joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ad480
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov esi, esp
mov edi, ecx
mov eax, dword [0x4e6418]
xor eax, ebp
mov dword [esi + 0x28], eax
lea eax, [ecx + 0x61850]
xor ebx, ebx
cmp word [ecx + 0x61850], 0
cmove eax, ebx
sub esp, 0x14
movaps xmm0, xmmword [0x4d7820]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], eax
test eax, eax
je 0x4ad61d
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + 0x2048]
cmp word [ecx + 0x2348], 0
je 0x4ad4f3
mov edx, ecx
add edx, 0x2348
mov dword [esi + 0xc], edx
jne 0x4ad50d
lea edx, [edi + 0x60608]
mov dword [esi + 0xc], edx
xor edx, edx
cmp word [edi + 0x60608], 0
cmovne edx, dword [esi + 0xc]
mov dword [esi + 0xc], edx
test ebx, ebx
je 0x4ad51b
cmp word [ecx + 0x2048], 0
jne 0x4ad52e
lea edx, [edi + 0x60708]
xor ebx, ebx
cmp word [edi + 0x60708], 0
cmovne ebx, edx
xor edx, edx
cmp dword [ecx + 4], 1
setne dl
lea ecx, [edx*2 + 1]
mov dword [esi + 0x10], ecx
push 0x4ac620
push eax
call dword [sym.imp.WININET.dll_InternetSetStatusCallbackW]
mov edx, ebx
mov ebx, edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x20]
movzx ecx, word [eax]
add eax, 0x2148
push edi
push dword [ebx + 0x26d4]
push dword [esi + 0x10]
push edx
push dword [esi + 0xc]
push ecx
push eax
push dword [edi + 0x14]
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [edi + 0x18], eax
test eax, eax
je 0x4ad633
cmp word [ebx + 0x60808], 0
je 0x4ad61b
mov edi, ebx
add edi, 0x60808
mov dword [esi + 0x14], 3
push edi
call fcn.0047b6dc
add esp, 4
xor ebx, ebx
cmp eax, 0x3ffffffe
jg 0x4ad5fd
lea ecx, [eax*2 + 2]
mov dword [esi + 0xc], ecx
lea eax, [eax*2 + 5]
and eax, 0xfffffffc
call fcn.0045dd50
mov ebx, esp
and ebx, 0xfffffff0
mov esp, ebx
push ecx
push 0xff
push ebx
call fcn.00460af0
add esp, 0xc
mov byte [ebx], 0
xor eax, eax
push eax
push eax
push dword [esi + 0xc]
push ebx
push 0xffffffffffffffff
push edi
push eax
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove ebx, eax
lea eax, [esi + 0x14]
mov dword [eax + 4], ebx
mov dword [eax + 8], 0x4d3359
push 0xc
push eax
push 0x26
mov eax, dword [ebp + 8]
push dword [eax + 0x14]
call dword [sym.imp.WININET.dll_InternetSetOptionA]
mov bl, 1
mov ecx, dword [esi + 0x28]
xor ecx, ebp
call fcn.0045901d
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
xor ebx, ebx
jmp 0x4ad61d
Function at 0x4ad6e0
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [0x4e6418]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
mov ecx, dword [esi + 0x26d8]
mov edx, dword [esi + 0x26dc]
sub edx, ecx
sar edx, 2
cmp edx, eax
jbe 0x4ad7bb
mov edi, dword [ecx + eax*4]
mov dword [edi + 0x28], 2
mov ecx, dword [edi + 0x20]
cmp dword [ecx + 4], 1
je 0x4ad76a
mov bl, 1
cmp dword [esi + 0x2480], 0
je 0x4ad77b
lea eax, [ebp - 0x14]
mov dword [eax], 0
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0x2484]
push dword [esi + 0x2480]
push dword [edi + 0x1c]
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x4ad791
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x4ad77b
cmp dword [edi], 0
jne 0x4ad7a2
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x4ad7a2
mov dword [edi + 0x18], ecx
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045901d
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x4ad77b
xor ebx, ebx
jmp 0x4ad77b
mov dword [edi + 0x28], 0
mov ecx, esi
push 1
push eax
call fcn.004aeb90
mov bl, 1
test al, al
jne 0x4ad77b
jmp 0x4ad79e
push str....._third_partylibc_srcinclude_vector:1393:_assertion___n___size___failed:_vector___index_out_of_bounds_n
push 0x4d143c
call fcn.0048e9c0
int3
Function at 0x4adf10
Capabilities:
Send data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov edx, dword [ebp + 8]
mov eax, dword [0x4e6418]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + 0x26d8]
mov ecx, dword [ecx + 0x26dc]
sub ecx, eax
sar ecx, 2
cmp ecx, edx
jbe 0x4adff3
mov edi, dword [eax + edx*4]
mov dword [edi + 0x28], 6
mov eax, dword [edi + 0x20]
cmp dword [eax + 4], 1
je 0x4adfa9
mov bl, 1
cmp dword [esi + 0x2480], 0
je 0x4adfba
lea eax, [ebp - 0x14]
mov dword [eax], 0
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 0x14]
push eax
push dword [esi + 0x2484]
push dword [esi + 0x2480]
push dword [edi + 0x1c]
call dword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x4adf99
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x4adfba
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
sete bl
jmp 0x4adfba
cmp dword [edi], 0
jne 0x4adfd0
mov eax, dword [edi + 4]
test eax, eax
je 0x4adfd0
mov dword [edi + 0x18], eax
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045901d
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov dword [edi + 0x28], 4
mov ecx, esi
push 1
push edx
mov edi, edx
call fcn.004aeb90
mov bl, 1
test al, al
jne 0x4adfba
mov ecx, esi
push edi
call fcn.004aea90
jmp 0x4adfba
push str....._third_partylibc_srcinclude_vector:1393:_assertion___n___size___failed:_vector___index_out_of_bounds_n
push 0x4d143c
call fcn.0048e9c0
int3
Function at 0x4ae440
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x26d8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ecx + 0x26dc]
sub ecx, eax
sar ecx, 2
cmp ecx, edx
jbe 0x4ae575
mov ebx, dword [eax + edx*4]
xor eax, eax
mov dword [ebx + 0x8068], eax
xorps xmm0, xmm0
movups xmmword [ebx + 0x8058], xmm0
movups xmmword [ebx + 0x8048], xmm0
mov dword [ebx + 0x8044], 0x28
lea edi, [ebx + 0x40]
mov esi, 0x8000
push esi
push eax
push edi
call fcn.00460af0
add esp, 0xc
mov dword [ebx + 0x8058], edi
lea edi, [ebx + 0x805c]
mov dword [ebx + 0x805c], esi
mov ecx, dword [ebx + 0x8040]
test ecx, ecx
je 0x4ae504
mov edx, dword [ecx + 8]
mov eax, dword [ecx + 0x10]
add edx, dword [ecx + 0x18]
sub eax, edx
inc eax
mov ecx, 0x8000
cmp eax, 0x8000
cmovl ecx, eax
mov dword [edi], ecx
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [ebx + 0x28], 9
mov eax, dword [ebx + 0x20]
cmp dword [eax + 4], 1
je 0x4ae525
lea eax, [ebx + 0x8044]
push ebx
push 1
push eax
push dword [ebx + 0x1c]
call dword [sym.imp.WININET.dll_InternetReadFileExA]
jmp 0x4ae53b
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + 0x5d100]
mov ecx, dword [ecx + 0x5d104]
and ecx, eax
cmp ecx, 0xffffffff
je 0x4ae4d6
mov ecx, dword [ebp - 0x10]
sub eax, dword [ecx + 0x5d110]
jmp 0x4ae4c7
push edi
push dword [ebx + 0x805c]
push dword [ebx + 0x8058]
push dword [ebx + 0x1c]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x4ae554
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov al, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov al, 1
cmp ecx, 0x3e5
je 0x4ae54a
mov ecx, dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.004aea90
xor eax, eax
jmp 0x4ae54a
push str....._third_partylibc_srcinclude_vector:1393:_assertion___n___size___failed:_vector___index_out_of_bounds_n
push 0x4d143c
call fcn.0048e9c0
int3
Function at 0x4ae8b0
Capabilities:
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1040
call fcn.0045dd50
mov esi, ecx
mov eax, dword [0x4e6418]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor ebx, ebx
cmp dword [ecx + 0x2480], ebx
mov eax, 0x4d789c
mov edi, str.POST
cmove edi, eax
lea eax, [ebp - 0x18]
mov dword [eax], 0x4d78ae
mov dword [eax + 4], ebx
lea eax, [ebp - 0x1018]
push 0x1000
push ebx
push eax
call fcn.00460af0
add esp, 0xc
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x20]
lea ecx, [eax + 0x1048]
add eax, 0x48
push ecx
push eax
push str._s_s
push 0x7ff
lea eax, [ebp - 0x1018]
push eax
call fcn.004af540
add esp, 0x14
xor eax, eax
mov dword [ebp - 0x104c], esi
cmp dword [esi + 0x62cb4], ebx
setne al
shl eax, 0x13
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x20]
cmp dword [ecx + 4], 4
mov ecx, 0x8480f300
mov edx, 0x8400c300
cmove edx, ecx
or edx, eax
push esi
push edx
lea ecx, [ebp - 0x18]
push ecx
push ebx
push str.HTTP_1.1
lea ecx, [ebp - 0x1018]
push ecx
push edi
push dword [esi + 0x18]
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov dword [esi + 0x1c], eax
test eax, eax
je 0x4aea0e
lea ecx, [ebp - 0x101c]
mov dword [ecx], 0x3a98
mov edi, 4
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
push edi
push ecx
push 2
push eax
call esi
lea eax, [ebp - 0x1020]
mov dword [eax], 1
push edi
push eax
push 0x41
mov eax, dword [ebp + 8]
push dword [eax + 0x1c]
call esi
mov esi, eax
xorps xmm0, xmm0
movups xmmword [ebp - 0x1034], xmm0
movups xmmword [ebp - 0x1044], xmm0
mov dword [ebp - 0x1024], 0
mov dword [ebp - 0x1048], 0x28
push 0xa2d0
call fcn.00457063
add esp, 4
test eax, eax
jne 0x4aea27
lea eax, [ebp - 0x1048]
mov ecx, dword [ebp + 8]
push ecx
push 1
push 0
push eax
push dword [ecx + 0x1c]
call dword [sym.imp.WININET.dll_HttpSendRequestExW]
mov esi, eax
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045901d
mov eax, ebx
add esp, 0x1040
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov ebx, eax
xor eax, eax
test esi, esi
setne al
mov esi, eax
xor eax, eax
push 0xa2d0
push eax
push ebx
call fcn.00460af0
add esp, 0xc
mov ecx, dword [ebp - 0x104c]
push esi
push 0x5167
push ebx
mov esi, dword [ebp + 8]
push esi
call fcn.004af5a0
lea edi, [ebp - 0x1048]
mov dword [edi + 8], ebx
push ebx
call fcn.0047b6dc
add esp, 4
mov dword [edi + 0xc], eax
push esi
push 1
xor eax, eax
push eax
push edi
push dword [esi + 0x1c]
call dword [sym.imp.WININET.dll_HttpSendRequestExW]
mov esi, eax
push ebx
call fcn.0045706c
add esp, 4
jmp 0x4aea09
Function at 0x4af100
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x4e6418]
xor eax, ebp
mov dword [esp + 0x18], eax
mov bl, 1
cmp dword [ecx + 8], 0
je 0x4af134
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.0045901d
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, ecx
xor ebx, ebx
lea edi, [esp + 8]
mov dword [edi + 4], ebx
mov dword [edi], ebx
lea eax, [ecx + 0x5d120]
mov dword [esp], eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetDriveNumberW]
add eax, 0x41
lea ecx, [esp + 0x10]
mov word [ecx], ax
mov dword [ecx + 2], 0x5c003a
mov word [ecx + 6], 0
push ebx
push ebx
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x4af11f
mov ecx, dword [esi + 0x5d100]
mov eax, dword [esi + 0x5d104]
mov edx, ecx
and edx, eax
cmp edx, 0xffffffff
je 0x4af1a6
cmp ecx, dword [esp + 8]
sbb eax, dword [esp + 0xc]
jb 0x4af1a6
mov dword [esi + 0x2470], 2
xor ebx, ebx
jmp 0x4af11f
sub esp, 0x1c
movaps xmm0, xmmword [0x4d7830]
movups xmmword [esp + 4], xmm0
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x20
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 8], eax
cmp eax, 0xffffffff
je 0x4af206
mov bl, 1
cmp byte [esi + 0x26f0], 0
je 0x4af11f
lea edi, [esi + 0x26e4]
mov eax, dword [esi + 0x26e4]
mov ecx, dword [esi + 0x26e8]
cmp ecx, eax
je 0x4af22d
add ecx, 0xfffffffc
jne 0x4af1fb
jmp 0x4af21e
mov dword [esi + 0x2470], 3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x2474], eax
jmp 0x4af19f
push str....._third_partylibc_srcinclude__memoryconstruct_at.h:66:_assertion___loc___nullptr_failed:_null_pointer_given_to_destroy_at_n
push 0x4d143c
call fcn.0048e9c0
mov dword [esi + 0x26e8], eax
mov ecx, esi
call fcn.004af8f0
test al, al
jne 0x4af11f
mov ecx, dword [esi + 0x2468]
test ecx, ecx
je 0x4af258
mov eax, 0xa
cmp ecx, 0xb
jae 0x4af25d
jmp 0x4af263
mov eax, 5
mov dword [esi + 0x2468], eax
lea ecx, [esi + 0x5cfb8]
xor eax, eax
mov dword [esi + 0x5cfc4], eax
mov dword [esi + 0x5cfc0], eax
mov eax, dword [esi + 0x5d100]
mov edx, dword [esi + 0x5d104]
add eax, 0xffffffff
adc edx, 0xffffffff
mov dword [esi + 0x5cfc8], eax
mov dword [esi + 0x5cfcc], edx
mov dword [esp + 4], ecx
mov eax, dword [esi + 0x26e8]
cmp eax, dword [esi + 0x26ec]
jae 0x4af2e3
test eax, eax
je 0x4af2f1
mov dword [eax], ecx
add eax, 4
mov dword [esi + 0x26e8], eax
mov eax, dword [esi + 0x5d100]
mov ecx, dword [esi + 0x5d104]
lea edx, [esp + 4]
mov dword [edx], ecx
push 0
push edx
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x4af11f
lea eax, [esp + 4]
mov ecx, edi
push eax
call fcn.004b0100
jmp 0x4af2b0
push str....._third_partylibc_srcinclude__memoryconstruct_at.h:40:_assertion___location___nullptr_failed:_null_pointer_given_to_construct_at_n
jmp 0x4af223
Function at 0x4af300
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, dword [ebp + 8]
mov eax, dword [0x4e6418]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [edi + 0x805c]
mov edx, dword [edi + 0x20]
cmp dword [edx + 4], 1
cmove eax, edi
mov esi, ecx
mov ebx, dword [eax]
cmp byte [ecx + 0x26f0], 0
jne 0x4af385
xor eax, eax
lea ecx, [ebp - 0x14]
mov dword [ecx], eax
lea edx, [edi + 0x40]
push eax
push ecx
push ebx
push edx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4af353
cmp dword [ebp - 0x14], ebx
je 0x4af36b
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045901d
mov eax, ebx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4
add dword [esi + 0x5d110], ebx
adc dword [esi + 0x5d114], 0
mov ecx, esi
push ebx
push edi
call fcn.004afd20
mov bl, 1
jmp 0x4af355
mov ecx, esi
call fcn.004afb40
mov edx, dword [edi + 0x8040]
mov eax, dword [edx + 0x18]
add eax, dword [edx + 8]
mov ecx, dword [edx + 0x1c]
mov dword [ebp - 0x1c], edx
adc ecx, dword [edx + 0xc]
lea edx, [ebp - 0x14]
mov dword [edx], ecx
push 0
push edx
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x4af3de
xor eax, eax
lea ecx, [ebp - 0x18]
mov dword [ecx], eax
lea edx, [edi + 0x40]
push eax
push ecx
push ebx
push edx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4af353
cmp dword [ebp - 0x18], ebx
jne 0x4af353
jmp 0x4af3ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4af353
jmp 0x4af3b8
mov eax, dword [ebp - 0x1c]
add dword [eax + 0x18], ebx
adc dword [eax + 0x1c], 0
add dword [esi + 0x5d110], ebx
adc dword [esi + 0x5d114], 0
mov ecx, esi
push ebx
push edi
call fcn.004afd20
mov ecx, esi
call fcn.004afc30
jmp 0x4af381
Function at 0x4afb40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x214
mov esi, ecx
mov eax, dword [0x4e6418]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor edi, edi
lea ebx, [ebp - 0x21c]
mov dword [ebx], edi
mov dword [ebp - 0x220], edi
lea eax, [ebp - 0x218]
push 0x208
push edi
push eax
call fcn.00460af0
add esp, 0xc
push 2
push edi
push 0xffffffffffffff96
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
push ebx
push 0x6a
lea eax, [ebp - 0x218]
push eax
mov edi, esi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebx], 0x6a
jne 0x4afc16
mov esi, ebx
push str.546865576F726C64_86C36F73_2C25_4a7d_91EA_F5581018A42D
lea eax, [ebp - 0x218]
push eax
call fcn.0047b638
add esp, 8
test eax, eax
jne 0x4afc16
mov eax, 0xfffffffc
sub eax, dword [ebp - 0x21c]
xor ecx, ecx
inc ecx
xor edx, edx
push ecx
push edx
push eax
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ebx, [ebp - 0x220]
xor eax, eax
push eax
push esi
push 4
push ebx
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebx]
add eax, dword [ebp - 0x21c]
neg eax
xor ecx, ecx
inc ecx
push ecx
xor ecx, ecx
push ecx
push eax
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045901d
add esp, 0x214
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4afc30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov eax, dword [0x4e6418]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov edi, dword [ecx + 0x26e8]
mov ebx, dword [ecx + 0x26e4]
mov ecx, edi
sub ecx, ebx
sar ecx, 2
mov dword [ebp - 0x18], ecx
push 2
push eax
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp edi, ebx
je 0x4afcf7
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x18]
push 0
push eax
push 4
push ecx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 0x26e4]
cmp dword [esi + 0x26e8], eax
je 0x4afd12
mov ebx, 4
xor edi, edi
push 0
lea ecx, [ebp - 0x14]
push ecx
push 0x20
push dword [eax + edi*4]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
add ebx, 0x20
inc edi
mov eax, dword [esi + 0x26e4]
mov ecx, dword [esi + 0x26e8]
sub ecx, eax
sar ecx, 2
cmp edi, ecx
jb 0x4afc9f
mov dword [ebp - 0x18], ebx
xor eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
lea edi, [ebp - 0x14]
push edi
push 4
lea eax, [ebp - 0x18]
push eax
push dword [esi + 8]
call ebx
xor eax, eax
push eax
push edi
push 0x6a
push str.546865576F726C64_86C36F73_2C25_4a7d_91EA_F5581018A42D
push dword [esi + 8]
call ebx
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045901d
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, 4
jmp 0x4afccc
Function at 0x4b0cb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20c
mov eax, dword [0x4e6418]
xor eax, ebp
mov dword [ebp - 0x10], eax
call fcn.00448290
mov ecx, eax
push str.enable_logging
call fcn.004482a0
test al, al
je 0x4b0d81
mov bl, 1
cmp dword [0x4eefa0], 0
jne 0x4b0d83
mov esi, dword [0x4eef8c]
test esi, esi
je 0x4b0d9a
test byte [0x4e81c8], 1
je 0x4b0d83
cmp byte [esi + 0xb], 0
jns 0x4b0d0d
mov esi, dword [esi]
sub esp, 0x1c
movaps xmm0, xmmword [0x4d7cc0]
movups xmmword [esp + 4], xmm0
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x4eefa0], eax
inc eax
cmp eax, 1
ja 0x4b0d83
lea esi, [ebp - 0x216]
push 0x206
push 0xff
push esi
call fcn.00460af0
add esp, 0xc
mov word [esi - 2], 0
lea esi, [ebp - 0x218]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jae 0x4b0e33
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045901d
mov eax, ebx
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret
push 0xc
call fcn.00456ffd
add esp, 4
mov esi, eax
lea edi, [ebp - 0x218]
push 0x208
push 0xff
push edi
call fcn.00460af0
add esp, 0xc
push 0x104
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
dec eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov ecx, esi
push edi
call fcn.0048c410
movzx eax, byte [esi + 0xb]
mov ecx, esi
test al, al
jns 0x4b0def
mov eax, dword [esi + 4]
mov ecx, dword [esi]
test eax, eax
jne 0x4b0e0c
mov ecx, esi
push 9
push str.debug.log
call fcn.00429ee0
mov dword [0x4eef8c], esi
jmp 0x4b0cfc
add eax, eax
test eax, eax
je 0x4b0df3
lea edx, [eax - 2]
cmp word [ecx + eax - 2], 0x5c
mov eax, edx
jne 0x4b0e0e
cmp edx, 0xfffffffe
je 0x4b0df3
sar edx, 1
inc edx
mov ecx, esi
push 0xffffffffffffffff
push edx
call fcn.00423bb0
jmp 0x4b0df3
mov ecx, dword [0x4eef8c]
push esi
call fcn.00429e50
mov ecx, dword [0x4eef8c]
call fcn.004a5000
cmp word [eax], 0x5c
je 0x4b0e62
mov ecx, dword [0x4eef8c]
push 1
push 0x4d25fc
call fcn.00429ee0
mov ecx, dword [0x4eef8c]
push 9
push str.debug.log
call fcn.00429ee0
mov eax, dword [0x4eef8c]
cmp byte [eax + 0xb], 0
jns 0x4b0e81
mov eax, dword [eax]
movaps xmm0, xmmword [0x4d7cc0]
sub esp, 0x1c
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x4eefa0], eax
inc eax
cmp eax, 1
ja 0x4b0d83
mov dword [0x4eefa0], 0
jmp 0x4b0d81
Function at 0x4bf250
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov eax, dword [0x4e6418]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
mov eax, esp
movdqa xmmword [eax], xmm0
movdqa xmmword [eax + 0x30], xmm0
movdqa xmmword [eax + 0x20], xmm0
movdqa xmmword [eax + 0x10], xmm0
mov dword [eax], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x4bf2f8
mov ecx, dword [ebp + 8]
mov esi, dword [esp + 8]
mov edx, dword [esp + 0xc]
shrd esi, edx, 0xa
test edx, 0xfffffe00
mov edx, 0x7fffffff
cmovne esi, edx
mov dword [ecx], esi
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
shrd esi, edi, 0xa
test edi, 0xfffffe00
cmovne esi, edx
mov dword [ecx + 4], esi
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
shrd esi, edi, 0xa
test edi, 0xfffffe00
cmovne esi, edx
mov dword [ecx + 8], esi
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
shrd esi, edi, 0xa
test edi, 0xfffffe00
cmovne esi, edx
mov dword [ecx + 0xc], esi
test eax, eax
setne bl
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.0045901d
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret