joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445d4b
Capabilities:
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
push edi
mov edi, dword [ebp + 0x10]
push 0
push 0
push dword [edi + 4]
push dword [edi]
push dword [ebp + 0xc]
call fcn.00443d45
mov esi, eax
test esi, esi
js 0x445ea1
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x445e72
cmp dword [ebp - 4], 0
je 0x445ea0
xor ebx, ebx
and dword [ebp + 0x10], ebx
push 0
lea eax, [ebp + 0x10]
push eax
mov eax, dword [ebp - 4]
sub eax, ebx
push eax
mov eax, dword [ebp + 0x20]
add eax, ebx
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x445e4c
add ebx, dword [ebp + 0x10]
cmp dword [ebp + 0x10], 0
je 0x445dd0
cmp ebx, dword [ebp - 4]
jb 0x445d9f
add dword [edi], ebx
push 0
pop eax
adc dword [edi + 4], eax
cmp dword [ebp + 0x14], 0xffffffff
je 0x445e1a
push eax
push eax
push eax
push eax
push dword [ebp + 0x14]
mov ebx, eax
mov dword [ebp - 8], eax
call fcn.00443d45
test eax, eax
js 0x445e1a
push 0
lea eax, [ebp - 8]
push eax
push 8
pop eax
sub eax, ebx
push eax
lea eax, [edi + ebx*8]
push eax
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_WriteFile]
add ebx, dword [ebp - 8]
cmp dword [ebp - 8], 0
je 0x445e1a
cmp ebx, 8
jb 0x445df3
mov eax, dword [ebp + 0x28]
test eax, eax
je 0x445e40
cmp dword [eax], 0
je 0x445e40
push dword [ebp + 0xc]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [edi + 4]
push dword [edi]
push eax
call fcn.00445697
mov esi, eax
test esi, esi
js 0x445ea0
cmp dword [ebp - 4], 0
jne 0x445d75
jmp 0x445ea0
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x1b1
jmp 0x445e96
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x1a5
push str.dlutil.cpp
call fcn.0043c22c
pop ebx
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x24
Function at 0x445eab
Capabilities:
Create http request
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
or dword [ebp - 0xc], 0xffffffff
xor eax, eax
push ebx
mov ebx, dword [ebp + 8]
xorps xmm0, xmm0
push esi
push edi
push eax
push dword [ebx]
mov dword [ebp - 8], eax
mov edi, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 8]
push eax
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x20], xmm0
call fcn.00440857
mov esi, eax
test esi, esi
js 0x446014
xor eax, eax
push eax
push eax
push eax
push eax
push 0x46634c
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, eax
test edi, edi
jne 0x445f3b
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x8f
push str.dlutil.cpp
call fcn.0043c22c
jmp 0x446014
lea eax, [ebp - 4]
push eax
push 0x78
push str.DownloadTimeout
push 0x454930
call fcn.0044522f
mov eax, dword [ebp - 4]
test eax, eax
je 0x445f87
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
imul eax, eax, 0x3e8
push 4
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 2
push edi
call esi
push 4
lea eax, [ebp - 4]
push eax
push 6
push edi
call esi
push 4
lea eax, [ebp - 4]
push eax
push 5
push edi
call esi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 0x1c]
lea eax, [ebp - 8]
push dword [ebx + 8]
push dword [ebx + 4]
push eax
push edi
call fcn.00445710
mov esi, eax
test esi, esi
js 0x446014
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x14]
call fcn.004457b9
push dword [ebp + 0x1c]
lea eax, [ebp - 8]
push dword [ebp + 0x18]
push dword [ebp - 0xc]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 0x14]
push dword [ebx + 8]
push dword [ebx + 4]
push eax
push edi
call fcn.0044540d
mov esi, eax
test esi, esi
js 0x446005
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x446005
xor ecx, ecx
cmp word [eax], cx
je 0x446005
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0xc], 0xffffffff
je 0x446014
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x446021
push eax
call fcn.0044506c
test edi, edi
je 0x44602c
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
cmp dword [ebp - 8], 0
je 0x44603a
push dword [ebp - 8]
call fcn.0044506c
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x448413
Capabilities:
Get http content length

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
mov dword [ebp - 4], 4
push esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0x20000005
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
jne 0x448464
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jns 0x448464
push esi
push 0x23
push str.inetutil.cpp
call fcn.0043c22c
jmp 0x448470
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
and dword [edx + 4], 0
mov dword [edx], ecx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4485aa
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x246c
call fcn.00449460
mov eax, dword [0x46a004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2430], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x242c], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x20]
mov dword [ebp - 0x241c], eax
mov eax, dword [ebp + 0x14]
push esi
mov dword [ebp - 0x2428], eax
xor esi, esi
mov eax, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x24]
mov dword [ebp - 0x2424], eax
mov eax, dword [ebp + 0x1c]
push 0x3c
mov dword [ebp - 0x2420], eax
lea eax, [ebp - 0x246c]
push esi
push eax
call fcn.0042a6f0
add esp, 0xc
mov dword [ebp - 0x246c], 0x3c
cmp dword [ebp - 0x241c], esi
je 0x44863c
lea eax, [ebp - 0x410]
mov dword [ebp - 0x2458], 0x101
mov dword [ebp - 0x245c], eax
mov ecx, 0x81
cmp dword [ebp - 0x2424], esi
je 0x44865b
lea eax, [ebp - 0x108]
mov dword [ebp - 0x244c], ecx
mov dword [ebp - 0x2450], eax
cmp dword [ebp - 0x2420], esi
je 0x448675
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x2444], ecx
mov dword [ebp - 0x2448], eax
mov ecx, 0x801
test ebx, ebx
je 0x448690
lea eax, [ebp - 0x1414]
mov dword [ebp - 0x243c], ecx
mov dword [ebp - 0x2440], eax
test edi, edi
je 0x4486a6
lea eax, [ebp - 0x2418]
mov dword [ebp - 0x2434], ecx
mov dword [ebp - 0x2438], eax
lea eax, [ebp - 0x246c]
push eax
push 0x90000000
push esi
push dword [ebp - 0x2430]
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x4486f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
mov eax, 0x80004005
test esi, esi
cmovns esi, eax
push esi
push 0x61
push str.uriutil.cpp
call fcn.0043c22c
jmp 0x4487b7
mov ecx, dword [ebp - 0x242c]
test ecx, ecx
je 0x448705
mov eax, dword [ebp - 0x2460]
mov dword [ecx], eax
mov eax, dword [ebp - 0x241c]
test eax, eax
je 0x44872b
push dword [ebp - 0x2458]
push dword [ebp - 0x245c]
push eax
call fcn.00440857
mov esi, eax
test esi, esi
js 0x4487b7
mov eax, dword [ebp - 0x2428]
test eax, eax
je 0x44873f
mov cx, word [ebp - 0x2454]
mov word [eax], cx
mov eax, dword [ebp - 0x2424]
test eax, eax
je 0x448761
push dword [ebp - 0x244c]
push dword [ebp - 0x2450]
push eax
call fcn.00440857
mov esi, eax
test esi, esi
js 0x4487b7
mov eax, dword [ebp - 0x2420]
test eax, eax
je 0x448783
push dword [ebp - 0x2444]
push dword [ebp - 0x2448]
push eax
call fcn.00440857
mov esi, eax
test esi, esi
js 0x4487b7
test ebx, ebx
je 0x44879f
push dword [ebp - 0x243c]
push dword [ebp - 0x2440]
push ebx
call fcn.00440857
mov esi, eax
test esi, esi
js 0x4487b7
test edi, edi
je 0x4487b7
push dword [ebp - 0x2434]
push dword [ebp - 0x2438]
push edi
call fcn.00440857
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429d4c
mov esp, ebp
pop ebp
ret 0x20
Function at 0x412590
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xf000]
push edi
jmp 0x4125aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4125b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4125a0
mov eax, 1
add ebx, ebx
jne 0x4125c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4125b8
jne 0x4125d4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4125b8
xor ecx, ecx
sub eax, 3
jb 0x4125e8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41265a
mov ebp, eax
add ebx, ebx
jne 0x4125f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x412600
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x412624
inc ecx
add ebx, ebx
jne 0x412610
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x412605
jne 0x412621
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x412605
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x412644
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x412635
jmp 0x4125a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x412644
add edi, ecx
jmp 0x4125a6
pop esi
lea edi, [esi + 0x10000]
mov eax, dword [edi]
or eax, eax
je 0x4126ac
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12708]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x127c4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x412661
mov ecx, edi
jns 0x412690
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x127cc]
or eax, eax
je 0x4126a6
mov dword [ebx], eax
add ebx, 4
jmp 0x41267e
call dword [esi + 0x127c8]
mov ebp, dword [esi + 0x127d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4126e0
sub esp, 0xffffff80
jmp 0x403ac6

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x49510d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x54a66c]
cmp eax, 0xffffffff
jne 0x495219
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
mov dword [esp], 0xa57940
call sub.msvcrt.dll_memset
mov dword [0xa57940], 0x44
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov dword [esp], 0xa57984
call sub.msvcrt.dll_memset
mov dword [esp + 0x24], 0xa57984
mov dword [esp + 0x20], 0xa57940
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x8000000
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.cmd.exe__c_ver
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
test eax, eax
setne al
test al, al
je 0x49520f
mov eax, dword [0xa57984]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov eax, dword [0xa57984]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [0xa57988]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [0x54a66c], 1
jmp 0x495219
mov dword [0x54a66c], 0
mov eax, dword [0x54a66c]
leave
ret
Function at 0x4a6206
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004a5e02
test eax, eax
sete al
test al, al
je 0x4a6232
mov eax, 0xfffffffe
mov edx, 0xffffffff
jmp 0x4a62e5
mov edx, dword [0x6bd1dc]
mov eax, dword [ebp + 8]
shl eax, 3
mov ecx, eax
shl ecx, 4
mov edi, ecx
sub edi, eax
mov eax, edi
add eax, edx
mov dword [0xa46c4c], eax
mov eax, dword [0xa46c4c]
movzx eax, byte [eax + 0x70]
test al, al
je 0x4a6269
mov eax, 0xfffffffc
mov edx, 0xffffffff
jmp 0x4a62e5
mov eax, dword [0x6bd1d8]
mov edx, dword [ebp + 8]
shl edx, 2
add eax, edx
mov dword [0xa46c50], eax
mov edi, 0xa46c58
mov eax, dword [0xa46c50]
mov eax, dword [eax]
mov dword [esp + 4], 0xa46c5c
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetFileSize]
call eax
sub esp, 8
mov dword [edi], eax
mov eax, dword [0xa46c58]
mov edx, dword [0xa46c5c]
mov ebx, eax
and bh, 0xff
mov esi, edx
and esi, 0
mov eax, ebx
xor eax, 0xffffffff
or eax, esi
test eax, eax
jne 0x4a62da
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
test eax, eax
setne al
test al, al
je 0x4a62da
mov eax, 0xfffffffd
mov edx, 0xffffffff
jmp 0x4a62e5
mov eax, dword [0xa46c58]
mov edx, dword [0xa46c5c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4a7c8b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x30
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004a5e02
test eax, eax
sete al
test al, al
je 0x4a7cc9
mov eax, 0xfffffffe
jmp 0x4a7e83
mov edx, dword [0x6bd1dc]
mov eax, dword [ebp + 8]
shl eax, 3
mov ecx, eax
shl ecx, 4
mov ebx, ecx
sub ebx, eax
mov eax, ebx
add eax, edx
mov dword [0xa46b94], eax
mov eax, dword [0xa46b94]
movzx eax, byte [eax + 0xa]
test al, al
jne 0x4a7cfe
mov eax, 0xfffffffd
jmp 0x4a7e83
cmp dword [ebp - 0x14], 0
jns 0x4a7d0e
mov eax, 0xfffffffc
jmp 0x4a7e83
mov eax, dword [ebp - 0xc]
mov edx, eax
xor edx, 0xffffffff
mov eax, dword [ebp - 0x10]
xor eax, 0xffffffff
or eax, edx
test eax, eax
je 0x4a7d58
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004a7b51
mov dword [0xa46b98], eax
mov eax, dword [0xa46b98]
test eax, eax
setne al
test al, al
je 0x4a7d58
mov eax, dword [0xa46b98]
jmp 0x4a7e83
mov eax, dword [0x6bd1d8]
mov edx, dword [ebp + 8]
shl edx, 2
add eax, edx
mov dword [0xa46b9c], eax
jmp 0x4a7e69
cmp dword [ebp - 0x14], 0
jle 0x4a7d89
mov dword [0xa46ba0], 0xffffffff
add dword [ebp - 0x18], 1
adc dword [ebp - 0x14], 0xffffffff
jmp 0x4a7d9f
mov eax, dword [ebp - 0x18]
mov dword [0xa46ba0], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edx, dword [0xa46ba0]
mov eax, dword [0xa46b9c]
mov eax, dword [eax]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xa46ba8
mov dword [esp + 8], edx
mov edx, dword [ebp + 0x14]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WriteFile]
call eax
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x4a7e0b
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [0xa46bb0], eax
mov eax, dword [0xa46bb0]
cmp eax, 5
je 0x4a7dfd
mov eax, dword [0xa46bb0]
cmp eax, 0x21
jne 0x4a7e04
mov eax, 0xfffffff9
jmp 0x4a7e83
mov eax, 0xfffffff7
jmp 0x4a7e83
mov eax, dword [0xa46ba8]
mov edx, dword [0xa46bac]
add dword [ebp + 0x14], eax
mov esi, dword [0xa46b94]
mov eax, dword [0xa46b94]
mov ecx, dword [eax + 0x10]
mov ebx, dword [eax + 0x14]
mov eax, dword [0xa46ba8]
mov edx, dword [0xa46bac]
add eax, ecx
adc edx, ebx
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov eax, dword [0xa46ba0]
mov ecx, eax
mov ebx, 0
mov eax, dword [0xa46ba8]
mov edx, dword [0xa46bac]
mov esi, ebx
xor esi, edx
xor eax, ecx
or eax, esi
test eax, eax
je 0x4a7e69
mov eax, 0xffffffff
jmp 0x4a7e83
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
or eax, edx
test eax, eax
setne al
test al, al
jne 0x4a7d6f
mov eax, 0
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x4bed37
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
call eax
sub esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4bed81
mov dword [esp], 7
call fcn.00472150
mov eax, dword [ebp - 0x14]
jmp 0x4bee1c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
call eax
sub esp, 8
mov edx, eax
sub dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
cmp edx, eax
setne al
test al, al
je 0x4beddd
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp + 4], 1
mov dword [esp], 0
call fcn.0047386a
mov dword [ebp - 0x14], eax
mov dword [esp], 0x33
call fcn.00472150
mov eax, dword [ebp - 0x14]
jmp 0x4bee1c
mov dword [esp + 4], 1
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.0047386a
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x18]
leave
ret
Function at 0x4c73a0
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [esp + 0xc]
mov dword [0xa692e0], eax
jmp fcn.004c6b90
Function at 0x4c8f80
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x1c
cmp byte [0x54a9bc], 0
je 0x4c8fc0
mov eax, dword [0xa69378]
test eax, eax
je 0x4c8fdd
mov dword [esp + 4], 0
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0xa69378]
mov byte [eax + 0x38], 0
sub esp, 8
add esp, 0x1c
ret
mov dword [esp + 4], str.glutHideWindow
mov dword [esp], 0x57ab98
call fcn.004cca00
mov eax, dword [0xa69378]
test eax, eax
jne 0x4c8f95
cmp dword [0x54aa14], 2
je 0x4c8f95
mov dword [esp + 4], str.glutHideWindow
mov dword [esp], 0x57ac44
call fcn.004cca00
mov eax, dword [0xa69378]
jmp 0x4c8f95

Function at 0x4c9010
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x1c
cmp byte [0x54a9bc], 0
je 0x4c9050
mov eax, dword [0xa69378]
test eax, eax
je 0x4c906d
mov byte [eax + 0x39], 0
mov dword [esp + 4], 6
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0xa69378]
mov byte [eax + 0x38], 0
sub esp, 8
add esp, 0x1c
ret
mov dword [esp + 4], str.glutIconifyWindow
mov dword [esp], 0x57ab98
call fcn.004cca00
mov eax, dword [0xa69378]
test eax, eax
jne 0x4c9025
cmp dword [0x54aa14], 2
je 0x4c9025
mov dword [esp + 4], str.glutIconifyWindow
mov dword [esp], 0x57ac44
call fcn.004cca00
mov eax, dword [0xa69378]
jmp 0x4c9025

Function at 0x4cc800
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, 1
push ebx
sub esp, 0x14
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [esp], 0xa0
call ebx
sub esp, 4
test ax, ax
js 0x4cc833
mov dword [esp], 0xa1
call ebx
movsx esi, ax
sub esp, 4
shr esi, 0x1f
mov dword [esp], 0xa2
call ebx
mov edx, 2
sub esp, 4
test ax, ax
js 0x4cc85d
mov dword [esp], 0xa3
call ebx
mov edx, eax
sub esp, 4
shr edx, 0xe
and edx, 2
or esi, edx
mov dword [esp], 0xa4
call ebx
mov edx, 4
sub esp, 4
test ax, ax
js 0x4cc889
mov dword [esp], 0xa5
call ebx
mov edx, eax
sub esp, 4
shr edx, 0xd
and edx, 4
mov eax, esi
add esp, 0x14
or eax, edx
pop ebx
pop esi
ret

Function at 0x4cca00
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [0x54aa48]
test ebx, ebx
je 0x4cca28
lea eax, [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call dword [0x54aa48]
add esp, 0x18
pop ebx
ret
mov eax, dword [sym.imp.msvcrt.dll__iob]
lea ebx, [esp + 0x24]
mov dword [esp + 8], 9
mov dword [esp + 4], 1
mov dword [esp], str.freeglut
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [0x54aa1c]
test eax, eax
je 0x4cca79
mov dword [esp + 8], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 4], str.__s_:
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp], 0xa
add eax, 0x40
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
cmp byte [0x54a9bc], 0
jne 0x4ccac2
mov dword [esp], 1
call sub.msvcrt.dll_exit
call fcn.004c6900
jmp 0x4ccab6