joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49aaa0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x28
push ebx
push ebp
mov ebx, ecx
push esi
lea esi, [ebx + 0xe4]
push edi
mov ecx, esi
xor edi, edi
call fcn.0049c670
test eax, eax
mov ebp, dword [esp + 0x40]
jle 0x49aafa
push edi
mov ecx, esi
mov dword [esp + 0x44], 0
call fcn.00497a10
mov edx, dword [eax]
lea ecx, [esp + 0x40]
push ecx
mov ecx, dword [esp + 0x48]
push ecx
mov ecx, dword [esp + 0x44]
push ebp
push ecx
mov ecx, eax
call dword [edx]
mov eax, dword [esp + 0x40]
test eax, eax
jne 0x49ab67
mov ecx, esi
inc edi
call fcn.0049c670
cmp edi, eax
jl 0x49aac0
mov eax, dword [esp + 0x3c]
sub eax, 0x100
je 0x49abe6
sub eax, 4
je 0x49ab76
sub eax, 2
jne 0x49abda
xor edi, edi
push ebp
mov word [esp + 0x14], di
mov dword [esp + 0x18], edi
call fcn.00492416
mov ebx, dword [ebx + 0x50]
add esp, 4
mov word [esp + 0x10], ax
mov edx, dword [ebx]
push reloc.WSOCK32.dll_inet_addr
lea eax, [esp + 0x14]
push eax
push 0x4993a0
mov ecx, ebx
call dword [edx + 0xec]
mov esi, eax
cmp esi, edi
je 0x49abda
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xe0]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x18]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x28
ret 0x10
mov eax, dword [ebx + 0x54]
test eax, eax
je 0x49abda
mov edx, dword [ebx + 0x64]
mov eax, dword [ebx + 0x68]
xor ecx, ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x18], 6
mov word [esp + 0x2c], bp
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], eax
call fcn.00498700
mov word [esp + 0x2e], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x54]
mov dword [esp + 0x20], eax
mov edx, dword [ecx]
lea eax, [esp + 0x18]
push eax
call dword [edx + 0xf8]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x28
ret 0x10
cmp ebp, 9
jne 0x49abda
mov eax, dword [ebx + 0x54]
test eax, eax
je 0x49ac35
mov ecx, eax
mov edx, dword [ecx]
call dword [edx + 0xc0]
test eax, eax
je 0x49ac35
mov ecx, dword [ebx + 0x54]
mov eax, dword [ecx]
call dword [eax + 0xcc]
test eax, eax
je 0x49ac35
mov ecx, dword [ebx + 0x54]
mov edx, dword [ecx]
push 0x4f9410
call dword [edx + 0xc]
push eax
call fcn.0048273c
add esp, 8
test eax, eax
je 0x49ac35
mov ecx, dword [ebx + 0x54]
call fcn.004bb010
test eax, eax
jne 0x49abda
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
xor ecx, ecx
test ax, ax
setge cl
push ecx
mov ecx, ebx
call fcn.0049a960
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x28
ret 0x10
Function at 0x4a1b4a
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x98
push esi
mov esi, ecx
push edi
lea ecx, [esp + 8]
push ecx
mov ecx, esi
mov dword [esi + 0x10], eax
call fcn.0049faa0
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx + 0x3dc]
test edx, edx
mov eax, 0x40000080
je 0x4a1b74
mov eax, 0x400000a0
mov edx, dword [ecx + 0x610]
test edx, edx
je 0x4a1b83
or eax, 0x2000
mov edi, dword [esp + 8]
push 0
sub esp, 0x10
mov edx, esp
mov dword [edx], edi
mov edi, dword [esp + 0x20]
mov dword [edx + 4], edi
mov edi, dword [esp + 0x24]
push 0
mov dword [edx + 8], edi
mov edi, dword [esp + 0x2c]
push eax
mov eax, dword [ecx]
push 0
mov dword [edx + 0xc], edi
call dword [eax + 0x1c]
mov ecx, eax
call fcn.00498800
push eax
mov ecx, esi
call fcn.004986c0
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx + 0x3b4]
mov edx, dword [ecx]
push 1
push eax
call dword [edx + 0x1c]
mov ecx, eax
call fcn.00499170
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
mov eax, dword [esi + 4]
push 0x30
push eax
call edi
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx + 0x3d4]
mov eax, dword [esi + 4]
push 0
push edx
push 0xc5
push eax
call edi
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + 0x3dc]
test ecx, ecx
je 0x4a1c1e
movzx ecx, word [eax + 0x3e0]
mov edx, dword [esi + 4]
push 0
push ecx
push 0xcc
push edx
call edi
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
lea edx, [esp + 0x18]
push edx
call dword [eax + 0x28]
mov eax, dword [eax]
mov ecx, dword [esi + 4]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1c]
cmp eax, edx
je 0x4a1c4d
push eax
call fcn.00482838
add esp, 4
mov eax, dword [esi + 4]
push 0
push 0
push 0xb9
push eax
call edi
push 0
push 3
push 0xd3
mov ecx, esi
call fcn.00498080
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx]
call dword [edx + 0xcc]
dec eax
neg eax
sbb eax, eax
inc eax
push eax
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx + 0x3d8]
xor edx, edx
cmp eax, 1
mov eax, dword [esi + 4]
sete dl
push 0
push edx
push 0xcf
push eax
call edi
mov ecx, dword [esi + 4]
push 4
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
push 0
push 0
push 0
push 0x4dc4b8
push ecx
call dword [eax + 0x1c]
mov ecx, eax
call fcn.0049a4b0
pop edi
pop esi
add esp, 0x98
ret 4
Function at 0x4a3200
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
test eax, eax
push edi
je 0x4a3268
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
inc edi
lea eax, [edi + edi]
add eax, 3
and eax, 0xfffffffc
call fcn.00483900
mov ebx, esp
test ebx, ebx
je 0x4a3268
mov ecx, dword [esi + 4]
push edi
push ebx
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push 0xffffffffffffffff
push ebx
add ecx, 0x150
call fcn.00401550
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx]
push 0
push 0
push 0
push 0x4de5f0
push ecx
call dword [edx + 0x1c]
mov ecx, eax
call fcn.0049a4b0
xor eax, eax
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x4aa870
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d96b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.004a87a0
mov eax, dword [esp + 0x28]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0
mov dword [esi], 0x4fb4d8
mov dword [esi + 0x3ac], 0x4dc048
mov dword [esi + 0x410], eax
call fcn.004976e0
mov edx, dword [eax]
sub esp, 0x10
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
mov ecx, esi
call fcn.004a4ca0
mov ecx, dword [esp + 0x18]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x20
ret 4
Function at 0x4bd960
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x4bd96b
xor eax, eax
ret
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x18]
cmp edi, 8
not esi
jb 0x4bda63
mov ebp, edi
shr ebp, 3
xor edx, edx
mov dl, byte [ecx]
mov eax, esi
shr eax, 8
sub edi, 8
xor edx, esi
and edx, 0xff
mov esi, dword [edx*4 + 0x4fe590]
xor edx, edx
mov dl, byte [ecx + 1]
xor eax, esi
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x4fe590]
xor edx, edx
mov dl, byte [ecx + 1]
shr eax, 8
xor eax, esi
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x4fe590]
xor edx, edx
mov dl, byte [ecx + 1]
shr eax, 8
xor eax, esi
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x4fe590]
xor edx, edx
mov dl, byte [ecx + 1]
shr eax, 8
xor eax, esi
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x4fe590]
shr eax, 8
xor eax, esi
xor edx, edx
mov dl, byte [ecx + 1]
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x4fe590]
shr eax, 8
xor eax, esi
xor edx, edx
mov dl, byte [ecx + 1]
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x4fe590]
shr eax, 8
xor eax, esi
xor edx, edx
mov dl, byte [ecx + 1]
inc ecx
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0x4fe590]
shr eax, 8
xor eax, esi
inc ecx
dec ebp
mov esi, eax
jne 0x4bd986
test edi, edi
je 0x4bda82
xor eax, eax
mov al, byte [ecx]
xor eax, esi
and eax, 0xff
mov ebp, dword [eax*4 + 0x4fe590]
shr esi, 8
xor esi, ebp
inc ecx
dec edi
jne 0x4bda67
pop edi
mov eax, esi
pop esi
not eax
pop ebp
ret

Function at 0x4bdeb0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
mov ecx, dword [ebx]
push ebp
mov ebp, dword [esp + 0x10]
mov eax, ebp
imul eax, dword [esp + 0x14]
test ecx, ecx
je 0x4bdef4
mov edx, dword [esp + 0xc]
push 0
lea ecx, [esp + 0x14]
push ecx
push eax
mov eax, dword [ebx + 8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4bdee9
mov dword [ebx + 0xc], 1
mov eax, dword [esp + 0x10]
xor edx, edx
div ebp
pop ebp
pop ebx
ret
mov edx, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x18]
push esi
lea esi, [edx + eax]
cmp esi, ecx
push edi
jbe 0x4bdf07
sub ecx, edx
mov eax, ecx
mov esi, dword [ebx + 0x14]
mov edi, dword [esp + 0x14]
add esi, edx
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x1c]
pop edi
add ecx, eax
pop esi
xor edx, edx
div ebp
pop ebp
mov dword [ebx + 0x1c], ecx
pop ebx
ret
Function at 0x4bf0d0
Capabilities:
Create directory

Disassembly:
sub esp, 0x414
mov eax, dword [0x50ba00]
push edi
mov edi, dword [esp + 0x420]
test edi, edi
mov dword [esp + 0x414], eax
je 0x4bf181
xor eax, eax
mov ax, word [edi]
test ax, ax
je 0x4bf181
push ebx
push esi
mov esi, edi
mov ecx, edi
cmp ax, 0x2f
je 0x4bf112
cmp ax, 0x5c
jne 0x4bf114
mov esi, ecx
mov ax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x4bf106
cmp esi, edi
mov ebx, dword [esp + 0x424]
je 0x4bf150
sub esi, edi
sar esi, 1
push esi
lea eax, [esp + 0x10]
push edi
push eax
call fcn.004850c9
lea ecx, [esp + 0x18]
push ecx
push ebx
mov word [esp + esi*2 + 0x20], 0
call fcn.004bf0d0
add esp, 0x14
lea edx, [esp + 0x214]
push ebx
push edx
call fcn.0048266b
lea eax, [esp + 0x21c]
push edi
push eax
call fcn.00482641
add esp, 0x10
push 0
lea ecx, [esp + 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop esi
pop ebx
mov ecx, dword [esp + 0x414]
pop edi
call fcn.00482423
add esp, 0x414
ret

Function at 0x4c0dd0
Capabilities:
Get common file path

Disassembly:
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x4c0e60
cmp dword [edi + 4], 0xffffffff
jne 0x4c0e60
push ebx
push esi
lea esi, [edi + 0x138]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x4e8294
push esi
call fcn.00482641
mov esi, dword [esp + 0x20]
mov ebx, dword [esp + 0x18]
add esp, 8
cmp esi, 1
jne 0x4c0e28
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x4c0e28
pop esi
pop ebx
mov eax, 0x2000000
pop edi
ret 0xc
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push esi
push ecx
push ebx
call fcn.004bdd50
add esp, 0x10
test eax, eax
jne 0x4c0e4a
mov eax, dword [esp + 0x18]
pop esi
pop ebx
pop edi
ret 0xc
push eax
call fcn.004c0890
add esp, 4
pop esi
mov dword [edi], eax
mov eax, dword [0x51bfd8]
pop ebx
pop edi
ret 0xc
mov eax, 0x1000000
pop edi
ret 0xc
Function at 0x4c43e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov eax, dword [ebx + 8]
push ebp
push esi
mov esi, eax
and esi, 7
je 0x4c440a
cmp eax, esi
jge 0x4c43f8
mov eax, ebx
call fcn.004c3c10
mov edx, dword [ebx + 0xc]
mov eax, dword [ebx + 8]
mov ecx, esi
shr edx, cl
sub eax, esi
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], edx
mov ecx, dword [ebx + 8]
xor eax, eax
test ecx, ecx
jle 0x4c443f
mov esi, 0xfffffff8
mov edx, ecx
lea ebx, [ebx]
mov cl, byte [ebx + 0xc]
mov ebp, dword [ebx + 0xc]
mov byte [esp + eax + 8], cl
shr ebp, 8
add edx, esi
inc eax
test edx, edx
mov dword [ebx + 0xc], ebp
jg 0x4c4420
cmp eax, 4
mov dword [ebx + 8], edx
jge 0x4c445e
mov edx, dword [ebx + 4]
mov esi, dword [ebx]
cmp esi, edx
jb 0x4c444c
xor ecx, ecx
jmp 0x4c4454
mov cl, byte [esi]
inc esi
mov dword [ebx], esi
movzx ecx, cl
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 4
jl 0x4c4442
mov eax, dword [esp + 8]
movzx ecx, byte [esp + 0xa]
movzx ebp, ah
movzx edx, al
movzx eax, byte [esp + 0xb]
shl ebp, 8
add ebp, edx
shl eax, 8
mov edx, ebp
add eax, ecx
xor edx, 0xffff
cmp eax, edx
je 0x4c4498
pop esi
mov dword [0x51bfe0], 0x4feddc
xor eax, eax
pop ebp
pop ecx
ret
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
add eax, ebp
cmp eax, ecx
jbe 0x4c44b3
pop esi
mov dword [0x51bfe0], 0x4fedc8
xor eax, eax
pop ebp
pop ecx
ret
mov ecx, dword [ebx + 0x10]
mov eax, dword [ebx + 0x18]
add ecx, ebp
cmp ecx, eax
push edi
jbe 0x4c44d2
mov ecx, ebp
mov edi, ebx
call fcn.004c3c50
test eax, eax
jne 0x4c44d2
pop edi
pop esi
pop ebp
pop ecx
ret
mov esi, dword [ebx]
mov edi, dword [ebx + 0x10]
mov ecx, ebp
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx]
mov eax, dword [ebx + 0x10]
add ecx, ebp
add eax, ebp
pop edi
pop esi
mov dword [ebx + 0x10], eax
mov dword [ebx], ecx
mov eax, 1
pop ebp
pop ecx
ret
Function at 0x4c9410
Capabilities:
Encode data using base64

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
jne 0x4c941f
xor eax, eax
pop ebx
pop ecx
ret
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x4c942d
cmp byte [esi], 0x30
jne 0x4c9432
mov esi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
push ebp
push edi
mov edi, dword [esp + 0x1c]
lea ecx, [edi*4]
mov eax, 0xaaaaaaab
mul ecx
mov ebp, dword [esp + 0x20]
mov ecx, edx
shr ecx, 1
add ecx, 4
mov eax, 0x38e38e39
mul ecx
shr edx, 4
lea edx, [edx + ecx + 1]
push edx
mov ecx, ebp
call fcn.004c9350
test eax, eax
jne 0x4c9471
pop edi
pop ebp
pop esi
pop ebx
pop ecx
ret
mov eax, dword [ebp]
lea ebp, [ebx + edi]
mov edx, ebp
sub edx, ebx
xor edi, edi
cmp edx, 3
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], ebp
mov ecx, ebx
jl 0x4c94f9
mov ebp, edx
mov edi, edi
movzx edx, byte [ecx]
shr edx, 2
mov dl, byte [edx + esi]
mov byte [eax], dl
movzx ebx, byte [ecx + 1]
xor edx, edx
mov dl, byte [ecx]
shr ebx, 4
inc eax
add edi, 4
add ecx, 3
sub ebp, 3
and edx, 3
shl edx, 4
or edx, ebx
mov dl, byte [edx + esi]
mov byte [eax], dl
movzx ebx, byte [ecx - 1]
xor edx, edx
mov dl, byte [ecx - 2]
shr ebx, 6
inc eax
and edx, 0xf
shl edx, 2
or edx, ebx
mov dl, byte [edx + esi]
mov byte [eax], dl
xor edx, edx
mov dl, byte [ecx - 1]
inc eax
and edx, 0x3f
mov dl, byte [edx + esi]
mov byte [eax], dl
inc eax
cmp edi, 0x48
jb 0x4c94f0
add byte [eax], 0xa
xor edi, edi
cmp ebp, 3
jge 0x4c9490
mov ebp, dword [esp + 0x18]
sub ebp, ecx
je 0x4c954f
movzx edx, byte [ecx]
shr edx, 2
mov dl, byte [edx + esi]
mov byte [eax], dl
inc eax
cmp ebp, 1
jne 0x4c9522
movzx ecx, byte [ecx]
and ecx, 3
shl ecx, 4
mov dl, byte [ecx + esi]
mov byte [eax], dl
inc eax
mov byte [eax], 0x3d
jmp 0x4c9547
movzx ebx, byte [ecx + 1]
xor edx, edx
mov dl, byte [ecx]
shr ebx, 4
and edx, 3
shl edx, 4
or edx, ebx
mov dl, byte [edx + esi]
mov byte [eax], dl
movzx ecx, byte [ecx + 1]
inc eax
and ecx, 0xf
mov dl, byte [esi + ecx*4]
mov byte [eax], dl
inc eax
mov byte [eax], 0x3d
inc eax
add edi, 4
test edi, edi
je 0x4c9557
mov byte [eax], 0xa
inc eax
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov byte [eax], 0
sub eax, edx
push eax
call fcn.004c93c0
pop edi
pop ebp
pop esi
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x4c9910
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x84
mov eax, dword [0x50ba00]
mov edx, dword [esp + 0x88]
xor eax, esp
push ebx
push ebp
mov ebp, dword [esp + 0x98]
mov dword [esp + 0x88], eax
xor ebx, ebx
xor eax, eax
cmp ebp, ebx
je 0x4c9a65
push esi
mov esi, dword [esp + 0xa0]
cmp esi, ebx
je 0x4c9a64
mov dword [esp + 0x69], eax
mov dword [esp + 0x6d], eax
xor ecx, ecx
mov dword [esp + 0x71], eax
mov dword [esp + 0x14], ecx
mov word [esp + 0x75], ax
mov dword [esp + 0x18], ecx
push edi
mov dword [esp + 0x20], ecx
mov ecx, 0x12
lea edi, [esp + 0x24]
mov byte [esp + 0x7b], al
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x9c]
push eax
push edx
lea ecx, [esp + 0x1c]
push ecx
mov byte [esp + 0x78], bl
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x20], 0x67452301
mov dword [esp + 0x24], 0xefcdab89
mov dword [esp + 0x28], 0x98badcfe
mov dword [esp + 0x2c], 0x10325476
call fcn.004c9750
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x7c]
push eax
call fcn.004c9810
add esp, 0x14
mov word [ebp], bx
xor edi, edi
jmp 0x4c99e0
movzx edx, byte [esp + edi + 0x6c]
xor ecx, ecx
mov dword [esp + 0x7e], ecx
push edx
mov dword [esp + 0x86], ecx
push str._02X
mov dword [esp + 0x8e], ecx
lea eax, [esp + 0x84]
mov dword [esp + 0x92], ecx
push 0xa
push eax
mov word [esp + 0x8c], bx
mov word [esp + 0x9e], cx
call fcn.004529a0
add esp, 0x10
cmp esi, 0x7fffffff
ja 0x4c9a58
lea ecx, [esp + 0x10]
push ecx
push esi
push ebp
call fcn.00405fd0
test eax, eax
jl 0x4c9a58
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x7c]
push edx
mov ecx, esi
sub ecx, eax
push ecx
lea edx, [ebp + eax*2]
push edx
call fcn.00402910
inc edi
cmp edi, 0x10
jl 0x4c99e0
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x88]
pop ebp
pop ebx
xor ecx, esp
call fcn.00482423
add esp, 0x84
ret
Function at 0x4c9a80
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x14
push ebp
xor ebp, ebp
cmp eax, ebp
jne 0x4c9a95
xor eax, eax
pop ebp
add esp, 0x14
ret
push esi
push ebp
push 0x80
push 3
push ebp
push 1
push Ordinal_2
push eax
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x24], ebp
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4c9ac4
pop esi
xor eax, eax
pop ebp
add esp, 0x14
ret
push edi
lea eax, [esp + 0x24]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, ebp
jne 0x4c9af9
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push ecx
push edx
push ebp
push ebp
call fcn.004c9910
add esp, 0x10
pop edi
pop esi
pop ebp
add esp, 0x14
ret
push ebx
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], 0x20
call fcn.004c9350
test eax, eax
mov ebx, dword [esp + 0x14]
je 0x4c9b47
push ebp
lea eax, [esp + 0x2c]
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push ecx
push edx
push edi
push ebx
call fcn.004c9910
add esp, 0x10
mov edi, eax
jmp 0x4c9b4b
mov edi, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, ebp
je 0x4c9b5f
push ebx
call fcn.00482838
add esp, 4
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x14
ret

Function at 0x4c9b70
Capabilities:
Get file size
Write file on windows

Disassembly:
push ecx
mov eax, dword [esp + 8]
test eax, eax
jne 0x4c9b7b
pop ecx
ret
push ebx
mov ebx, dword [esp + 0x10]
test ebx, ebx
jne 0x4c9b89
xor eax, eax
pop ebx
pop ecx
ret
push esi
push edi
mov edi, dword [esp + 0x1c]
test edi, edi
push 0
push 0x80
je 0x4c9b9e
push 4
jmp 0x4c9ba0
push 2
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4c9bbe
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
test edi, edi
je 0x4c9bcf
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esp + 0xc]
push eax
push esi
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
jne 0x4c9c08
push 0
lea ecx, [esp + 0x10]
push ecx
push 2
lea edx, [esp + 0x20]
push edx
push esi
mov byte [esp + 0x28], 0xff
mov byte [esp + 0x29], 0xfe
call edi
push 0
lea eax, [esp + 0x10]
push eax
push ebx
call fcn.00482726
add esp, 4
shl eax, 1
push eax
push ebx
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x4c9c30
Capabilities:
Check if file exists
Get file version info

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x42c
mov eax, dword [0x50ba00]
push ebx
push esi
mov dword [esp + 0x430], eax
mov eax, dword [ebp + 0xc]
xor esi, esi
cmp eax, esi
push edi
je 0x4c9d9d
cmp dword [ebp + 0x10], esi
je 0x4c9d9d
xor eax, eax
mov word [esp + 0x20], si
mov ecx, 0x81
lea edi, [esp + 0x22]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [ebp + 8]
cmp edi, esi
jne 0x4c9c98
lea edi, [esp + 0x20]
push 0x104
mov eax, edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x4c9ca7
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4c9d9d
lea ecx, [esp + 0x1c]
push ecx
push edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
cmp ebx, esi
je 0x4c9d9d
mov edx, ebx
shr edx, 5
inc edx
shl edx, 5
push edx
call fcn.00483778
mov esi, eax
add esp, 4
test esi, esi
je 0x4c9d9d
push esi
push ebx
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoW
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
push str.VarFileInfoTranslation
xor ebx, ebx
push esi
mov dword [esp + 0x24], ebx
call sub.VERSION.dll_VerQueryValueW
mov edx, dword [esp + 0x18]
xor eax, eax
cmp edx, ebx
je 0x4c9d9f
mov word [esp + 0x228], bx
mov ecx, 0x81
lea edi, [esp + 0x22a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [esp + 0x10], ebx
movzx eax, word [edx + 2]
movzx ecx, word [edx]
push eax
push ecx
push str.StringFileInfo_04x_04xFileVersion
lea edx, [esp + 0x234]
push 0x104
push edx
call fcn.004529a0
add esp, 0x14
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x230]
push edx
push esi
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push eax
push ecx
push edx
call fcn.00402e00
push esi
call fcn.00482838
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x434]
call fcn.00482423
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [esp + 0x434]
call fcn.00482423
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret