joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cb16b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x59a240]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
xorps xmm0, xmm0
xor ebx, ebx
movlpd qword [ebp - 0x1c], xmm0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [0x69dc78], eax
test eax, eax
je 0x4cb26b
call fcn.004ca9ca
mov dword [0x69dc7c], eax
cmp dword [0x69dc78], ebx
jne 0x4cb2b8
push esi
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x4cb2a0
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test ebx, ebx
jne 0x4cb1e7
call fcn.0040e037
mov ebx, eax
test ebx, ebx
je 0x4cb2a2
test edi, edi
jne 0x4cb2a2
lea eax, [ebp - 0x14]
push eax
call fcn.0040e037
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push 6
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 4
mov esi, eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
add esi, dword [ebp - 0x10]
add eax, 3
mov ecx, dword [ebp - 0xc]
add esi, eax
mov eax, ecx
mov dword [ebp - 0x20], 3
sub eax, dword [ebp - 0x14]
cdq
idiv dword [ebp - 0x20]
mov dword [ebp - 0x10], esi
sub ecx, eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], ecx
cmp eax, dword [ebp - 0x14]
jle 0x4cb29b
cmp eax, ecx
jge 0x4cb29b
cmp dword [ebp - 0x18], esi
jle 0x4cb29b
push 0xf
call dword [sym.imp.USER32.dll_GetSystemMetrics]
add eax, dword [ebp - 0x10]
cmp dword [ebp - 0x18], eax
jge 0x4cb29b
mov dword [0x69dc5c], 1
call fcn.004ca9ca
mov dword [0x69dc60], eax
jmp 0x4cb2a2
call fcn.004ca9ca
sub eax, dword [0x69dc7c]
cmp eax, 0xde
jae 0x4cb1ac
call fcn.004ca9ca
sub eax, dword [0x69dc7c]
push eax
push str.:7:CheckForMouseButton___was_called_consecutively_too_quickly:__dms
call fcn.00425c08
pop ecx
pop ecx
jmp 0x4cb2b8
xor edi, edi
inc edi
jmp 0x4cb2a2
xor edi, edi
push 0x16
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x69dc78], 0
je 0x4cb1b9
pop esi
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop ebx
call fcn.004e3632
leave
ret 4
Function at 0x4cf66d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1444
call fcn.004e3640
mov eax, dword [0x59a240]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x1440]
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push 0x1234
push ebx
push eax
call fcn.004e4da0
push 0x104
lea eax, [ebp - 0x108]
mov dword [ebp - 0x1444], ebx
push ebx
push eax
call fcn.004e4da0
push 0x104
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.004e4da0
push esi
call fcn.0049f486
add esp, 0x28
test eax, eax
je 0x4cf6e0
or eax, 0xffffffff
jmp 0x4cf832
test edi, edi
je 0x4cf6f3
push 0x1234
push ebx
push edi
call fcn.004e4da0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.004a11a5
lea eax, [ebp - 0x20c]
push eax
call fcn.004a025a
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push 0x50b870
push eax
call fcn.0047ced0
lea eax, [ebp - 0x108]
push eax
push esi
call fcn.004ee718
add esp, 0x24
test eax, eax
jne 0x4cf75c
call fcn.004ee499
push eax
push 0x50d368
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.004a0d90
add esp, 0x10
push ebx
lea eax, [ebp - 0x108]
push eax
push esi
call fcn.004e2f00
push 0x32a
push str.E:UserskerryDocumentsVisual_Studio_2022ProjectsPAULA__TEMP_COPY_TrackProg.c
lea eax, [ebp - 0x108]
push 0x50965c
push eax
call fcn.0042d2de
mov esi, eax
add esp, 0x1c
test esi, esi
jne 0x4cf7a2
lea eax, [ebp - 0x108]
push eax
call fcn.00429e69
or eax, 0xffffffff
jmp 0x4cf831
lea eax, [ebp - 0x1440]
push eax
push esi
call fcn.004cf841
pop ecx
pop ecx
test eax, eax
jne 0x4cf7e0
lea eax, [ebp - 0x108]
push eax
push str.:7:LoadTillSheetFromProgress___s___FAILED:_fread___FAILED_to_read_the_till_sheet_struct.
call fcn.004255b9
push esi
call fcn.0042d153
lea eax, [ebp - 0x108]
push eax
call fcn.00429e69
add esp, 0x10
jmp 0x4cf6d8
push esi
push 1
lea eax, [ebp - 0x1444]
push 4
push eax
call fcn.004e8bc6
add esp, 0x10
cmp eax, 1
jae 0x4cf7ff
mov dword [ebp - 0x1444], ebx
push esi
call fcn.0042d153
pop ecx
test edi, edi
je 0x4cf81f
push 0x1234
lea eax, [ebp - 0x1440]
push eax
push edi
call fcn.004e4820
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
call fcn.00429e69
mov eax, dword [ebp - 0x1444]
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e3632
leave
ret
Function at 0x4cf841
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x4cf9bf
test ebx, ebx
je 0x4cf9bf
push esi
xor edi, edi
lea eax, [ebp - 4]
inc edi
push edi
push 4
push eax
call fcn.004e8bc6
add esp, 0x10
cmp eax, edi
jae 0x4cf882
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4cf885
mov eax, dword [ebp - 4]
mov ecx, 0x1234
test eax, eax
je 0x4cf9bf
cmp eax, ecx
ja 0x4cf9a2
push ecx
push 0
push ebx
call fcn.004e4da0
push esi
push edi
push dword [ebp - 4]
push ebx
call fcn.004e8bc6
add esp, 0x1c
cmp eax, edi
jae 0x4cf8c7
push edi
push esi
call fcn.0042d104
push eax
push str.:7:LoadTillSheetFromProgressRAW___s___FAILED:_fread___FAILED_to_read_the_till_sheet_struct.
jmp 0x4cf9b7
mov eax, dword [ebx + 0x11b8]
test eax, eax
je 0x4cf8ef
push edi
push eax
call fcn.004ee464
push esi
push edi
push dword [ebx + 0x11b8]
mov dword [ebx + 0x11b0], eax
push eax
call fcn.004e8bc6
add esp, 0x18
mov eax, dword [ebx + 0x11c0]
test eax, eax
je 0x4cf917
push edi
push eax
call fcn.004ee464
push esi
push edi
push dword [ebx + 0x11c0]
mov dword [ebx + 0x11bc], eax
push eax
call fcn.004e8bc6
add esp, 0x18
and dword [ebx + 0x104c], 0
cmp dword [ebx + 0x1040], 0
je 0x4cf99e
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
lea esi, [ebp - 0x14]
push 8
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
inc eax
mov word [ebp - 0x12], ax
pop eax
mov word [ebp - 0xe], ax
sub esp, 0x10
mov edi, esp
mov eax, 0x7d7
mov word [ebp - 0x14], ax
sub esp, 0x10
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, esp
lea esi, [ebx + 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.004c9469
add esp, 0x20
test eax, eax
je 0x4cf99b
xor ecx, ecx
lea eax, [ebx + 0x1040]
cmp dword [ebx + 0xb8], ecx
je 0x4cf986
cmp word [ebx + 0x2a], cx
je 0x4cf986
xor edi, edi
inc edi
jmp 0x4cf98f
xor edi, edi
inc edi
mov dword [ebx + 0x1050], edi
cmp dword [ebx + 0x1050], ecx
jne 0x4cf99e
mov dword [eax], ecx
jmp 0x4cf99e
xor edi, edi
inc edi
mov eax, edi
jmp 0x4cf9c1
test eax, eax
je 0x4cf9bf
push ecx
push eax
push edi
push esi
call fcn.0042d104
pop ecx
pop ecx
push eax
push str.:7:LoadTillSheetFromProgressRAW___s___FAILED:_The_server_may_need_to_be_recompiled:_The_till_sheet_size_is_invalid:__ld__ld
call fcn.004255b9
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4d5056
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x59a240]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push edi
push 0x104
xor ebx, ebx
push ebx
push eax
call fcn.004e4da0
lea eax, [ebp - 0x108]
mov dword [ebp - 0x10c], ebx
push str.FcUpd.flg
push eax
call fcn.0046379e
add esp, 0x14
lea eax, [ebp - 0x108]
push ebx
push 0x80
push 3
push ebx
push 7
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4d50d2
test esi, esi
je 0x4d50ce
push 0x10
push ebx
push esi
call fcn.004e4da0
add esp, 0xc
xor eax, eax
jmp 0x4d5140
test esi, esi
je 0x4d50e8
push ebx
lea eax, [ebp - 0x10c]
push eax
push 0x10
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0x19c7
push str.E:UserskerryDocumentsVisual_Studio_2022ProjectsPAULA__TEMP_COPY_UpdatePAULA.c
push str.GetForceUpdateFlag
push edi
call fcn.00426fac
lea eax, [ebp - 0x108]
push eax
call fcn.00429e69
pop ecx
test eax, eax
jne 0x4d511f
push str._GetLastError_
push str.:4:GetForceUpdateFlag___FAILED_to_delete_the_flag_file:__s
call fcn.004255b9
pop ecx
pop ecx
cmp dword [ebp - 0x10c], 0x10
je 0x4d513d
push 0x10
push dword [ebp - 0x10c]
push str.:4:GetForceUpdateFlag___encountered_a_problem:_only__d_bytes_of__d_were_could_be_loaded.
call fcn.004255b9
add esp, 0xc
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e3632
leave
ret
Function at 0x4d5830
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x59a240]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
xor eax, eax
push esi
push edi
lea edi, [ebp - 0x14]
test ecx, ecx
stosd dword es:[edi], eax
push 0x10
push 0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea edi, [ebp - 0x14]
cmovne edi, ecx
push edi
call fcn.004e4da0
add esp, 0xc
push 0xfbd
push str.E:UserskerryDocumentsVisual_Studio_2022ProjectsPAULA__TEMP_COPY_UpdatePAULA.c
push 0x50965c
push str.LstFtpStmp.tim
push 0
call fcn.0047ced0
pop ecx
pop ecx
push eax
call fcn.0042d2de
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4d58a6
push esi
push 1
push 0x10
push edi
call fcn.004e8bc6
push esi
call fcn.0042d153
xor eax, eax
add esp, 0x14
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004e3632
leave
ret

Function at 0x4d58ba
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x59a240]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x104
push 0
push eax
mov dword [ebp - 0x120], esi
call fcn.004e4da0
xor eax, eax
lea edi, [ebp - 0x118]
stosd dword es:[edi], eax
xor ecx, ecx
add esp, 0xc
mov dword [ebp - 0x11c], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0x4d590c
mov dword [esi], ecx
test ebx, ebx
je 0x4d591e
push 0x10
push ecx
push ebx
call fcn.004e4da0
add esp, 0xc
xor ecx, ecx
push str.prcolmem.dat
push ecx
push ecx
call fcn.0047ced0
pop ecx
pop ecx
push eax
push 0x50d2a0
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.004a0ddb
push 0x1200
push str.E:UserskerryDocumentsVisual_Studio_2022ProjectsPAULA__TEMP_COPY_UpdatePAULA.c
lea eax, [ebp - 0x108]
push 0x50965c
push eax
call fcn.0042d2de
mov esi, eax
add esp, 0x24
test esi, esi
je 0x4d59b7
push esi
push 1
lea eax, [ebp - 0x11c]
push 4
push eax
call fcn.004e8bc6
push esi
push 1
lea eax, [ebp - 0x118]
push 0x10
push eax
call fcn.004e8bc6
push esi
call fcn.0042d153
mov ecx, dword [ebp - 0x120]
add esp, 0x24
test ecx, ecx
je 0x4d59a4
mov eax, dword [ebp - 0x11c]
mov dword [ecx], eax
test ebx, ebx
je 0x4d59b4
mov edi, ebx
lea esi, [ebp - 0x118]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e3632
leave
ret
Function at 0x4d8331
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x59a240]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
lea eax, [ebp - 0x108]
push 0x104
push esi
push eax
mov dword [ebp - 0x10c], esi
mov dword [ebp - 0x114], esi
mov dword [ebp - 0x110], esi
mov dword [ebp - 0x118], esi
call fcn.004e4da0
lea eax, [ebp - 0x108]
push str.Live.ark
push eax
call fcn.0046379e
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00403c43
add esp, 0x20
test eax, eax
je 0x4d84aa
call fcn.004ca9ca
push esi
push esi
mov ebx, eax
call fcn.0047ced0
push eax
lea eax, [ebp - 0x108]
push str._sLUA.DAT
push eax
call fcn.00404f28
add esp, 0x14
push 0x21cb
push str.E:UserskerryDocumentsVisual_Studio_2022ProjectsPAULA__TEMP_COPY_UpdatePAULA.c
lea eax, [ebp - 0x108]
push 0x50965c
push eax
call fcn.0042d2de
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x4d842a
lea eax, [ebp - 0x108]
push eax
call fcn.0042916f
pop ecx
test eax, eax
je 0x4d84a5
push 0x96
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004ca9ca
sub eax, ebx
cmp eax, 0x157c
ja 0x4d84a5
inc esi
cmp esi, 0xf
jl 0x4d83cc
jmp 0x4d84a5
push edi
push 1
lea eax, [ebp - 0x118]
push 4
push eax
call fcn.004e8bc6
add esp, 0x10
cmp eax, 1
je 0x4d8456
lea eax, [ebp - 0x108]
push eax
push str.:8:IsNewUpdateAvailable___encountered_a_problem:_fread___s___FAILED_to_read_the_archive_size_
call fcn.00425c08
pop ecx
pop ecx
push edi
push 1
lea eax, [ebp - 0x110]
push 4
push eax
call fcn.004e8bc6
add esp, 0x10
cmp eax, 1
je 0x4d8482
lea eax, [ebp - 0x108]
push eax
push str.:8:IsNewUpdateAvailable___encountered_a_problem:_fread___s___FAILED_to_read_the_archive_CheckSum_
call fcn.00425c08
pop ecx
pop ecx
push edi
call fcn.0042d153
pop ecx
mov ecx, dword [ebp - 0x10c]
cmp ecx, dword [ebp - 0x110]
jne 0x4d84a5
mov ecx, dword [ebp - 0x114]
cmp ecx, dword [ebp - 0x118]
je 0x4d84aa
xor eax, eax
inc eax
jmp 0x4d84ac
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e3632
leave
ret
Function at 0x4df8ce
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x188
mov eax, dword [0x59a240]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x44]
push 0x40
xor ebx, ebx
push ebx
push eax
call fcn.004e4da0
push 0x40
lea eax, [ebp - 0x84]
push ebx
push eax
call fcn.004e4da0
push 0x104
lea eax, [ebp - 0x188]
push ebx
push eax
call fcn.004e4da0
push str.E:UserskerryDocumentsVisual_Studio_2022ProjectsPAULA__TEMP_COPY_UpdatePAULA.c
push 0x107c
push ebx
call fcn.00459b09
mov esi, eax
add esp, 0x30
test esi, esi
jne 0x4df936
xor eax, eax
jmp 0x4dfa2f
push str.:0:FYI:_Updating_servers_from_global_server_index.txt
call fcn.00425c08
lea eax, [ebp - 0x188]
push eax
push str.b_Z_19_S_P_Wi_pi_ysmTwXNejdx_jOjpV
call fcn.004a0bb6
push ebx
push ebx
push edi
push 0xea60
push str.PAULAWAULA
push str.PAULA
lea eax, [ebp - 0x188]
push esi
push eax
call fcn.00419740
add esp, 0x2c
push esi
test eax, eax
jne 0x4df984
call fcn.00459cd4
xor eax, eax
jmp 0x4dfa2e
call fcn.0045a8a9
push esi
lea eax, [ebp - 0x44]
push 0x3f
push eax
call fcn.0045a713
lea eax, [ebp - 0x44]
push eax
call fcn.004a0b9c
lea eax, [ebp - 0x44]
push eax
call fcn.0046096b
add esp, 0x18
test eax, eax
jne 0x4df9cf
lea eax, [ebp - 0x44]
push eax
push str.primary
push str.:7:UpdateServerIps___received_an_invalid__s_server_entry:___s_
call fcn.004255b9
push esi
call fcn.00459cd4
add esp, 0x10
jmp 0x4df92f
push esi
lea eax, [ebp - 0x84]
push 0x3f
push eax
call fcn.0045a713
lea eax, [ebp - 0x84]
push eax
call fcn.004a0b9c
lea eax, [ebp - 0x84]
push eax
call fcn.0046096b
add esp, 0x14
test eax, eax
jne 0x4dfa0b
lea eax, [ebp - 0x84]
push eax
push str.secondary
jmp 0x4df9b7
lea eax, [ebp - 0x44]
push eax
call fcn.004608c3
mov dword [0x6a11dc], eax
lea eax, [ebp - 0x84]
push eax
call fcn.004608c3
mov dword [0x6a11e0], eax
xor eax, eax
pop ecx
inc eax
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e3632
leave
ret
Function at 0x4e41c4
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
jmp 0x4e41f9
mov ecx, dword [edx + 0xc]
cmp dword [ebp + 0xc], ecx
jb 0x4e41f6
mov eax, dword [edx + 8]
add eax, ecx
cmp dword [ebp + 0xc], eax
jb 0x4e4202
add edx, 0x28
cmp edx, esi
jne 0x4e41e4
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x4e41ff

Function at 0x4e4661
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4e46a0
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4e46a0
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4e46a0
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4e46a0
cmp dword [ecx + 0x74], 0xe
jbe 0x4e46a0
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4e9428
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.004e3640
mov eax, dword [0x59a240]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.004f96fc
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4e946a
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x4e95c6
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.004e3b10
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x6a1d48]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.004fbb5e
mov ecx, dword [esi*4 + 0x6a1d48]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x4e95bf
cmp eax, dword [edi + ecx + 0x24]
jne 0x4e95bf
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4e95bf
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004fbb5e
add esp, 0x14
test edx, edx
jl 0x4e95bf
jg 0x4e9535
test eax, eax
jb 0x4e95bf
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x4e95bf
jl 0x4e954f
cmp dword [ebp - 0x1008], eax
ja 0x4e95bf
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x4e956d
test ebx, ebx
je 0x4e95a6
cmp ecx, edi
jae 0x4e95a6
mov al, byte [ecx]
cmp al, 0xd
jne 0x4e9587
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4e9593
cmp byte [ecx + 1], 0xa
jne 0x4e9593
inc ecx
jmp 0x4e9593
movzx eax, al
movsx eax, byte [eax + 0x59a490]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4e956d
cmp edx, ebx
jne 0x4e956d
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x4e95c4
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004e3632
leave
ret
Function at 0x4fa9c8
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004fa839

Function at 0x4fae1d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x6a1d48]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4fae5d
cmp byte [ebx], 0xa
jne 0x4fae5d
or byte [eax + edi + 0x28], 4
jmp 0x4fae62
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x4faf60
mov al, byte [edx]
cmp al, 0x1a
je 0x4faf42
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x4fae91
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x4faeb6
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x4faec0
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x4fae73
jmp 0x4faf60
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4faf3d
cmp dword [ebp - 0xc], 0
je 0x4faf3d
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x6a1d48]
test byte [eax + edi + 0x28], 0x48
je 0x4faf17
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4faf02
mov byte [esi], dl
jmp 0x4faf13
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x6a1d48]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x4faf60
cmp byte [ebp - 1], 0xa
jne 0x4faf26
cmp esi, ebx
jne 0x4faf26
mov byte [esi], 0xa
jmp 0x4faf5f
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004fbb7c
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x4faf60
mov byte [esi], 0xd
jmp 0x4faf5f
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x6a1d48]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4faf5c
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4faf60
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4faf69
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x6a1d48]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4fafac
cmp word [esi], dx
jne 0x4fafac
or byte [edi + eax + 0x28], 4
jmp 0x4fafb1
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x4fb0ea
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x4fb0ca
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x4faff3
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4fb029
cmp eax, edx
jae 0x4fb035
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x4fafcb
jmp 0x4fb0ea
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4fb0c6
cmp dword [ebp - 0x14], 0
je 0x4fb0c6
mov eax, dword [ebx*4 + 0x6a1d48]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x4fb09e
mov cx, word [ebp - 4]
pop eax
cmp cx, ax
je 0x4fb0e4
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x6a1d48]
push 0xa
mov byte [edi + eax + 0x2a], cl
mov eax, dword [ebx*4 + 0x6a1d48]
shr cx, 8
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x6a1d48]
pop ecx
mov byte [edi + eax + 0x2c], cl
jmp 0x4fb0e7
pop ebx
cmp word [ebp - 4], bx
jne 0x4fb0af
cmp esi, dword [ebp + 0xc]
jne 0x4fb0af
mov word [esi], bx
jmp 0x4fb0e7
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004fbb7c
add esp, 0x10
cmp word [ebp - 4], bx
je 0x4fb0ea
push 0xd
jmp 0x4fb0e3
mov ecx, dword [ebx*4 + 0x6a1d48]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4fb0e1
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4fb0ea
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4fe318
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5821b0
push 0x5821a8
push str.FlsAlloc
push 0x1e
call fcn.004fe1d9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4fe34c
push dword [ebp + 8]
mov ecx, esi
call dword [0x50957c]
call esi
jmp 0x4fe352
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4fe396
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x5821c0
push 0x5821b8
push str.FlsGetValue
push 0x20
call fcn.004fe1d9
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4fe3cd
push dword [ebp + 8]
mov ecx, esi
call dword [0x50957c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]