joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42efd0
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
lea ebp, [esp + 0x34]
mov dword [esp + 4], 0xc
mov edi, dword [esp + 0x60]
mov dword [esp + 8], ebp
mov dword [esp], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
call fcn.00427280
mov ebx, eax
mov eax, edx
or eax, ebx
jne 0x42f170
lea eax, [esp + 0x3c]
mov dword [esp + 0x10], eax
mov eax, dword [edi + 0x78]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [edi + 0x74]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.0042fe90
mov ebx, eax
mov eax, edx
mov esi, edx
or eax, ebx
jne 0x42f0a3
mov eax, dword [esp + 0x34]
mov dword [esp + 0xc], 7
mov dword [esp + 8], 0xc
mov dword [esp + 4], eax
lea eax, [esp + 0x38]
mov dword [esp], eax
call fcn.0042ed10
mov ebx, eax
mov eax, edx
mov esi, edx
or eax, ebx
jne 0x42f1b2
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x3c]
mov dword [eax], edx
mov edx, dword [esp + 0x38]
mov dword [eax + 4], edi
mov dword [eax + 8], edx
mov edx, dword [esp + 0x64]
mov dword [edx], eax
add esp, 0x4c
mov eax, ebx
mov edx, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], edx
mov dword [esp], ebx
call fcn.0041d490
mov dword [esp], 2
mov edi, dword [fcn.004a1b90]
mov dword [esp + 0x2c], eax
call edi
mov edx, dword [esp + 0x2c]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x5361a0
mov dword [esp + 0x10], edx
mov dword [esp + 4], str.__s__Error_while_creating_bitmap_stream:__lu___s_
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], 2
call edi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x5361e1
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call edi
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov eax, dword [esp + 0x38]
test eax, eax
je 0x42f134
lea eax, [esp + 0x38]
mov dword [esp], eax
call fcn.0042eef0
mov edx, dword [esp + 0x3c]
test edx, edx
je 0x42f148
lea eax, [esp + 0x3c]
mov dword [esp], eax
call fcn.0042ff80
mov eax, dword [esp + 0x34]
test eax, eax
je 0x42f097
mov dword [esp + 4], ebp
mov dword [esp], eax
call fcn.0041d440
add esp, 0x4c
mov eax, ebx
mov edx, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], edx
mov esi, edx
mov dword [esp], ebx
call fcn.0041d490
mov dword [esp], 2
mov edi, dword [fcn.004a1b90]
mov dword [esp + 0x2c], eax
call edi
mov edx, dword [esp + 0x2c]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x5361a0
mov dword [esp + 0x10], edx
mov dword [esp + 4], 0x536ec8
jmp 0x42f0de
mov dword [esp + 4], edx
mov dword [esp], ebx
call fcn.0041d490
mov dword [esp], 2
mov edi, dword [fcn.004a1b90]
mov dword [esp + 0x2c], eax
call edi
mov edx, dword [esp + 0x2c]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x5361a0
mov dword [esp + 0x10], edx
mov dword [esp + 4], str.__s__Failed_to_create_bitmap_cache:__lu___s_
jmp 0x42f0de
Function at 0x42f8e0
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [esp + 0x74]
mov edx, dword [esp + 0x78]
mov dword [esp + 0x3c], 0
mov ebp, dword [esp + 0x64]
mov edi, dword [esp + 0x68]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x80]
mov esi, dword [esp + 0x6c]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
test ebp, ebp
jne 0x42f9e0
mov eax, esi
and eax, edi
cmp eax, 0xffffffff
je 0x42f941
mov eax, dword [esp + 0x60]
mov ebx, esi
cmp edi, dword [eax + 0x60]
sbb ebx, dword [eax + 0x64]
jae 0x42f9f7
mov eax, dword [esp + 0x88]
mov eax, dword [eax]
test eax, eax
je 0x42fae0
mov edx, dword [eax + 0xec]
mov dword [esp + 0x3c], eax
test edx, edx
je 0x42f975
add eax, 0xec
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.0041d440
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x84]
mov ecx, dword [esp + 0x28]
mov dword [esp], edi
mov ebx, dword [esp + 0x2c]
mov dword [esp + 4], esi
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x70]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x18], ebx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
mov ecx, ebp
mov dword [esp + 8], edx
mov edx, dword [esp + 0x60]
mov dword [esp + 0x10], ebx
call fcn.0042f240
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x42f9d3
mov ebx, dword [esp + 0x88]
mov ebx, dword [ebx]
test ebx, ebx
je 0x42fab0
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp ebp, 1
jne 0x42f9f7
mov eax, dword [esp + 0x60]
mov ebx, esi
cmp edi, dword [eax + 0x38]
sbb ebx, dword [eax + 0x3c]
jb 0x42f941
mov ebx, dword [fcn.004a1b90]
mov dword [esp], 2
call ebx
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], esi
mov dword [esp + 8], 0x537001
mov dword [esp + 4], 0x537098
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], 2
call ebx
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x536ffe
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call ebx
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x42fad0
mov eax, dword [esp + 0x88]
mov edx, 0
mov esi, dword [eax]
mov eax, 0x16
test esi, esi
jne 0x42f9d3
lea ebx, [esp + 0x3c]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 0x28], edx
mov dword [esp + 0x20], eax
call fcn.0041d440
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
jmp 0x42f9d3
mov ebx, edx
or ebx, eax
jne 0x42fa83
mov ebx, dword [esp + 0x88]
mov dword [ebx], ecx
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0x16
xor edx, edx
jmp 0x42f9d3
lea eax, [esp + 0x3c]
mov dword [esp + 4], 0xf0
mov dword [esp + 8], eax
mov dword [esp], 0
call fcn.00427280
mov ebx, edx
or ebx, eax
je 0x42f971
jmp 0x42f9ba
Function at 0x42fda0
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov eax, dword [esp + 0x44]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x14]
mov ebx, dword [eax + 0x18]
test esi, esi
js 0x42fe10
mov ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x40]
sub edx, 2
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], esi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], esi
mov dword [esp + 0x28], ecx
mov dword [esp + 0x24], 1
mov dword [esp + 0x10], 1
mov dword [esp + 8], edx
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.0042f8e0
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov edi, dword [fcn.004a1b90]
mov dword [esp], 2
call edi
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 8], 0x537001
mov dword [esp + 4], str.__s__Upcase_table_size_too_large_for_s64:__I64u
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], 2
call edi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x536ffe
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call edi
mov dword [esp], eax
call sub.msvcrt.dll_fflush
add esp, 0x30
mov eax, 0x16
xor edx, edx
pop ebx
pop esi
pop edi
ret

Function at 0x42fe90
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [esp + 0x4c]
mov ebx, dword [esp + 0x48]
test esi, esi
js 0x42ff00
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x50]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], esi
sub eax, 2
mov dword [esp + 0x14], ebx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x18], esi
mov dword [esp + 0x28], edx
mov dword [esp + 0x24], 1
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.0042f8e0
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov edi, dword [fcn.004a1b90]
mov dword [esp], 2
call edi
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 8], 0x537001
mov dword [esp + 4], str.__s__Bitmap_size_too_large_for_s64:__I64u
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], 2
call edi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x536ffe
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call edi
mov dword [esp], eax
call sub.msvcrt.dll_fflush
add esp, 0x30
mov eax, 0x16
xor edx, edx
pop ebx
pop esi
pop edi
ret
Function at 0x432f20
Capabilities:
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push esi
push ebx
mov ebx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x20]
mov dword [esp + 0xc], edx
xor edx, edx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], ebx
pop ebx
pop esi
jmp fcn.00432ba0
Function at 0x434720
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, 0xc
sub esp, 0x4c
mov eax, dword [esp + 0x64]
lea ebp, [esp + 0x3c]
mov esi, dword [esp + 0x68]
mov dword [esp + 0x3c], 0
movzx ecx, byte [eax + 0x6c]
mov dword [esp + 8], ebp
mov eax, 0x539078
mov dword [esp], 0
shl ebx, cl
test esi, esi
mov dword [esp + 4], ebx
cmove esi, eax
call fcn.00427280
mov edi, eax
mov eax, edx
or eax, edi
jne 0x434860
mov eax, dword [esp + 0x64]
mov dword [esp + 8], esi
xor ecx, ecx
mov dword [esp + 4], ebx
add eax, 0x6c
mov edx, eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
mov eax, dword [esp + 0x60]
call fcn.00433900
mov edi, eax
mov eax, edx
mov dword [esp + 0x2c], edx
or eax, edi
jne 0x4347f2
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], esi
mov ecx, 1
mov dword [esp + 4], ebx
mov edx, dword [esp + 0x28]
mov dword [esp], eax
mov eax, dword [esp + 0x60]
call fcn.00433900
mov edi, eax
mov eax, edx
or eax, edi
jne 0x4348f0
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], ebp
mov dword [esp + 0x28], edx
mov dword [esp], eax
call fcn.0041d440
mov edx, dword [esp + 0x28]
add esp, 0x4c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [fcn.004a1b90]
mov dword [esp], 2
call ebx
mov dword [esp + 8], 0x537cc0
mov dword [esp + 4], str.__s__Validation_of_main_boot_region_failed.
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], 2
call ebx
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x537cf5
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call ebx
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov edx, dword [esp + 0x2c]
jmp 0x4347d0
mov dword [esp + 4], edx
mov dword [esp], edi
mov dword [esp + 0x28], edx
call fcn.0041d490
mov ebx, dword [fcn.004a1b90]
mov dword [esp], 2
mov esi, eax
call ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x537cc0
mov dword [esp + 4], str.__s__Failed_to_allocate_temporary_space_for_boot_region_data:__lu___s_
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], 2
call ebx
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x537cf5
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call ebx
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov edx, dword [esp + 0x28]
add esp, 0x4c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x28], edx
mov ebx, dword [fcn.004a1b90]
mov dword [esp], 2
call ebx
mov dword [esp + 8], 0x537cc0
mov dword [esp + 4], str.__s__Validation_of_backup_boot_region_failed.
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], 2
call ebx
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x537cf5
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call ebx
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov edx, dword [esp + 0x28]
jmp 0x4347d0
Function at 0x4396c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, eax
push edi
mov edi, edx
push esi
lea esi, [edx + ecx]
push ebx
sub esp, 0x3c
mov ebx, dword [eax]
mov eax, dword [ebx]
cmp eax, esi
jb 0x439735
test ecx, ecx
je 0x439704
mov dword [esp + 0x24], edi
mov eax, edi
mov ebp, 1
mov ecx, eax
mov edx, eax
mov edi, ebp
add eax, 1
and ecx, 7
shr edx, 3
shl edi, cl
mov ecx, edi
or byte [ebx + edx + 0x10], cl
cmp esi, eax
jne 0x4396e5
mov edi, dword [esp + 0x24]
cmp dword [ebx + 4], esi
jb 0x439730
mov eax, dword [ebx + 8]
mov edx, dword [ebx + 0xc]
add edx, eax
cmp edx, edi
jbe 0x43971d
cmp eax, esi
jb 0x4397c0
add esp, 0x3c
xor ebx, ebx
xor edx, edx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebx + 4], esi
jmp 0x439709
lea edx, [esi + 0xff]
shr eax, 3
mov dword [esp + 4], ebx
xor dl, dl
add eax, 0x10
mov dword [esp + 0x10], ebp
mov dword [esp + 0x2c], edx
shr edx, 3
mov dword [esp + 0x28], edx
add edx, 0x10
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp], 0
mov dword [esp + 0x24], ecx
call fcn.00427410
mov ecx, dword [esp + 0x24]
mov ebx, eax
mov eax, edx
or eax, ebx
jne 0x4397e0
mov ebx, dword [ebp]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x24], ecx
mov eax, dword [ebx]
mov dword [esp + 4], 0
shr eax, 3
sub edx, eax
lea eax, [ebx + eax + 0x10]
mov dword [esp + 8], edx
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
mov dword [ebx], eax
jmp 0x4396d6
mov ecx, dword [ebx + 4]
mov edx, esi
mov eax, ebx
xor ebx, ebx
call fcn.00439550
add esp, 0x3c
mov eax, ebx
xor edx, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], edx
mov dword [esp], ebx
mov dword [esp + 0x24], edx
call fcn.0041d490
mov esi, dword [fcn.004a1b90]
mov dword [esp], 2
mov edi, eax
call esi
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x5390a0
mov dword [esp + 4], 0x53a348
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x5390da
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call esi
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov edx, dword [esp + 0x24]
add esp, 0x3c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x43cde0
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebx, dword [esp + 0x78]
mov edi, dword [esp + 0x70]
mov dword [esp + 0x34], 0
test ebx, ebx
je 0x43cf20
mov dword [esp + 0x34], ebx
mov eax, ebx
mov edx, dword [esp + 0x7c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 0x40], edx
lea edx, [esp + 0x40]
mov dword [esp + 0x3c], edx
lea edx, [esp + 0x38]
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x74]
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], edi
mov byte [esp + 0x4c], 0
mov dword [esp + 0x38], 0x435540
call fcn.0043b050
mov esi, eax
mov eax, edx
or eax, esi
jne 0x43ce92
mov eax, dword [esp + 0x34]
test eax, eax
je 0x43ce6a
test ebx, ebx
je 0x43ce74
add esp, 0x5c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
lea ebp, [esp + 0x34]
mov dword [esp], ebp
mov dword [esp + 0x2c], edx
call fcn.0042ff80
mov edx, dword [esp + 0x2c]
add esp, 0x5c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], edx
mov dword [esp], esi
mov dword [esp + 0x2c], edx
call fcn.0041d490
mov edi, dword [fcn.004a1b90]
mov dword [esp], 2
mov ebp, eax
call edi
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x5390a0
mov dword [esp + 4], str.__s__exfat_dir_list_raw_operation_failed:__lu___s_
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], 2
call edi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x5390da
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call edi
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov edx, dword [esp + 0x2c]
jmp 0x43ce5e
lea ebp, [esp + 0x34]
mov dword [esp], edi
mov dword [esp + 4], ebp
call fcn.0042fbb0
mov esi, eax
mov ecx, edx
mov eax, dword [esp + 0x34]
or ecx, esi
je 0x43ce05
mov dword [esp + 4], edx
mov dword [esp], esi
mov dword [esp + 0x2c], edx
call fcn.0041d490
mov ebx, dword [fcn.004a1b90]
mov dword [esp], 2
mov edi, eax
call ebx
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x5390a0
mov dword [esp + 4], 0x53b2fc
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], 2
call ebx
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x5390da
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call ebx
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov edx, dword [esp + 0x34]
test edx, edx
mov edx, dword [esp + 0x2c]
jne 0x43ce78
jmp 0x43ce6a
Function at 0x447fe0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, edx
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x4c
mov eax, dword [eax + 0x30]
mov esi, dword [eax + 0xa4]
mov edi, dword [eax + 0xa0]
mov dword [eax + 0x88], 0
mov eax, esi
or eax, edi
jne 0x448080
mov edx, dword [ebx]
mov ecx, ebp
lea eax, [ebx + 8]
call fcn.00447d30
mov ecx, dword [ebx + 0x30]
mov dword [ebx + 0x14], 0
mov esi, dword [ecx + 0xc8]
test esi, esi
je 0x44804b
add ecx, 0xc8
mov dword [esp + 0x38], eax
mov dword [esp], ecx
mov dword [esp + 0x3c], edx
call fcn.00439bb0
mov ecx, dword [ebx + 0x30]
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
mov ebx, dword [ecx + 0xb8]
test ebx, ebx
je 0x448073
add ecx, 0xb8
mov dword [esp + 0x38], eax
mov dword [esp], ecx
mov dword [esp + 0x3c], edx
call fcn.0042ff80
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [fcn.004a1b90]
mov dword [esp], 2
mov dword [esp + 0x38], edx
call edx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], str.exfat_inode_cleanup
mov dword [esp + 0x10], 0x2397
mov dword [esp + 0xc], 0x53df68
mov dword [esp + 8], 0x53df70
mov dword [esp + 4], 0x53df7c
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov edx, dword [esp + 0x38]
mov dword [esp], 2
call edx
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x53ded6
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
mov edx, dword [esp + 0x38]
call edx
mov dword [esp], eax
call sub.msvcrt.dll_fflush
jmp 0x44800a
Function at 0x448120
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebp, dword [esp + 0x70]
mov ebx, dword [ebp]
mov ecx, dword [ebx + 0x30]
mov edx, dword [ecx + 0x94]
mov eax, dword [ecx + 0x90]
mov edi, edx
or edi, eax
je 0x448273
add eax, 0xffffffff
adc edx, 0xffffffff
mov dword [ecx + 0x90], eax
mov dword [ecx + 0x94], edx
or edx, eax
jne 0x448260
mov edx, dword [ecx + 0x8c]
test edx, edx
jne 0x4481b0
mov eax, dword [ecx]
mov edx, 1
mov dword [esp + 0x4c], eax
mov eax, ebx
call fcn.00447fe0
lea ecx, [esp + 0x4c]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x38], eax
mov dword [esp], ecx
mov dword [esp + 0x3c], edx
call fcn.0041d440
mov dword [ebp], 0
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebx + 0x20]
mov eax, dword [eax + 0x10]
test eax, eax
jne 0x44816b
mov edx, dword [fcn.004a1b90]
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0xc]
mov dword [esp], 2
mov dword [esp + 0x38], edx
call edx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x14], str.exfat_inode_release_internal
mov dword [esp + 0x10], 0x23ee
mov dword [esp + 0xc], 0x53df68
mov dword [esp + 8], 0x53df70
mov dword [esp + 4], 0x53e030
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov edx, dword [esp + 0x38]
mov dword [esp], 2
call edx
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x53ded6
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x38]
mov dword [esp], 2
call edx
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov ebx, dword [ebp]
mov ecx, dword [ebx + 0x30]
jmp 0x44816b
mov dword [ebp], 0
add esp, 0x5c
xor eax, eax
xor edx, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, dword [fcn.004a1b90]
mov dword [esp], 2
call esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], str.exfat_inode_release_internal
mov dword [esp + 0x10], 0x23d4
mov dword [esp + 0xc], 0x53df68
mov dword [esp + 8], 0x53df70
mov dword [esp + 4], 0x53dfe8
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x53ded6
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call esi
mov dword [esp], eax
call sub.msvcrt.dll_fflush
add esp, 0x5c
mov eax, 6
xor edx, edx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4486f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, eax
push edi
push esi
push ebx
sub esp, 0x4c
lea edi, [esp + 0x3c]
mov dword [esp + 4], 0x108
mov dword [esp + 8], edi
mov dword [esp], 0
mov dword [esp + 0x3c], 0
call fcn.00427280
mov ebx, eax
mov eax, edx
mov esi, edx
or eax, ebx
jne 0x448740
mov eax, dword [esp + 0x3c]
mov dword [ebp], eax
add esp, 0x4c
mov eax, ebx
mov edx, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], edx
mov dword [esp], ebx
call fcn.0041d490
mov ebp, dword [fcn.004a1b90]
mov dword [esp], 2
mov dword [esp + 0x2c], eax
call ebp
mov edx, dword [esp + 0x2c]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x53dea0
mov dword [esp + 0x10], edx
mov dword [esp + 4], str.__s__Failed_to_allocate_memory_for_new_exfat_inode_allocation:__lu___s_
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], 2
call ebp
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x53ded6
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call ebp
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x44872e
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.0041d440
add esp, 0x4c
mov eax, ebx
mov edx, esi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x458680
Capabilities:
Resolve function by parsing pe exports
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x54]
mov dword [esp + 4], eax
jmp fcn.00447590