joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1090e820
Capabilities:
Check if file exists
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1092b1d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
mov esi, dword [ebp + 8]
cmp dword [ebp + 0x10], 0
je 0x1090e867
mov eax, dword [sym.imp.Core.dll_int_GUnicodeOS]
cmp dword [eax], 0
je 0x1090e883
push 0x80
push esi
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov edi, dword [sym.imp.Core.dll_int___cdecl_winGetSizeANSI_wchar_t_const__]
mov eax, dword [sym.imp.Core.dll_int_GUnicodeOS]
push esi
cmp dword [eax], 0
je 0x1090e8ca
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1090e903
push esi
mov edi, dword [sym.imp.Core.dll_int___cdecl_winGetSizeANSI_wchar_t_const__]
call edi
add esp, 4
test eax, eax
jne 0x1090e897
xor ebx, ebx
jmp 0x1090e8ad
push esi
call edi
add esp, 4
add eax, 7
and eax, 0xfffffff8
call fcn.10924d50
mov dword [ebp - 0x10], esp
mov ebx, esp
push 0x80
push esi
call edi
push eax
push esi
push ebx
call dword [sym.imp.Core.dll_char____cdecl_winToANSI_char___wchar_t_const___int_]
add esp, 0x10
push eax
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
jmp 0x1090e86d
call edi
add esp, 4
test eax, eax
jne 0x1090e8d7
xor ebx, ebx
jmp 0x1090e8ed
push esi
call edi
add esp, 4
add eax, 7
and eax, 0xfffffff8
call fcn.10924d50
mov dword [ebp - 0x10], esp
mov ebx, esp
push esi
call edi
push eax
push esi
push ebx
call dword [sym.imp.Core.dll_char____cdecl_winToANSI_char___wchar_t_const___int_]
add esp, 0x10
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
test eax, eax
jne 0x1090e934
mov edi, dword [sym.imp.kernel32.dll_GetLastError]
cmp dword [ebp + 0xc], eax
jne 0x1090e919
call edi
cmp eax, 2
je 0x1090e934
xor ebx, ebx
call edi
push eax
push esi
push 0x1093612c
push 0x2ff
call dword [sym.imp.Core.dll_void___cdecl_debugf_enum_EName__wchar_t_const__]
add esp, 0x10
jmp 0x1090e939
mov ebx, 1
xor eax, eax
test ebx, ebx
setne al
lea esp, [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1090ec30
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1092b1f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1090ec7e
push eax
push dword [ebp + 8]
call fcn.1090b430
lea esp, [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [sym.imp.Core.dll_int_GUnicodeOS]
cmp dword [eax], 0
je 0x1090ec95
push 0
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
jmp 0x1090ecda
mov esi, dword [ebp + 8]
push esi
mov edi, dword [sym.imp.Core.dll_int___cdecl_winGetSizeANSI_wchar_t_const__]
call edi
add esp, 4
test eax, eax
jne 0x1090ecac
xor ebx, ebx
jmp 0x1090ecc2
push esi
call edi
add esp, 4
add eax, 7
and eax, 0xfffffff8
call fcn.10924d50
mov dword [ebp - 0x10], esp
mov ebx, esp
push 0
push esi
call edi
push eax
push esi
push ebx
call dword [sym.imp.Core.dll_char____cdecl_winToANSI_char___wchar_t_const___int_]
add esp, 0x10
push eax
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x1090ecf2
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
je 0x1090ecf2
xor eax, eax
jmp 0x1090ec68
mov eax, 1
jmp 0x1090ec68

Function at 0x1090ed60
Capabilities:
Check if file exists
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1092b200
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x1090edb1
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1090b5d0
lea esp, [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [sym.imp.Core.dll_int_GUnicodeOS]
cmp dword [eax], 0
je 0x1090edc6
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
jmp 0x1090ee09
mov esi, dword [ebp + 8]
push esi
mov edi, dword [sym.imp.Core.dll_int___cdecl_winGetSizeANSI_wchar_t_const__]
call edi
add esp, 4
test eax, eax
jne 0x1090eddd
xor ebx, ebx
jmp 0x1090edf3
push esi
call edi
add esp, 4
add eax, 7
and eax, 0xfffffff8
call fcn.10924d50
mov dword [ebp - 0x10], esp
mov ebx, esp
push esi
call edi
push eax
push esi
push ebx
call dword [sym.imp.Core.dll_char____cdecl_winToANSI_char___wchar_t_const___int_]
add esp, 0x10
push eax
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
test eax, eax
jne 0x1090ee24
cmp dword [ebp + 0xc], eax
jne 0x1090ee1d
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
je 0x1090ee24
xor eax, eax
jmp 0x1090ed9b
mov eax, 1
jmp 0x1090ed9b
Function at 0x10911030
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x24]
lea ecx, [ecx]
mov edx, dword [edi + 0x34]
mov ecx, dword [edi + 0x64]
sub edx, ecx
mov eax, dword [edi + 0x6c]
sub edx, eax
mov dword [ebp + 8], edx
jne 0x1091105e
test ecx, ecx
jne 0x1091106a
test eax, eax
jne 0x1091106a
mov edx, esi
jmp 0x109110dc
cmp edx, 0xffffffff
jne 0x1091106a
mov edx, 0xfffffffe
jmp 0x109110dc
mov eax, dword [edi + 0x24]
add eax, 0xfffffefa
add eax, esi
cmp ecx, eax
jb 0x109110dc
mov ecx, dword [edi + 0x30]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.10916900
mov edx, dword [edi + 0x44]
add esp, 0xc
mov eax, dword [edi + 0x3c]
sub dword [edi + 0x68], esi
sub dword [edi + 0x64], esi
sub dword [edi + 0x54], esi
lea ecx, [eax + edx*2]
jmp 0x109110a0
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x109110af
sub eax, esi
jmp 0x109110b1
xor eax, eax
mov word [ecx], ax
dec edx
jne 0x109110a0
mov eax, dword [edi + 0x38]
mov edx, esi
lea ecx, [eax + esi*2]
nop
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x109110cf
sub eax, esi
jmp 0x109110d1
xor eax, eax
mov word [ecx], ax
dec edx
jne 0x109110c0
mov edx, dword [ebp + 8]
add edx, esi
mov ebx, dword [edi]
cmp dword [ebx + 4], 0
je 0x1091117d
mov eax, dword [edi + 0x6c]
add eax, dword [edi + 0x64]
add eax, dword [edi + 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp + 8], ecx
test ecx, ecx
jne 0x10911109
xor eax, eax
jmp 0x10911141
sub eax, ecx
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
cmp dword [eax + 0x18], 0
jne 0x1091112b
push ecx
push dword [ebx]
push dword [ebx + 0x30]
call fcn.10911420
mov ecx, dword [ebp + 8]
add esp, 0xc
mov dword [ebx + 0x30], eax
push ecx
push dword [ebx]
push dword [ebp - 4]
call fcn.10916900
mov eax, dword [ebp + 8]
add esp, 0xc
add dword [ebx], eax
add dword [ebx + 8], eax
add dword [edi + 0x6c], eax
mov ebx, dword [edi + 0x6c]
cmp ebx, 3
jb 0x10911169
mov eax, dword [edi + 0x30]
add eax, dword [edi + 0x64]
mov ecx, dword [edi + 0x50]
movzx edx, byte [eax]
mov dword [edi + 0x40], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x4c]
mov dword [edi + 0x40], edx
cmp ebx, 0x106
jae 0x1091117d
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x10911040
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10911420
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx ecx, si
shr esi, 0x10
test edi, edi
jne 0x1091143c
lea eax, [edi + 1]
pop edi
pop esi
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x1091153d
jmp 0x10911450
mov edx, 0x15b0
cmp ebx, edx
cmovb edx, ebx
sub ebx, edx
mov dword [ebp + 0x10], ebx
cmp edx, 0x10
jl 0x10911502
mov ebx, edx
shr ebx, 4
mov eax, ebx
neg eax
shl eax, 4
add edx, eax
movzx eax, byte [edi]
add ecx, eax
movzx eax, byte [edi + 1]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 2]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 3]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 4]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 5]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 6]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 7]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 8]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 9]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xa]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xb]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xc]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xd]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xe]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xf]
add esi, ecx
add edi, 0x10
add ecx, eax
add esi, ecx
dec ebx
jne 0x10911476
mov ebx, dword [ebp + 0x10]
test edx, edx
je 0x10911511
movzx eax, byte [edi]
inc edi
add ecx, eax
add esi, ecx
dec edx
jne 0x10911506
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul esi
shr edx, 0xf
imul edx, edx, 0xffff000f
add esi, edx
test ebx, ebx
jne 0x10911450
shl esi, 0x10
pop ebx
or esi, ecx
pop edi
mov eax, esi
pop esi
pop ebp
ret
Function at 0x10922317
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10941e00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.kernel32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1091ca3d
mov dword [ebp - 0x14], eax
cmp dword [0x10989374], esi
jne 0x1092240a
push 0x800
push esi
push 0x10932310
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10922397
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x57
jne 0x109224ea
push esi
push esi
push 0x10932310
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x109224ea
push 0x10932328
push edi
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x109224ea
push eax
call ebx
push 0x10932334
push edi
mov dword [0x10989374], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push eax
call ebx
push 0x10932344
push edi
mov dword [0x10989378], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push eax
call ebx
push 0x10932358
push edi
mov dword [0x1098937c], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10989384], eax
test eax, eax
je 0x10922407
push 0x10932374
push edi
call dword [sym.imp.kernel32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10989380], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
test eax, eax
je 0x1092242f
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10922422
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10922444
push 4
pop eax
jmp 0x109224ec
cmp dword [ebp - 0x14], esi
je 0x10922444
push dword [0x10989374]
call dword [sym.imp.kernel32.dll_DecodePointer]
push 3
jmp 0x10922429
mov eax, dword [0x10989380]
mov ebx, dword [sym.imp.kernel32.dll_DecodePointer]
cmp eax, edi
je 0x109224a2
cmp dword [0x10989384], edi
je 0x109224a2
push eax
call ebx
push dword [0x10989384]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x109224a2
test eax, eax
je 0x109224a2
call ecx
test eax, eax
je 0x10922497
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10922497
test byte [ebp - 8], 1
jne 0x109224a2
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x109224d2
mov eax, dword [0x10989378]
cmp eax, edi
je 0x109224cf
push eax
call ebx
test eax, eax
je 0x109224cf
call eax
mov esi, eax
test esi, esi
je 0x109224cf
mov eax, dword [0x1098937c]
cmp eax, edi
je 0x109224cf
push eax
call ebx
test eax, eax
je 0x109224cf
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x10989374]
call ebx
test eax, eax
je 0x109224ea
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x109224ec
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.109173fc
mov esp, ebp
pop ebp
ret
Function at 0x10929fa0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [sym.imp.Core.dll_int_GUnicodeOS]
sub esp, 0x300
cmp dword [eax], 0
push esi
push edi
mov edi, dword [sym.imp.Core.dll_wchar_t____cdecl_appStrcpy_wchar_t___wchar_t_const__]
jne 0x1092a08c
push 0xff
lea eax, [ebp - 0x1ff]
mov byte [ebp - 0x200], 0
push 0
push eax
call fcn.109167c0
push 0xff
lea eax, [ebp - 0xff]
mov byte [ebp - 0x100], 0
push 0
push eax
call fcn.109167c0
push 0xff
lea eax, [ebp - 0x2ff]
mov byte [ebp - 0x300], 0
push 0
push eax
call fcn.109167c0
add esp, 0x24
lea eax, [ebp - 0x200]
push 0x100
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
push 0x100
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
push 0x100
lea eax, [ebp - 0x300]
push eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
mov esi, dword [sym.imp.Core.dll_wchar_t_const____cdecl_appFromAnsi_char_const___wchar_t__]
lea eax, [ebp - 0x200]
push 0
push eax
call esi
push eax
push 0x109897b0
call edi
lea eax, [ebp - 0x100]
push 0
push eax
call esi
push eax
push 0x109893a8
call edi
lea eax, [ebp - 0x300]
push 0
push eax
call esi
push eax
push 0x109895a8
call edi
add esp, 0x30
jmp 0x1092a0be
push 0x100
push 0x109897b0
call dword [sym.imp.kernel32.dll_GetSystemDirectoryW]
push 0x100
push 0x109893a8
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryW]
push 0x100
push 0x109895a8
push 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov esi, dword [sym.imp.Core.dll_int___cdecl_appStrlen_wchar_t_const__]
push 0x1093449c
push 0x109895a8
call esi
add esp, 4
lea eax, [eax*2 + 0x109895a0]
push eax
call dword [sym.imp.Core.dll_int___cdecl_appStricmp_wchar_t_const___wchar_t_const__]
add esp, 8
test eax, eax
jne 0x1092a104
push 0x109344a8
push 0x109895a8
call esi
add esp, 4
lea eax, [eax*2 + 0x109895a0]
push eax
call edi
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x444baa
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xfc
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x84], 0x80c9e4
mov dword [ebp - 0x80], 0x98cce0
lea edx, [ebp - 0x18]
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0x78], 0x4450c9
mov dword [ebp - 0x74], esp
lea eax, [ebp - 0x9c]
mov dword [esp], eax
call fcn.0080f6e4
mov ebx, dword [ebp - 0xa0]
cmp dword [ebx + 0x3c6c], 0
je 0x444c23
mov dword [esp + 8], 0x124
mov dword [esp + 4], str..._connection.cpp
mov dword [esp], 0x9b08b6
call sub.msvcrt.dll__assert
mov eax, 1
jmp 0x444cc4
mov eax, dword [ebp - 0xa0]
mov eax, dword [eax + 0x3c50]
mov dword [ebp - 0xa4], eax
lea ecx, [ebp - 0x28]
mov eax, 0x444578
mov edx, 0
mov ebx, dword [ebp - 0xa0]
mov dword [esp + 0xc], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov dword [esp], ecx
call fcn.008aff40
sub esp, 4
mov eax, dword [ebp - 0xa4]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0xa8]
mov dword [ebp - 0xac], edx
mov eax, dword [0x9ab958]
mov dword [esp], eax
mov dword [ebp - 0x98], 8
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
test eax, eax
je 0x444cbf
mov ebx, dword [ebp - 0xac]
cmp dword [eax], ebx
je 0x444c19
mov eax, dword [eax + 4]
test eax, eax
jne 0x444caa
mov eax, 0
test al, al
je 0x444ce6
lea eax, [ebp - 0x38]
mov dword [esp + 4], eax
mov dword [esp], eax
mov dword [ebp - 0x98], 8
call fcn.00843874
jmp 0x44518e
mov eax, dword [ebp - 0x38]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xa8]
mov dword [esp], eax
mov dword [ebp - 0x98], 8
call fcn.00899768
jmp 0x44518e
lea eax, [ebp - 0x9c]
mov dword [esp], eax
call fcn.0080f7c4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x485302
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov esi, dword [ebp + 8]
mov edi, 0xffffffff
mov eax, dword [esi + 0x1c]
dec eax
not eax
and eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov ecx, 0
mov eax, ecx
shl eax, 4
cmp dword [eax + esi + 0x20], 0
je 0x4853cb
inc ecx
cmp ecx, 2
jle 0x485324
cmp edi, 0xffffffff
jne 0x485372
mov ecx, 0
mov eax, dword [esi + 0x1c]
lea ebx, [eax + eax]
mov eax, ecx
shl eax, 4
mov eax, dword [eax + esi + 0x24]
sub eax, dword [ebp - 0x10]
cdq
xor eax, edx
sub eax, edx
cmp eax, ebx
jg 0x4853c7
inc ecx
cmp ecx, 2
jle 0x48534a
cmp edi, 0xffffffff
setne al
movzx eax, al
neg eax
and edi, eax
mov eax, edi
shl eax, 4
lea ebx, [eax + esi]
cmp dword [ebx + 0x28], 0
jne 0x48538e
mov eax, dword [esi + 0x1c]
mov dword [esp], eax
call fcn.0080e834
mov dword [ebx + 0x28], eax
mov eax, edi
shl eax, 4
add eax, esi
mov edx, dword [ebp - 0x10]
mov dword [eax + 0x24], edx
mov dword [esp + 8], 0
mov eax, dword [eax + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esi + 4]
mov dword [esp], eax
call sub.msvcrt.dll_fseek
test eax, eax
je 0x4853d2
mov dword [esi + 8], 5
mov eax, 0xffffffff
jmp 0x485424
mov edi, ecx
jmp 0x485365
mov edi, ecx
jmp 0x48533a
mov eax, dword [esi + 4]
mov dword [esp + 0xc], eax
mov eax, dword [esi + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov ebx, edi
shl ebx, 4
add ebx, esi
mov eax, dword [ebx + 0x28]
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov dword [ebx + 0x2c], eax
mov edx, dword [ebp + 0xc]
sub edx, dword [ebx + 0x24]
cmp edx, eax
jbe 0x485415
mov dword [esi + 8], 5
mov eax, 0xffffffff
jmp 0x485424
mov eax, edi
shl eax, 4
mov dword [eax + esi + 0x20], 1
mov eax, edi
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x6080aa
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov esi, dword [ebp + 8]
mov byte [esi + 0xf], 0
mov byte [esi + 0xe], 0
mov byte [esi + 0xa], 0
mov byte [esi + 9], 0
mov byte [esi + 6], 0
mov byte [esi + 5], 0
mov byte [esi + 4], 0
mov byte [esi + 0xc], 0
mov byte [esi + 0xb], 0
mov byte [esi + 8], 1
mov byte [esi + 7], 1
mov byte [esi + 0xd], 1
mov byte [esi + 0x18], 0
mov word [esi + 0x12], 0
mov word [esi + 0x10], 0
mov byte [esi + 0x17], 0
mov byte [esi + 0x16], 0
mov byte [esi + 0x15], 0
mov byte [esi + 0x14], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0x4c], 0xffffffff
mov dword [esi + 0x50], 1
mov dword [esi + 0x78], 0x5f
mov dword [esi + 0x38], 0x64
mov dword [esi + 0x34], 0x64
mov dword [esi + 0x3c], 0xc8
mov dword [esi + 0x1c], 2
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0xffffffff
mov ebx, dword [esi + 0xb8]
lea edi, [esi + 0xb8]
mov eax, ebx
cmp ebx, edi
je 0x608202
lea edx, [eax + 8]
cmp byte [eax + 8], 0
je 0x6081fa
mov edx, dword [edx + 0x18]
test edx, edx
je 0x6081f3
mov eax, dword [edx]
mov dword [esp], edx
call dword [eax + 4]
mov dword [ebx + 0x20], 0
mov ebx, dword [ebx]
mov eax, ebx
cmp ebx, edi
jne 0x6081db
lea eax, [esi + 0xb8]
mov dword [esp], eax
call fcn.00945a28
mov ebx, dword [esi + 0xc0]
lea edi, [esi + 0xc0]
mov eax, ebx
cmp ebx, edi
je 0x608249
lea edx, [eax + 8]
cmp byte [eax + 8], 0
je 0x608241
mov edx, dword [edx + 0x18]
test edx, edx
je 0x60823a
mov eax, dword [edx]
mov dword [esp], edx
call dword [eax + 4]
mov dword [ebx + 0x20], 0
mov ebx, dword [ebx]
mov eax, ebx
cmp ebx, edi
jne 0x608222
lea eax, [esi + 0xc0]
mov dword [esp], eax
call fcn.00945a28
lea eax, [esi + 0x90]
mov dword [esp], eax
call fcn.00945b94
lea eax, [esi + 0xd4]
mov dword [esp], eax
call fcn.0095a870
lea eax, [esi + 0xc8]
mov dword [esp], eax
call fcn.009537ec
lea eax, [esi + 0x98]
mov dword [esp], eax
call fcn.00947bf0
lea eax, [esi + 0xa0]
mov dword [esp], eax
call fcn.0093b69c
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x650582
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x7c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x44], 0x80c9e4
mov dword [ebp - 0x40], 0x99a9cc
lea edx, [ebp - 0x18]
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], 0x6506d2
mov dword [ebp - 0x34], esp
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call fcn.0080f6e4
mov edx, dword [ebp - 0x60]
mov eax, dword [edx]
cmp dword [eax - 0xc], 0
je 0x6505ff
mov dword [esp], 0x9fa560
mov dword [ebp - 0x58], 0xffffffff
call fcn.009831d4
mov dword [esp + 4], str.__ERROR:
mov dword [esp], eax
call fcn.00987374
mov edx, dword [ebp - 0x60]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00987ad4
mov dword [esp], eax
call fcn.009831d4
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
mov dword [ebp - 0x64], eax
cmp byte [0x9ab898], 0
jne 0x650746
mov dword [esp], 0x9aba1c
call fcn.00929a88
mov dword [ebp - 0x68], eax
lea edx, [ebp - 0x28]
mov dword [esp], edx
call fcn.00922308
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
mov dword [esp], 0x9abc08
call fcn.00922318
mov edx, dword [ebp - 0x68]
mov dword [0x9abc08], edx
lea eax, [ebp - 0x28]
mov dword [esp], eax
call fcn.00922338
mov dword [esp], 0x9abc20
mov dword [ebp - 0x58], 2
call fcn.006a0d7c
jmp 0x650733
mov byte [0x9ab898], 1
mov dword [esp], 0x65078c
call fcn.004012c0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x9c158a
mov edx, dword [ebp - 0x64]
mov dword [esp + 4], edx
mov eax, dword [0x9abc10]
mov dword [esp], eax
mov dword [ebp - 0x58], 0xffffffff
call sub.USER32.dll_MessageBoxA
sub esp, 0x10
mov dword [esp], str.pause
call sub.msvcrt.dll_system
mov dword [esp], 0xffffffff
call sub.msvcrt.dll_exit
push ebp
mov ebp, esp
sub esp, 0x78
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x44], 0x80c9e4
mov dword [ebp - 0x40], 0x99a9d4
lea eax, [ebp - 0x18]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], 0x65082d
mov dword [ebp - 0x34], esp
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call fcn.0080f6e4
mov dword [0x9abc20], 0x9eea48
mov eax, dword [0x9abc08]
mov dword [ebp - 0x64], eax
sub eax, 0xc
mov dword [ebp - 0x60], eax
mov dword [esp + 4], 0x9abc08
lea eax, [ebp - 0x28]
mov dword [esp], eax
call fcn.009222f8
cmp dword [ebp - 0x60], 0x9aba1c
je 0x65085f
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x64]
sub eax, 4
mov dword [esp], eax
mov dword [ebp - 0x58], 1
call fcn.00815de4
test eax, eax
jg 0x65085f
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call fcn.00929958
jmp 0x65085f
lea eax, [ebp - 0x28]
mov dword [esp], eax
call fcn.00922338
mov dword [esp], 0x9abc08
call fcn.00922348
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call fcn.0080f7c4
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret