + 2]
cmp edx, eax
jbe 0x50db83
mov esi, dword [edi + 0x18]
sub eax, esi
mov ebx, eax
je 0x50dc9a
lea eax, [esi + ecx]
push ebx
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.0060d1b0
add esi, ebx
add esp, 0xc
mov dword [edi + 0x18], esi
cmp ebx, 2
jmp 0x50dbc4
mov edx, dword [edi + 4]
push edx
push 1
lea eax, [esp + 0x1c]
push 2
push eax
call fcn.0060860a
add esp, 0x10
test eax, eax
jne 0x50dbca
cmp dword [edi + 4], eax
jne 0x50dc9a
cmp dword [edi + 0xc], eax
jne 0x50dc9a
mov cx, word [esp + 0x14]
rol cx, 8
movzx eax, cx
cmp ax, 2
jb 0x50dc9a
add eax, 0xfffe
test ax, ax
mov dword [esp + 0x14], eax
jbe 0x50dcaf
push 0x14
call fcn.0045d550
mov esi, eax
add esp, 4
test esi, esi
je 0x50dc3d
mov edx, dword [esp + 0x1c]
mov eax, dword [edx]
mov dword [esi], eax
mov byte [esi + 4], 0xe2
mov dword [esi + 8], 0
movzx ecx, word [esp + 0x14]
mov dword [esi + 0xc], ecx
movzx edx, word [esp + 0x14]
push edx
call fcn.0045d550
mov ebx, eax
add esp, 4
test ebx, ebx
mov dword [esi + 0x10], ebx
jne 0x50dc4c
push esi
call fcn.0045da90
add esp, 4
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
cmp dword [edi + 0x14], 0
movzx ebp, word [esp + 0x14]
je 0x50dc68
test ebp, ebp
je 0x50dc85
mov eax, ebp
call fcn.00410220
xor edx, edx
div ebp
jmp 0x50dc80
mov edi, dword [edi + 4]
test edi, edi
je 0x50dc7e
push edi
push 1
push ebp
push ebx
call fcn.0060860a
add esp, 0x10
jmp 0x50dc80
xor eax, eax
cmp eax, 1
je 0x50dca9
mov eax, dword [esi + 0x10]
push eax
call fcn.0045da90
add esp, 4
push esi
call fcn.0045da90
add esp, 4
mov eax, 3
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
mov ecx, dword [esp + 0x1c]
mov dword [ecx], esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret 4
Function at 0x52c860
Capabilities:
Check internet connectivity via wininet

Disassembly:
sub esp, 8
push edi
push 0
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test byte [esp + 4], 0x20
je 0x52c8c1
mov eax, 0x18
mov edi, str.Working_offline._state:
lea ecx, [esp + 8]
mov dword [esp + 8], 0
call fcn.00459750
mov ecx, dword [esp + 4]
push ecx
push 1
call fcn.0052c740
push eax
lea eax, [esp + 0x14]
call fcn.00544030
lea edi, [esp + 8]
call fcn.00401700
mov al, 1
pop edi
add esp, 8
ret
xor al, al
pop edi
add esp, 8
ret
Function at 0x52eff0
Capabilities:
Create http request

Disassembly:
mov ecx, dword [ecx]
test ecx, ecx
je 0x52f004
test dword [ecx], 0xffffff00
je 0x52f004
cmp byte [ecx + 4], 0
jne 0x52f00c
push 0
call fcn.0052f040
ret
mov eax, dword [eax]
add ecx, 4
test eax, eax
je 0x52f027
push 0
push 0
push ecx
add eax, 4
push 3
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
ret
xor eax, eax
push eax
push eax
push ecx
push 3
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
ret

Function at 0x52f040
Capabilities:
Create http request

Disassembly:
mov eax, dword [eax]
test eax, eax
je 0x52f04b
add eax, 4
jmp 0x52f04d
xor eax, eax
xor ecx, ecx
cmp dword [esp + 4], ecx
push 0
sete cl
push 0
push 0
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
ret 4