joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c1cc0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
mov dword [esp + 4], 0
test esi, esi
je 0x4c1d25
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4c1d1d
push dword [esp + 0x10]
push dword [0x54530c]
call fcn.004d5397
test eax, eax
je 0x4c1d13
cmp dword [eax + 4], 0
je 0x4c1d02
push edi
push esi
push eax
call fcn.004c2780
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea ecx, [esp + 0xc]
push ecx
push edi
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
pop edi
xor eax, eax
pop esi
pop ecx
ret 0xc
xor eax, eax
pop esi
pop ecx
ret 0xc

Function at 0x4c1e60
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push esi
push dword [esp + 0x10]
mov dword [esp + 8], 0
push dword [0x54530c]
call fcn.004d5397
mov esi, eax
test esi, esi
je 0x4c1edf
cmp dword [esi + 4], 0
je 0x4c1eb0
push 1
lea eax, [esp + 8]
push eax
push esi
call fcn.004c2d40
test eax, eax
je 0x4c1ea4
inc dword [esi + 0xc]
xor eax, eax
pop esi
add esp, 8
ret 4
mov eax, 1
pop esi
add esp, 8
ret 4
push 0
lea eax, [esp + 0xc]
push eax
push 1
lea eax, [esp + 0x1c]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4c1eea
cmp dword [esp + 8], 0
je 0x4c1eea
push 1
push 0
push 0xffffffffffffffff
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 4]
pop esi
add esp, 8
ret 4
or eax, 0xffffffff
pop esi
add esp, 8
ret 4

Function at 0x4c1f00
Capabilities:
Write file on windows

Disassembly:
push dword [esp + 4]
push dword [0x54530c]
call fcn.004d5397
test eax, eax
je case.0x4c1f2e.3
mov ecx, dword [esp + 8]
add ecx, 0xfffffffe
cmp ecx, 0x17
ja case.0x4c1f2e.3
movzx ecx, byte [ecx + 0x4c2038]
jmp dword [ecx*4 + 0x4c2020]
cmp dword [eax + 4], 0
je 0x4c1f4b
push 2
push 0x509aa4
push eax
call fcn.004c2780
ret 8
push 0
lea ecx, [esp + 8]
push ecx
push 2
push 0x509aa4
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8
cmp dword [eax + 4], 0
je 0x4c1f7a
push 3
push 0x508e68
push eax
call fcn.004c2780
ret 8
push 0
lea ecx, [esp + 8]
push ecx
push 3
push 0x508e68
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8
cmp dword [eax + 4], 0
je 0x4c1fa9
push 2
push 0x509aa8
push eax
call fcn.004c2780
ret 8
push 0
lea ecx, [esp + 8]
push ecx
push 2
push 0x509aa8
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8
cmp dword [eax + 4], 0
je 0x4c1fd8
push 4
push 0x509aac
push eax
call fcn.004c2780
ret 8
push 0
lea ecx, [esp + 8]
push ecx
push 4
push 0x509aac
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8
cmp dword [eax + 4], 0
je 0x4c2007
push 4
push 0x509ab4
push eax
call fcn.004c2780
ret 8
push 0
lea ecx, [esp + 8]
push ecx
push 4
push 0x509ab4
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8
Function at 0x4c20d0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push ebx
push dword [0x54530c]
mov dword [esp + 0x10], 0
call fcn.004d5397
mov ebp, eax
test ebp, ebp
je 0x4c222c
push esi
push edi
push ebx
call fcn.004c2580
cmp dword [ebp + 4], 0
mov esi, eax
mov edi, edx
je 0x4c211c
push 4
lea eax, [esp + 0x1c]
push eax
push ebp
call fcn.004c2d40
mov ecx, eax
mov dword [esp + 0x10], ecx
jmp 0x4c2137
push 0
lea eax, [esp + 0x14]
push eax
push 4
lea eax, [esp + 0x24]
push eax
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x10]
cmp ecx, 2
jl 0x4c2165
lea edx, [esp + 0x18]
mov eax, 0xfeff
cmp word [edx], ax
jne 0x4c2165
add esi, 2
adc edi, 0
push edi
push esi
push ebx
call fcn.004c2440
pop edi
pop esi
pop ebp
mov eax, 0x19
pop ebx
pop ecx
ret 4
cmp ecx, 3
jl 0x4c2196
lea edx, [esp + 0x18]
cmp word [edx], 0xbbef
jne 0x4c2196
cmp byte [edx + 2], 0xbf
jne 0x4c2196
add esi, 3
adc edi, 0
push edi
push esi
push ebx
call fcn.004c2440
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
pop ecx
ret 4
cmp ecx, 2
jl 0x4c21c4
lea edx, [esp + 0x18]
mov eax, 0xfffe
cmp word [edx], ax
jne 0x4c21c4
add esi, 2
adc edi, 0
push edi
push esi
push ebx
call fcn.004c2440
pop edi
pop esi
pop ebp
mov eax, 4
pop ebx
pop ecx
ret 4
cmp ecx, 4
jl 0x4c2217
lea eax, [esp + 0x18]
cmp dword [eax], 0xfeff
jne 0x4c21f0
add esi, 4
adc edi, 0
push edi
push esi
push ebx
call fcn.004c2440
pop edi
pop esi
pop ebp
mov eax, 5
pop ebx
pop ecx
ret 4
lea eax, [esp + 0x18]
cmp dword [eax], 0xfffe0000
jne 0x4c2217
add esi, 4
adc edi, 0
push edi
push esi
push ebx
call fcn.004c2440
pop edi
pop esi
pop ebp
mov eax, 6
pop ebx
pop ecx
ret 4
push edi
push esi
push ebx
call fcn.004c2440
pop edi
pop esi
pop ebp
mov eax, 0x18
pop ebx
pop ecx
ret 4
pop ebp
mov eax, 0x18
pop ebx
pop ecx
ret 4
Function at 0x4c2240
Capabilities:
Write file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov dword [esp], 0
test edx, edx
je 0x4c2348
cmp word [edx], 0
je 0x4c2348
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
test ecx, ecx
jne 0x4c226e
mov ecx, dword [esi + 0x18]
push edi
cmp ecx, 0x19
jne 0x4c22cd
cmp dword [esi + 4], 0
mov ecx, edx
lea edi, [ecx + 2]
je 0x4c22a0
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4c2280
sub ecx, edi
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push edx
push esi
call fcn.004c2780
pop edi
pop esi
pop ecx
ret 0xc
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4c22a0
sub ecx, edi
lea eax, [esp + 8]
push 0
sar ecx, 1
push eax
lea eax, [ecx + ecx]
push eax
push edx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
cmp ecx, 2
lea ecx, [esp + 0x14]
setne al
push ecx
dec eax
and eax, 0xfde9
push edx
push eax
call fcn.004c2e60
mov edi, eax
test edi, edi
je 0x4c22c3
cmp dword [esi + 4], 0
je 0x4c231b
push dword [esp + 0x14]
push edi
push esi
call fcn.004c2780
push edi
push 0
push dword [0x540d84]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x1c]
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
push 0
push dword [0x540d84]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
pop ecx
ret 0xc

Function at 0x4c2350
Capabilities:
Write file on windows

Disassembly:
push dword [esp + 4]
push dword [0x54530c]
call fcn.004d5397
test eax, eax
je 0x4c236c
mov dword [esp + 4], eax
jmp fcn.004c2240
xor eax, eax
ret 0xc

Function at 0x4c2610
Capabilities:
Read file on windows

Disassembly:
push ecx
push dword [esp + 8]
mov byte [esp + 7], 0
push dword [0x54530c]
call fcn.004d5397
test eax, eax
je 0x4c265b
cmp dword [eax + 4], 0
je 0x4c2645
push 1
lea ecx, [esp + 7]
push ecx
push eax
call fcn.004c2d40
movsx eax, byte [esp + 3]
pop ecx
ret 4
push 0
lea ecx, [esp + 0xc]
push ecx
push 1
lea ecx, [esp + 0xf]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
movsx eax, byte [esp + 3]
pop ecx
ret 4

Function at 0x4c2670
Capabilities:
Read file on windows

Disassembly:
push ecx
push dword [esp + 8]
mov dword [esp + 4], 0
push dword [0x54530c]
call fcn.004d5397
test eax, eax
je 0x4c26bd
cmp dword [eax + 4], 0
je 0x4c26a7
push 2
lea ecx, [esp + 4]
push ecx
push eax
call fcn.004c2d40
movsx eax, word [esp]
pop ecx
ret 4
push 0
lea ecx, [esp + 0xc]
push ecx
push 2
lea ecx, [esp + 0xc]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
movsx eax, word [esp]
pop ecx
ret 4
Function at 0x4c26d0
Capabilities:
Read file on windows

Disassembly:
push ecx
push dword [esp + 8]
mov dword [esp + 4], 0
push dword [0x54530c]
call fcn.004d5397
test eax, eax
je 0x4c271c
cmp dword [eax + 4], 0
je 0x4c2706
push 4
lea ecx, [esp + 4]
push ecx
push eax
call fcn.004c2d40
mov eax, dword [esp]
pop ecx
ret 4
push 0
lea ecx, [esp + 0xc]
push ecx
push 4
lea ecx, [esp + 0xc]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp]
pop ecx
ret 4

Function at 0x4c2780
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp dword [esi + 0x1c], 0
jne 0x4c2887
cmp dword [esi + 0x14], 1
jne 0x4c27cb
mov eax, dword [esi + 0xc]
lea ecx, [esp + 0xc]
push 1
neg eax
cdq
push ecx
push eax
push dword [esi]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
push edi
mov edi, dword [esp + 0x20]
cmp eax, edi
jle 0x4c2848
mov ecx, dword [esi + 8]
add ecx, dword [esi + 4]
sub ecx, eax
mov eax, edi
dec eax
je 0x4c2833
dec eax
je 0x4c281c
sub eax, 2
je 0x4c2807
push edi
push dword [esp + 0x20]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov ax, word [eax]
mov word [ecx], ax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov al, byte [eax]
mov byte [ecx], al
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
push esi
call fcn.004c17e0
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x4c2875
push 0
lea eax, [esp + 0xc]
push eax
push edi
push dword [esp + 0x28]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0xc
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
push edi
push dword [esp + 0x20]
add ecx, eax
jmp 0x4c27f1
xor eax, eax
pop esi
add esp, 0xc
ret 0xc
Function at 0x4c2890
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push 0x1000
push 0
push dword [0x540d84]
mov dword [esp + 0x14], 0x1000
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x4c2a14
mov cl, byte [esp + 3]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x28]
push esi
push edi
mov esi, edx
mov edi, edi
cmp ebp, 0xffffffff
je 0x4c28de
test ebp, ebp
je 0x4c2980
dec ebp
cmp dword [ebx + 4], 0
je 0x4c28f7
push 1
lea eax, [esp + 0x17]
push eax
push ebx
call fcn.004c2d40
mov dword [esp + 0x14], eax
jmp 0x4c2911
push 0
lea eax, [esp + 0x18]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
mov cl, byte [esp + 0x13]
cmp eax, 1
jne 0x4c2980
test cl, cl
je 0x4c2925
mov byte [esi], cl
inc esi
mov cl, byte [esp + 0x13]
mov eax, dword [esp + 0x18]
mov edi, esi
mov edx, dword [esp + 0x20]
dec eax
sub edi, edx
cmp edi, eax
jle 0x4c2960
mov eax, dword [esp + 0x18]
add eax, 0x1000
push eax
push edx
push 8
push dword [0x540d84]
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov cl, byte [esp + 0x13]
mov edx, eax
mov dword [esp + 0x20], edx
lea esi, [edi + edx]
test cl, cl
je 0x4c2980
cmp dword [esp + 0x2c], 0
jne 0x4c28d0
cmp cl, 0xd
je 0x4c2987
cmp cl, 0xa
jne 0x4c28d0
dec esi
jmp 0x4c29f7
cmp dword [esp + 0x2c], 0
jne 0x4c29f7
cmp cl, 0xa
jne 0x4c298f
dec esi
jmp 0x4c29f7
cmp cl, 0xd
jne 0x4c29f7
dec esi
cmp dword [ebx + 4], 0
je 0x4c29ae
push 1
lea eax, [esp + 0x17]
push eax
push ebx
call fcn.004c2d40
mov dword [esp + 0x14], eax
jmp 0x4c29c4
push 0
lea eax, [esp + 0x18]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x4c29f7
cmp dword [ebx + 4], 0
je 0x4c29d6
inc dword [ebx + 0xc]
jmp 0x4c29f7
push 1
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], 0xffffffff
push eax
push 0xffffffffffffffff
push dword [ebx]
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x34]
mov ecx, esi
sub ecx, dword [esp + 0x20]
pop edi
mov dword [eax], ecx
mov eax, dword [esp + 0x1c]
mov byte [esi], 0
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
xor eax, eax
add esp, 0x14
ret 0x10
Function at 0x4c2a20
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
push 0x1000
push 0
push dword [0x540d84]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov dword [esp + 8], ecx
test ecx, ecx
je 0x4c2bcd
mov ax, word [esp]
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x2c]
push esi
push edi
mov edi, ecx
mov dword [esp + 0x20], 0x1000
mov dword [esp + 0x1c], 0x7ff
cmp ebp, 0xffffffff
je 0x4c2a74
test ebp, ebp
je 0x4c2b2d
dec ebp
cmp dword [ebx + 4], 0
je 0x4c2a8d
push 2
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.004c2d40
mov dword [esp + 0x14], eax
jmp 0x4c2aa7
push 0
lea eax, [esp + 0x18]
push eax
push 2
lea eax, [esp + 0x1c]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
cmp eax, 2
mov ax, word [esp + 0x10]
jne 0x4c2b2d
test ax, ax
je 0x4c2ac1
mov word [edi], ax
add edi, 2
mov ax, word [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov esi, edi
mov edx, dword [esp + 0x1c]
sub esi, ecx
sar esi, 1
cmp esi, edx
jle 0x4c2b08
mov eax, dword [esp + 0x20]
add edx, 0x800
add eax, 0x1000
mov dword [esp + 0x1c], edx
push eax
push ecx
push 8
push dword [0x540d84]
mov dword [esp + 0x30], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, eax
mov ax, word [esp + 0x10]
mov dword [esp + 0x18], ecx
lea edi, [ecx + esi*2]
test ax, ax
je 0x4c2b2d
cmp dword [esp + 0x30], 0
jne 0x4c2a66
cmp ax, 0xd
je 0x4c2b34
cmp ax, 0xa
jne 0x4c2a66
sub edi, 2
jmp 0x4c2bac
cmp dword [esp + 0x30], 0
jne 0x4c2bac
cmp ax, 0xa
jne 0x4c2b3f
sub edi, 2
jmp 0x4c2bac
cmp ax, 0xd
jne 0x4c2bac
sub edi, 2
cmp dword [ebx + 4], 0
je 0x4c2b61
push 2
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.004c2d40
mov dword [esp + 0x14], eax
jmp 0x4c2b77
push 0
lea eax, [esp + 0x18]
push eax
push 2
lea eax, [esp + 0x1c]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp word [esp + 0x10], 0xa
je 0x4c2bac
cmp dword [ebx + 4], 0
je 0x4c2b8b
add dword [ebx + 0xc], 2
jmp 0x4c2bac
push 1
lea eax, [esp + 0x28]
mov dword [esp + 0x24], 0xfffffffe
push eax
push 0xfffffffffffffffe
push dword [ebx]
mov dword [esp + 0x34], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x38]
mov ecx, edi
sub ecx, dword [esp + 0x18]
sar ecx, 1
mov dword [eax], ecx
xor eax, eax
mov word [edi], ax
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
xor eax, eax
add esp, 0x18
ret 0x10
Function at 0x4c2be0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push 0x1000
push 0
push dword [0x540d84]
mov dword [esp + 0x10], 0x1000
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 0xc], edx
test edx, edx
je 0x4c2d30
mov eax, dword [esp + 0x1c]
mov cl, byte [esp + 3]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, edx
cmp edi, 0xffffffff
je 0x4c2c2c
test edi, edi
je 0x4c2c9d
dec edi
push esi
push ebp
call fcn.004c2ed0
mov dword [esp + 0x20], eax
test eax, eax
jne 0x4c2c3f
xor cl, cl
jmp 0x4c2c41
mov cl, byte [esi]
mov edx, dword [esp + 0x1c]
add esi, eax
mov eax, dword [esp + 0x14]
mov ebx, esi
sub ebx, edx
mov byte [esp + 0x13], cl
add eax, 0xfffffffb
cmp ebx, eax
jle 0x4c2c84
mov eax, dword [esp + 0x14]
add eax, 0x1000
push eax
push edx
push 8
push dword [0x540d84]
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov cl, byte [esp + 0x13]
mov edx, eax
mov dword [esp + 0x1c], edx
lea esi, [ebx + edx]
mov eax, dword [esp + 0x2c]
test cl, cl
je 0x4c2c9d
test eax, eax
jne 0x4c2c22
cmp cl, 0xd
je 0x4c2ca1
cmp cl, 0xa
jne 0x4c2c22
dec esi
jmp 0x4c2d13
test eax, eax
jne 0x4c2d13
cmp cl, 0xa
jne 0x4c2ca9
dec esi
jmp 0x4c2d13
cmp cl, 0xd
jne 0x4c2d13
dec esi
cmp dword [ebp + 4], 0
je 0x4c2cc8
push 1
lea eax, [esp + 0x17]
push eax
push ebp
call fcn.004c2d40
mov dword [esp + 0x20], eax
jmp 0x4c2cdf
push 0
lea eax, [esp + 0x24]
push eax
push 1
lea eax, [esp + 0x1f]
push eax
push dword [ebp]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [esp + 0x13], 0xa
je 0x4c2d13
cmp dword [ebp + 4], 0
je 0x4c2cf1
inc dword [ebp + 0xc]
jmp 0x4c2d13
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0xffffffff
push eax
push 0xffffffffffffffff
push dword [ebp]
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x34]
mov ecx, esi
sub ecx, dword [esp + 0x1c]
pop edi
mov dword [eax], ecx
mov eax, dword [esp + 0x18]
mov byte [esi], 0
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0x10
xor eax, eax
add esp, 0x14
ret 0x10
Function at 0x4c2d40
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
cmp dword [esi + 0x14], 0
jne 0x4c2d61
push esi
call fcn.004c17e0
mov dword [esi + 0x14], 1
mov dword [esi + 0xc], 0
mov ebx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
mov eax, dword [esi + 0x10]
cmp ebx, edi
jl 0x4c2dd5
add eax, dword [esi + 4]
mov ecx, edi
sub eax, ebx
dec ecx
je 0x4c2dc2
dec ecx
je 0x4c2dad
sub ecx, 2
je 0x4c2d9a
push edi
push eax
push dword [esp + 0x1c]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [eax]
mov eax, dword [esp + 0x14]
mov dword [eax], ecx
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov cx, word [eax]
mov eax, dword [esp + 0x14]
mov word [eax], cx
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
mov ecx, dword [esp + 0x14]
mov dl, byte [eax]
mov eax, edi
mov byte [ecx], dl
sub dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 0xc
push ebp
mov ebp, dword [esp + 0x18]
sub eax, ebx
add eax, dword [esi + 4]
push ebx
push eax
push ebp
call sub.MSVCRT.dll_memcpy
mov eax, dword [esi + 8]
add esp, 0xc
sub edi, ebx
add ebp, ebx
push 0
cmp edi, eax
jl 0x4c2e1a
lea eax, [esp + 0x18]
push eax
push edi
push ebp
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
pop ebp
pop edi
mov dword [esi + 0xc], 0
add eax, ebx
pop esi
pop ebx
ret 0xc
lea ecx, [esp + 0x18]
push ecx
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
cmp edi, eax
jle 0x4c2e3b
mov edi, eax
push edi
push dword [esi + 4]
push ebp
call sub.MSVCRT.dll_memcpy
sub dword [esi + 0xc], edi
lea eax, [ebx + edi]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x4c2ed0
Capabilities:
Read file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [edi + 4], 0
je 0x4c2ef7
push 1
lea eax, [esp + 0x10]
push eax
push edi
call fcn.004c2d40
mov dword [esp + 4], eax
jmp 0x4c2f11
push 0
lea eax, [esp + 8]
push eax
push 1
lea eax, [esp + 0x18]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 4]
cmp eax, 1
je 0x4c2f1d
xor eax, eax
pop edi
pop ecx
ret 8
mov cl, byte [esp + 0xc]
test cl, cl
js 0x4c2f39
mov eax, dword [esp + 0x10]
pop edi
mov byte [eax], cl
mov byte [eax + 1], 0
mov eax, 1
pop ecx
ret 8
mov al, cl
and al, 0xe0
push esi
cmp al, 0xc0
jne 0x4c2f49
mov esi, 2
jmp 0x4c2f65
mov al, cl
and al, 0xf0
cmp al, 0xe0
jne 0x4c2f58
mov esi, 3
jmp 0x4c2f65
mov al, cl
and al, 0xf8
cmp al, 0xf0
jne 0x4c2fc2
mov esi, 4
mov edx, dword [esp + 0x14]
mov byte [edx], cl
cmp dword [edi + 4], 0
je 0x4c2f94
lea eax, [esi - 1]
push eax
lea eax, [edx + 1]
push eax
push edi
call fcn.004c2d40
mov edx, eax
lea ecx, [esi - 1]
xor eax, eax
cmp edx, ecx
setne al
dec eax
and eax, esi
pop esi
pop edi
pop ecx
ret 8
push 0
lea eax, [esp + 0xc]
push eax
lea eax, [esi - 1]
push eax
lea eax, [edx + 1]
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 8]
lea ecx, [esi - 1]
xor eax, eax
cmp edx, ecx
setne al
dec eax
and eax, esi
pop esi
pop edi
pop ecx
ret 8
mov eax, dword [esp + 0x14]
pop esi
pop edi
mov word [eax], 0x3f
mov eax, 1
pop ecx
ret 8

Function at 0x4c46f1
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor esi, esi
push esi
mov ebx, esi
call dword [sym.imp.USER32.DLL_OpenClipboard]
test eax, eax
je 0x4c4732
push 0xd
call dword [sym.imp.USER32.DLL_GetClipboardData]
mov edi, eax
test edi, edi
je 0x4c472a
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test esi, esi
je 0x4c472a
push esi
call sub.MSVCRT.dll_wcslen
pop ecx
mov ebx, eax
call dword [sym.imp.USER32.DLL_CloseClipboard]
jmp 0x4c4735
mov edi, dword [ebp + 8]
push dword [ebp + 8]
push ebx
call fcn.004d5d20
test esi, esi
je 0x4c475d
lea ecx, [ebx*2 + 2]
push ecx
push esi
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x4c4762
xor ecx, ecx
mov word [eax], cx
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4c4769
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push edi
xor edi, edi
push edi
call dword [sym.imp.USER32.DLL_OpenClipboard]
test eax, eax
je 0x4c47de
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x4c4787
mov esi, 0x4f4bf4
push esi
call sub.MSVCRT.dll_wcslen
pop ecx
lea ebp, [eax*2 + 2]
push ebp
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x4c47d5
call dword [sym.imp.USER32.DLL_EmptyClipboard]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4c47d5
push ebp
push esi
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 0xd
call dword [sym.imp.USER32.DLL_SetClipboardData]
mov edi, eax
call dword [sym.imp.USER32.DLL_CloseClipboard]
pop esi
pop ebp
pop ebx
mov eax, edi
pop edi
ret 4

Function at 0x4c487f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 4]
test edx, edx
jne 0x4c4890
mov eax, dword [esp + 0xc]
jmp 0x4c496c
mov ecx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x10]
not ecx
mov ebx, 0xff
cmp esi, 8
jb 0x4c494d
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x509bc0]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x509bc0]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x509bc0]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x509bc0]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x509bc0]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x509bc0]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x509bc0]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x509bc0]
dec edi
jne 0x4c48b0
pop edi
test esi, esi
je 0x4c4966
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x509bc0]
inc edx
dec esi
jne 0x4c4951
not ecx
pop esi
mov eax, ecx
pop ebx
ret 0xc