joyce8/EMBER2024-capa huggingface dataset:
Function at 0x487300
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x904
push ebx
mov ebx, ecx
call fcn.004800c0
mov dword [0x6e94c8], eax
mov eax, dword [ebx]
mov edx, dword [eax + 0x28]
mov ecx, ebx
call edx
test al, al
je 0x48732f
mov ecx, ebx
call fcn.004868c0
pop ebx
mov esp, ebp
pop ebp
ret
push esi
lea esi, [ebx + 0x40b]
push esi
call fcn.004521c0
add esp, 4
test al, al
je 0x487355
pop esi
mov dword [0x6ea840], 0x34
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x104]
push eax
mov ecx, ebx
call fcn.00482e60
mov ecx, 0x22
mov eax, esi
mov word [ebp - 0x904], cx
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x487373
push edi
lea edi, [ebp - 0x904]
sub eax, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x487384
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x904]
rep movsb byte es:[edi], byte [esi]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4873a1
mov dx, word [0x60df1c]
mov cl, byte [0x60df1e]
mov word [eax], dx
mov byte [eax + 2], cl
mov eax, 0x6e9fe0
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4873c3
lea edi, [ebp - 0x904]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4873d3
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.plug:lg:_tid_d_n
call fcn.005152d0
push 0x6e9498
lea edx, [ebp - 0x104]
push edx
lea eax, [ebp - 0x904]
push 4
push eax
call fcn.00451ad0
add esp, 0x18
pop edi
test eax, eax
jne 0x48743d
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x4c7
neg eax
sbb eax, eax
and eax, 0x19
mov dword [0x6ea840], eax
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, ebx
call fcn.0047fba0
test al, al
je 0x487457
mov ecx, dword [0x6e9498]
push ecx
call fcn.00459d50
add esp, 4
call fcn.004a4e40
test al, al
je 0x4874b1
call fcn.004a6b80
test al, al
je 0x487435
mov edx, dword [ebx]
mov eax, dword [edx + 0x20]
mov ecx, ebx
call eax
test al, al
je 0x4874b1
cmp word [0x6e9f28], 7
jne 0x487498
mov ecx, dword [0x6e949c]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x96
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [0x6e949c]
mov eax, dword [0x6e9498]
push edx
push eax
call fcn.004a5340
add esp, 8
test al, al
je 0x487435
push 0
push 0
push 0
push 0
push 0
push 0x4854a0
call sub.MFC42.dll_AfxBeginThread
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4874d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e1f51
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x930
mov eax, dword [str.Applications.exe]
mov edx, dword [0x60e044]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [0x60e040]
mov dword [ebp - 0x24], ecx
mov ecx, dword [0x60e04c]
mov dword [ebp - 0x28], eax
mov eax, dword [0x60e048]
mov dword [ebp - 0x20], edx
mov dl, byte [0x60e050]
mov dword [ebp - 0x18], ecx
mov ecx, edi
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x14], dl
xor ebx, ebx
call fcn.004887b0
push eax
lea eax, [ebp - 0x438]
push str.Choose___s_...
push eax
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0xc
mov byte [ebp - 0x338], bl
cmp byte [edi + 0xd10], bl
je 0x48756c
mov eax, dword [edi + 0xd18]
lea edx, [ebp - 0x338]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x487562
lea esi, [edi + 0x40b]
push esi
call fcn.004521c0
add esp, 4
test al, al
je 0x48759e
push 0
push 0x10
lea ecx, [ebp - 0x53c]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x4875ba
lea ebx, [ebp - 0x53c]
jmp 0x4875ba
cmp byte [esi], 0
mov ebx, esi
je 0x4875ba
lea edx, [ebp - 0x338]
mov eax, esi
sub edx, esi
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4875b0
mov edx, dword [0x717e18]
mov eax, dword [edx + 0xd0]
push eax
lea eax, [ebp - 0x28]
push eax
push 0x81004
lea ecx, [ebp - 0x338]
push ecx
push 0x60e028
push 1
lea ecx, [ebp - 0x234]
call fcn.00503640
lea eax, [ebp - 0x234]
lea edx, [ebp - 0x438]
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x1a4], edx
mov dword [ebp - 0x1a8], ebx
mov dword [ebp - 0x2c], edi
call fcn.004d1870
add esp, 4
lea ecx, [ebp - 0x234]
call fcn.00502610
lea ecx, [ebp - 0x234]
push ecx
mov esi, eax
call fcn.004d0e70
add esp, 4
cmp esi, 2
jne 0x48766c
lea ecx, [ebp - 0x178]
mov dword [ebp - 4], 1
call sub.MFC42.dll_CString::CString
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], 0xffffffff
call sub.MFC42.dll_CDialog::CDialog
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 0x234]
call fcn.00502b40
mov ecx, dword [eax]
lea edx, [ebp - 0x93c]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x487683
lea ecx, [ebp - 0x10]
call sub.MFC42.dll_CString::CString
push 1
lea eax, [ebp - 0x93c]
push eax
mov ecx, edi
call fcn.0048ad50
lea ecx, [ebp - 0x178]
mov dword [ebp - 4], 2
call sub.MFC42.dll_CString::CString
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], 0xffffffff
call sub.MFC42.dll_CDialog::CDialog
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, 1
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x487770
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push esi
call fcn.004574b0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellMUICache
push reloc.WS2_32.dll_accept
call esi
test eax, eax
je 0x4877b9
lea ecx, [ebp - 4]
push ecx
push 1
push 0
push str.SoftwareMicrosoftWindowsShellNoRoamMUICache
push reloc.WS2_32.dll_accept
call esi
test eax, eax
jne 0x48785c
mov ecx, dword [ebp - 4]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
xor esi, esi
push esi
push esi
push esi
push esi
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10c]
push eax
push esi
push ecx
mov dword [ebp - 8], 0x104
call edi
cmp eax, 0x103
je 0x48784c
inc esi
mov dword [ebp - 8], 0x104
test eax, eax
jne 0x48782b
mov al, byte [ebp - 0x10c]
cmp al, 0x40
je 0x48782b
cmp al, 0x5c
je 0x48782b
lea edx, [ebp - 0x10c]
push str.windows_
push edx
call fcn.0045b6b0
add esp, 8
test eax, eax
jne 0x48782b
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10c]
push eax
push ecx
call fcn.00487720
add esp, 8
mov ecx, dword [ebp - 4]
push 0
push 0
push 0
push 0
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10c]
push eax
push esi
push ecx
call edi
cmp eax, 0x103
jne 0x4877e6
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.004574b0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x487870
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
call fcn.004574b0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareGOG.com
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x487a05
mov eax, dword [ebp - 4]
push esi
xor esi, esi
push esi
push esi
push esi
push esi
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x114]
push edx
push esi
push eax
mov dword [ebp - 8], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
je 0x4879f5
push edi
mov edi, dword [sym.imp.msvcrt.dll_strncmp]
jmp 0x4878e0
inc esi
mov dword [ebp - 8], 0x104
test eax, eax
jne 0x4879cb
push 3
lea ecx, [ebp - 0x114]
push 0x60e0f4
push ecx
call edi
add esp, 0xc
test eax, eax
jne 0x4879cb
push 4
lea edx, [ebp - 0x111]
push str.PACK
push edx
call edi
add esp, 0xc
test eax, eax
je 0x4879cb
mov ecx, str.GOGDOSBOX
lea eax, [ebp - 0x114]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x487951
test dl, dl
je 0x48794d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x487951
add eax, 2
add ecx, 2
test dl, dl
jne 0x487931
xor eax, eax
jmp 0x487956
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4879cb
mov edx, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x114]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4879cb
mov edx, dword [ebp - 0xc]
mov byte [ebp - 0x218], al
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x218]
push ecx
push 0
push 0
push 0x60e0dc
push edx
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp byte [ebp - 0x218], 0
je 0x4879c1
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x218]
push eax
push ecx
call fcn.00487720
add esp, 8
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 4]
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x114]
push ecx
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
jne 0x4878e0
pop edi
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.004574b0
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x487a10
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x400]
sub esp, 0x400
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x487a24
push str.SteamApps
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea ecx, [ebp - 0x400]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x487a6f
lea edx, [ebp - 0x400]
push edx
call sym.GameRanger.exe_char____cdecl_new_string_char_const__
mov ecx, dword [ebp + 8]
mov dword [ebp + 0xc], eax
add esp, 4
lea eax, [ebp + 0xc]
push eax
call fcn.0044fa90
mov esp, ebp
pop ebp
ret
Function at 0x4883a0
Capabilities:
Delete registry key

Disassembly:
cmp byte [0x6e94b0], 0
jne 0x4883c4
push 0
push 0
push 0
push 0
push 0
push 0x4882a0
mov byte [0x6e94b0], 1
call sub.MFC42.dll_AfxBeginThread
call fcn.0048c020
call fcn.00483210
jmp fcn.00483290
Function at 0x48b7e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x878
cmp byte [0x6e9d78], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov dword [ebp - 4], esi
mov ecx, ebx
je 0x48b803
push 2
jmp 0x48b805
push 1
call sym.GameRanger.exe_public:_void___thiscall_CRecord::Write_ubyte_unsigned_char_
mov eax, dword [0x6e9e9c]
push eax
mov ecx, ebx
call fcn.0044b5e0
push 0x6e9d46
push 0x506c4e6d
call sym.GameRanger.exe_public:_static_void___cdecl_CPlugInBase::AddPropertyStr_int__char_const__
push 0x6e9d68
push 0x50617373
call sym.GameRanger.exe_public:_static_void___cdecl_CPlugInBase::AddPropertyStr_int__char_const__
add esp, 0x10
cmp byte [0x6e9d78], 0
je 0x48b853
push 0x6e9d90
push 0x476d4e6d
call sym.GameRanger.exe_public:_static_void___cdecl_CPlugInBase::AddPropertyStr_int__char_const__
add esp, 8
cmp dword [esi + 0xc8c], 0
je 0x48b870
mov ecx, dword [0x6e9ea4]
push ecx
push 0x54595045
call sym.GameRanger.exe_public:_static_void___cdecl_CPlugInBase::AddPropertyVal_int__int_
add esp, 8
mov ecx, esi
call fcn.0048a520
mov edx, dword [esi]
mov eax, dword [edx + 0x60]
push ebx
mov ecx, esi
call eax
mov ecx, esi
call fcn.004888b0
cmp al, 2
jb 0x48b8a9
lea ecx, [ebp - 0x878]
push ecx
call fcn.0045a330
add esp, 4
lea edx, [ebp - 0x878]
push edx
mov ecx, ebx
call sym.GameRanger.exe_public:_void___thiscall_CRecord::Write_long_string_char_const__
cmp byte [0x6e9d78], 0
je 0x48b8c3
movzx eax, word [0x6e9e90]
push eax
mov ecx, ebx
call sym.GameRanger.exe_public:_void___thiscall_CRecord::Write_uword_unsigned_short_int_
jmp 0x48b8e0
movzx ecx, word [0x6e9d66]
push ecx
mov ecx, ebx
call sym.GameRanger.exe_public:_void___thiscall_CRecord::Write_uword_unsigned_short_int_
mov edx, dword [0x6e9d7c]
push edx
mov ecx, ebx
call fcn.0044b5e0
push 0x60
push 0x6ea7e0
mov ecx, ebx
call sym.GameRanger.exe_public:_void___thiscall_CRecord::Write_data_void_const___unsigned_int_
mov ecx, ebx
call fcn.0044bfd0
mov ecx, ebx
mov esi, eax
call fcn.0044bfe0
mov edi, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc58]
push ecx
call dword [sym.imp.WS2_32.dll_htonl]
lea edx, [ebp - 0x78]
push edx
mov dword [ebp + 8], eax
call fcn.005d5f30
push edi
lea eax, [ebp - 0x78]
push esi
push eax
call fcn.005d5cb0
push 4
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 0x78]
push edx
call fcn.005d5cb0
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x18]
push ecx
call fcn.005d5dd0
add esp, 0x24
xor ecx, ecx
test edi, edi
je 0x48b976
lea esp, [esp]
mov eax, 0xcccccccd
mul ecx
shr edx, 4
lea edx, [edx + edx*4]
add edx, edx
add edx, edx
mov eax, ecx
sub eax, edx
mov dl, byte [ebp + eax - 0x18]
xor dl, byte [esi]
inc esi
xor dl, cl
mov byte [esi - 1], dl
inc ecx
cmp ecx, edi
jb 0x48b950
push 0x14
lea eax, [ebp - 0x18]
push eax
mov ecx, ebx
call sym.GameRanger.exe_public:_void___thiscall_CRecord::Write_data_void_const___unsigned_int_
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x48f860
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e2364
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, ecx
push eax
mov dword [ebp - 0x10], esi
call fcn.004d5290
lea ecx, [esi + 0xa4]
mov dword [ebp - 4], 0
call fcn.0044e570
push 5
lea ecx, [esi + 0xc4]
mov dword [esi], vtable.CTimezoneListView.3.0
mov dword [esi + 0x40], vtable.CTimezoneListView.2.0
mov dword [esi + 0x90], vtable.CTimezoneListView.1.0
mov dword [esi + 0xa4], vtable.CTimezoneListView.0
call fcn.0048f310
mov ecx, 0x10
mov word [esi + 0x44], cx
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 2
call fcn.00445b30
push 0x82
push 0x46
push str.City
lea edx, [ebp - 0x2c]
push edx
lea ecx, [esi + 0x40]
call fcn.00445b50
lea eax, [ebp - 0x2c]
push eax
lea ecx, [esi + 0x40]
call fcn.004d4990
push 0
push 0x50
push str.Country
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [esi + 0x40]
call fcn.00445b50
lea edx, [ebp - 0x2c]
push edx
lea ecx, [esi + 0x40]
call fcn.004d4990
mov ecx, dword [ebp - 0xc]
pop edi
mov byte [esi + 0x68], 0
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x496a80
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.004968b0
mov edx, dword [ebp + 8]
lea ecx, [ebp - 4]
push ecx
push edx
push eax
call fcn.004968d0
add esp, 0xc
test eax, eax
jne 0x496ac2
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push ecx
push 3
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret

Function at 0x496b40
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00496a20

Function at 0x496bb0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00496ad0

Function at 0x496bd0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [0x6f1aa9]
push esi
mov esi, dword [ebp + 8]
dec eax
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendA]
cmp eax, 4
ja case.default.0x496beb
jmp dword [eax*4 + 0x496c60]
push 0
push 5
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x496c0f
push str.My_Games
push esi
call edi
test eax, eax
jne case.default.0x496beb
pop edi
xor al, al
pop esi
pop ebp
ret
push 0
push 5
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
jne case.default.0x496beb
pop edi
xor al, al
pop esi
pop ebp
ret
push 0
push 0x1a
jmp 0x496c19
push 0
push 0x1c
jmp 0x496c19
mov eax, dword [0x6f1ab0]
add eax, 6
mov edx, esi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x496c44
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
mov eax, dword [ebp + 0xc]
push eax
push esi
call edi
pop edi
pop esi
pop ebp
ret
Function at 0x496c80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e26f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor esi, esi
push 0x5f6670
push eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], esi
call dword [sym.imp.msvcrt.dll_fopen]
mov edi, eax
add esp, 8
mov dword [ebp - 0x24], edi
cmp edi, esi
jne 0x496cd9
push 0x637c4c
lea ecx, [ebp - 0x18]
push ecx
mov dword [ebp - 0x18], 0xff67697f
call sub.msvcrt.dll__CxxThrowException
push 2
push esi
mov esi, dword [sym.imp.msvcrt.dll_fseek]
push edi
call esi
push edi
call dword [sym.imp.msvcrt.dll_ftell]
mov ebx, dword [ebp + 0x10]
push 0
push 0
push edi
mov dword [ebx], eax
call esi
mov eax, dword [ebx]
add esp, 0x1c
cmp eax, 2
jbe 0x496da9
cmp eax, 0x100000
jae 0x496da9
add eax, 2
push eax
call fcn.00401148
mov esi, eax
add esp, 4
mov dword [ebp - 0x14], eax
test esi, esi
jne 0x496d3b
push 0x637c4c
lea edx, [ebp - 0x1c]
push edx
mov dword [ebp - 0x1c], 0xff67697f
call sub.msvcrt.dll__CxxThrowException
mov eax, dword [ebx]
push edi
push 1
push eax
push esi
call dword [sym.imp.msvcrt.dll_fread]
mov ecx, dword [ebx]
mov byte [esi + ecx], 0
mov edx, dword [ebx]
push edi
mov byte [edx + esi + 1], 0
call dword [sym.imp.msvcrt.dll_fclose]
mov al, byte [esi]
add esp, 0x14
cmp al, 0xff
jne 0x496d6b
cmp byte [esi + 1], 0xfe
je 0x496d8e
test al, al
je 0x496d8e
cmp byte [esi + 1], 0
je 0x496d8e
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 1
shr dword [ebx], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x637c4c
lea edx, [ebp - 0x20]
push edx
mov dword [ebp - 0x20], 0xff67697f
call sub.msvcrt.dll__CxxThrowException
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x496dcf
push eax
call dword [sym.imp.msvcrt.dll_fclose]
add esp, 4
mov eax, 0x496dd5
ret
Function at 0x496df0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e2700
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x208
push ebx
mov eax, 0x3c
push esi
mov word [ebp - 0x214], ax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x496e30
lea edi, [ebp - 0x214]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x496e42
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x214]
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x496e60
mov cx, word [0x610330]
lea eax, [ebp - 0x214]
mov word [edi], cx
lea edx, [eax + 1]
jmp 0x496e80
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x496e80
sub eax, edx
mov edx, dword [ebp + 8]
push 0x5f6698
push edx
mov ebx, eax
call dword [sym.imp.msvcrt.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
jne 0x496ecf
push 0x637c4c
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], 0xff67697f
call sub.msvcrt.dll__CxxThrowException
mov eax, 0x496ebe
ret
mov esi, dword [ebp + 0x14]
cmp byte [esi], 0
je 0x496f25
push ebx
lea ecx, [ebp - 0x214]
push ecx
push esi
call dword [sym.imp.msvcrt.dll__strnicmp]
add esp, 0xc
push edi
test eax, eax
jne 0x496f15
push 1
push ebx
push esi
call dword [sym.imp.msvcrt.dll_fwrite]
mov edx, dword [ebp + 0x10]
push edi
push edx
add esi, ebx
call dword [sym.imp.msvcrt.dll_fputs]
add esp, 0x18
mov al, byte [esi]
test al, al
je 0x496ed2
cmp al, 0x3c
je 0x496ed2
inc esi
jmp 0x496f08
movsx eax, byte [esi]
push eax
inc esi
call dword [sym.imp.msvcrt.dll_fputc]
add esp, 8
jmp 0x496ed2
push edi
call dword [sym.imp.msvcrt.dll_fclose]
mov ecx, dword [ebp - 0xc]
add esp, 4
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x496f50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e2710
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc08
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
mov ecx, 0x610338
lea edx, [ebp - 0x414]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x496f86
mov ecx, dword [ebp + 0xc]
push 0x200
lea eax, [ebp - 0xc14]
push eax
push 0xffffffffffffffff
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0xc14]
mov edx, eax
jmp 0x496fc0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x496fc0
lea edi, [ebp - 0x414]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x496fd6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x414]
add edi, 0xfffffffe
jmp 0x497000
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x497000
mov edx, dword [0x610334]
lea eax, [ebp - 0x414]
mov dword [edi], edx
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x497020
sub eax, edx
sar eax, 1
mov ebx, eax
mov eax, dword [ebp + 8]
push 0x5f6698
push eax
call dword [sym.imp.msvcrt.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
jne 0x497075
push 0x637c4c
lea ecx, [ebp - 0x14]
push ecx
mov dword [ebp - 0x14], 0xff67697f
call sub.msvcrt.dll__CxxThrowException
mov eax, 0x497064
ret
mov eax, dword [ebp + 0x10]
push 0x400
lea edx, [ebp - 0xc14]
push edx
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, dword [ebp + 0x14]
cmp word [esi], 0
je 0x4970f4
push ebx
lea ecx, [ebp - 0x414]
push ecx
push esi
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
push edi
test eax, eax
jne 0x4970e2
push 2
push ebx
push esi
call dword [sym.imp.msvcrt.dll_fwrite]
lea edx, [ebp - 0xc14]
push edi
push edx
lea esi, [esi + ebx*2]
call dword [sym.imp.msvcrt.dll_fputws]
add esp, 0x18
nop
movzx eax, word [esi]
test ax, ax
je 0x497094
cmp eax, 0x3c
je 0x497094
add esi, 2
jmp 0x4970d0
movzx eax, word [esi]
push eax
add esi, 2
call dword [sym.imp.msvcrt.dll_fputwc]
add esp, 8
jmp 0x497094
push edi
call dword [sym.imp.msvcrt.dll_fclose]
mov ecx, dword [ebp - 0xc]
add esp, 4
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret