joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449110
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
push ebx
mov ebx, dword [esp + 0x11c]
push esi
push edi
mov edi, dword [esp + 0x120]
mov esi, ecx
test edi, edi
mov byte [ebx], 0
je 0x449165
push 0x78
push 0
mov ecx, edi
call fcn.00422390
mov ecx, edi
call fcn.00422210
test al, al
je 0x449165
mov ecx, dword [esp + 0x128]
push str.Wait_for_data_aborted_by_app
mov eax, dword [ecx]
call dword [eax + 0x10]
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x10c
ret 0x14
mov edi, dword [esi + 0x4c]
cmp edi, 0xffffffff
jne 0x44918f
mov ecx, dword [esp + 0x128]
push str.Wait_for_data_passed_invalid_socket.
mov edx, dword [ecx]
call dword [edx + 0x10]
pop edi
mov byte [ebx], 1
pop esi
xor al, al
pop ebx
add esp, 0x10c
ret 0x14
mov ecx, dword [esp + 0x11c]
test ecx, ecx
jne 0x44919f
mov ecx, 0x14
mov eax, 0x10624dd3
mul ecx
shr edx, 6
mov eax, edx
neg eax
shl eax, 2
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [ecx + eax*8]
cmp eax, 0x7a120
jbe 0x4491c7
mov eax, 0x7a120
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
test edx, edx
jne 0x4491e0
test eax, eax
jne 0x4491e0
mov eax, 0x3e8
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], edx
push ecx
push 0
lea edx, [esp + 0x1c]
push 0
push edx
push 0
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], 1
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x449252
mov ecx, dword [esp + 0x128]
mov byte [ebx], 1
push str.The_peer_has_closed_the_socket__TCP__connection
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, dword [esi + 0x4c]
push 2
push ecx
call dword [sym.imp.WS2_32.dll_shutdown]
mov edx, dword [esi + 0x4c]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 0x4c], 0xffffffff
mov byte [esi + 0x48], 0
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x10c
ret 0x14
test eax, eax
pop edi
pop esi
setne al
pop ebx
add esp, 0x10c
ret 0x14
Function at 0x449270
Capabilities:
Get socket status

Disassembly:
mov eax, dword [esp + 0x14]
sub esp, 0x110
push ebx
mov ebx, dword [esp + 0x118]
push ebp
push esi
mov esi, dword [esp + 0x12c]
push edi
mov edi, ecx
mov byte [eax], 0
mov ecx, dword [esp + 0x138]
mov byte [esi], 0
test ebx, ebx
mov byte [ecx], 0
je 0x4492ac
cmp ebx, 0x32
jae 0x4492ac
mov ebx, 0x32
mov ebp, dword [esp + 0x128]
test ebp, ebp
jne 0x4492bc
mov ebp, 0x1499700
cmp dword [edi + 0x4c], 0xffffffff
jne 0x4492e5
mov ecx, dword [esp + 0x13c]
push str.Invalid_socket.
mov edx, dword [ecx]
call dword [edx + 0x10]
mov byte [esi], 1
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x110
ret 0x1c
xor eax, eax
mov cl, 1
mov dword [esp + 0x10], eax
test ebp, ebp
je 0x4492f9
cmp eax, ebp
jae 0x44942e
test ebx, ebx
mov esi, ebx
jne 0x449301
mov esi, ebp
test ebp, ebp
je 0x449317
cmp ebp, eax
jbe 0x449317
mov esi, ebp
sub esi, eax
test ebx, ebx
je 0x449317
cmp esi, ebx
jbe 0x449317
mov esi, ebx
test cl, cl
je 0x449327
shr esi, 1
cmp esi, 0x32
jae 0x449327
mov esi, 0x32
mov eax, 0x10624dd3
mov dword [esp + 0x1c], 1
mul esi
shr edx, 6
mov dword [esp + 0x14], edx
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
mov ecx, eax
mov eax, esi
sub eax, ecx
lea ecx, [esp + 0x14]
push ecx
push 0
lea eax, [eax + eax*4]
push 0
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
mov eax, dword [edi + 0x4c]
shl edx, 3
mov dword [esp + 0x24], edx
lea edx, [esp + 0x28]
push edx
push 0
mov dword [esp + 0x34], eax
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x4493d4
test eax, eax
jne 0x44941f
mov ecx, dword [esp + 0x10]
add ecx, esi
test ebp, ebp
mov dword [esp + 0x10], ecx
je 0x4493a1
mov eax, ecx
cmp eax, ebp
jae 0x44942e
mov esi, dword [esp + 0x12c]
test esi, esi
je 0x4493c9
test ebx, ebx
je 0x4493c9
push 0x73
push ebx
mov ecx, esi
call fcn.00422330
mov ecx, esi
call fcn.00422210
test al, al
jne 0x449467
mov eax, dword [esp + 0x10]
xor cl, cl
jmp 0x4492ed
mov eax, dword [esp + 0x130]
mov ecx, dword [esp + 0x13c]
push str.Error_waiting_for_socket_to_become_ready_for_reading.
mov byte [eax], 1
mov edx, dword [ecx]
call dword [edx + 0x10]
mov eax, dword [edi + 0x4c]
push 2
push eax
call dword [sym.imp.WS2_32.dll_shutdown]
mov ecx, dword [edi + 0x4c]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [edi + 0x4c], 0xffffffff
mov byte [edi + 0x48], 0
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x110
ret 0x1c
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x110
ret 0x1c
mov esi, dword [esp + 0x13c]
push str.Timeout_waiting_to_read_socket_or_accept_connection
mov ecx, esi
mov edx, dword [esi]
call dword [edx + 0x10]
mov eax, dword [esi]
push ebp
push str.timeoutMs
mov ecx, esi
call dword [eax + 0x2c]
mov ecx, dword [esp + 0x138]
pop edi
pop esi
pop ebp
mov byte [ecx], 1
xor al, al
pop ebx
add esp, 0x110
ret 0x1c
mov edx, dword [esp + 0x134]
mov ecx, dword [esp + 0x13c]
push str.socket_operation_aborted_by_application_callback
mov byte [edx], 1
mov eax, dword [ecx]
call dword [eax + 0x10]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x110
ret 0x1c
Function at 0x449b90
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x46e678
push eax
mov eax, dword [esp + 0x1c]
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push ebp
mov ebp, dword [esp + 0x3c]
push esi
mov esi, ecx
push edi
mov byte [ebp], 0
mov byte [eax], 0
cmp dword [esi + 0x4c], 0xffffffff
jne 0x449be5
mov ecx, dword [esp + 0x40]
push str.This_socket_is_not_connected
mov dword [ecx], 0
mov ecx, dword [esp + 0x50]
mov byte [eax], 1
mov edx, dword [ecx]
call dword [edx + 0x10]
xor al, al
jmp 0x449d83
mov eax, dword [esi + 0xb8]
test eax, eax
jne 0x449bf4
mov eax, 0xea60
mov ebx, dword [esp + 0x50]
mov edi, dword [esp + 0x4c]
push 0xabc
push 0
push 0
push ebx
push edi
push eax
mov ecx, esi
call fcn.00449020
test al, al
jne 0x449c52
cmp dword [esi + 0x4c], 0xffffffff
je 0x449c3a
mov eax, dword [edi]
push str.WaitForData_timed_out.
mov ecx, edi
call dword [eax + 0x10]
mov edx, dword [esp + 0x40]
mov byte [ebp], 1
xor al, al
mov dword [edx], 0
jmp 0x449d83
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x40]
xor al, al
mov byte [ecx], 1
mov dword [edx], 0
jmp 0x449d83
lea eax, [esp + 0x4c]
lea ecx, [esi + 0x90]
push eax
push ebx
push 0
mov byte [esp + 0x58], 0
call fcn.004580b0
mov al, byte [esp + 0x4c]
test al, al
je 0x449c8f
mov edx, dword [edi]
push str.Aborted_by_application_while_download_throttling__1_
mov ecx, edi
call dword [edx + 0x10]
mov eax, dword [esp + 0x40]
mov dword [eax], 0
xor al, al
jmp 0x449d83
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
push 0
mov edx, dword [ecx]
mov ecx, dword [esi + 0x4c]
push edx
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov ebp, eax
mov eax, dword [esp + 0x40]
test ebp, ebp
mov dword [eax], 0
jne 0x449cf2
mov edx, dword [edi]
push str.The_peer_has_closed_the_socket__TCP__connection
mov ecx, edi
call dword [edx + 0x10]
mov eax, dword [esi + 0x4c]
push 2
push eax
call dword [sym.imp.WS2_32.dll_shutdown]
mov ecx, dword [esi + 0x4c]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov edx, dword [esp + 0x48]
mov dword [esi + 0x4c], 0xffffffff
mov byte [esi + 0x48], 0
xor al, al
mov byte [edx], 1
jmp 0x449d83
cmp ebp, 0xffffffff
jne 0x449d3f
lea ecx, [esp + 0x10]
call fcn.00416ed0
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], 0
call fcn.00418200
mov esi, dword [edi]
lea ecx, [esp + 0x10]
call fcn.00422700
push eax
mov ecx, edi
call dword [esi + 0x10]
mov eax, dword [edi]
push str.Failed_to_receive_on_the_TCP_socket
mov ecx, edi
call dword [eax + 0x10]
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], ebp
call fcn.004171c0
xor al, al
jmp 0x449d83
test ebp, ebp
mov dword [eax], ebp
jle 0x449d65
push ebp
lea ecx, [esi + 0x90]
call fcn.00458050
mov al, byte [esi + 0x100]
test al, al
je 0x449d65
push ebx
push ebp
lea ecx, [esi + 8]
call fcn.00458420
test ebx, ebx
je 0x449d81
mov edx, dword [esp + 0x40]
lea ecx, [esp + 0x48]
push ecx
mov ecx, ebx
mov eax, dword [edx]
mov byte [esp + 0x4c], 0
push eax
call fcn.004225b0
mov al, 1
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 0x18
Function at 0x44a1a0
Capabilities:
Check for time delay via gettickcount
Receive data
Receive data on socket

Disassembly:
push 0xffffffffffffffff
push 0x46e6d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov edi, ecx
push 0x7d0
call fcn.0045d8e0
add esp, 4
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, ebp
jae 0x44a1e5
mov ebp, eax
jmp 0x44a1f0
sub eax, ebp
cmp eax, 0x64
ja 0x44a2d4
mov ecx, dword [esp + 0x4c]
lea eax, [esp + 0x13]
lea ebx, [edi + 0x90]
push eax
push ecx
push 0
mov ecx, ebx
call fcn.004580b0
mov al, byte [esp + 0x13]
test al, al
jne 0x44a276
mov edx, dword [esp + 0x14]
mov eax, dword [edi + 0x4c]
push 0
push 0x7d0
push edx
push eax
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
test esi, esi
je 0x44a288
cmp esi, 0xffffffff
je 0x44a2ba
test esi, esi
jle 0x44a25a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, eax
mov al, byte [edi + 0x100]
test al, al
je 0x44a25a
mov ecx, dword [esp + 0x4c]
push ecx
push esi
lea ecx, [edi + 8]
call fcn.00458420
push esi
mov ecx, ebx
call fcn.00458050
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x44]
push esi
push edx
call fcn.00423270
jmp 0x44a1d7
mov ecx, dword [esp + 0x48]
push str.Aborted_by_application_while_download_throttling__3_
mov eax, dword [ecx]
call dword [eax + 0x10]
xor al, al
jmp 0x44a2d6
mov ecx, dword [edi + 0x4c]
push 2
push ecx
call dword [sym.imp.WS2_32.dll_shutdown]
mov edx, dword [edi + 0x4c]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [esp + 0x14]
mov dword [edi + 0x4c], 0xffffffff
push eax
mov byte [edi + 0x48], 0
call fcn.0045cfdf
add esp, 4
xor al, al
jmp 0x44a2d6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x44a2eb
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0045cfdf
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret 0xc
lea ecx, [esp + 0x18]
call fcn.00416ed0
push str.SOCKET_ERROR:
lea ecx, [esp + 0x1c]
mov dword [esp + 0x40], 0
call fcn.00416a20
lea ecx, [esp + 0x18]
call fcn.00418200
mov esi, dword [esp + 0x48]
lea ecx, [esp + 0x18]
mov edi, dword [esi]
call fcn.00422700
push eax
mov ecx, esi
call dword [edi + 0x10]
mov edx, dword [esi]
push str.Failed_to_accumulate_data_on_socket.
mov ecx, esi
call dword [edx + 0x10]
mov eax, dword [esp + 0x14]
push eax
call fcn.0045cfdf
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x3c], 0xffffffff
call fcn.004171c0
xor al, al
jmp 0x44a2d6
Function at 0x44b560
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x46e800
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [esp + 0x20]
push ebp
push esi
push edi
mov edi, ecx
push eax
lea ebp, [edi + 0xc]
mov ecx, ebp
call fcn.00417e70
mov ecx, dword [esp + 0x30]
lea esi, [edi + 0x28]
push ecx
mov ecx, esi
call fcn.00417e70
push 0x47ff4c
mov ecx, esi
call fcn.00418160
test al, al
je 0x44b5d9
lea ecx, [esp + 0xc]
call fcn.0042bb70
push 0
push esi
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0
call fcn.0042cf60
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.0042bba0
push 0x47ff48
mov ecx, esi
call fcn.00418160
test al, al
je 0x44b617
lea ecx, [esp + 0x14]
call fcn.0042bb70
push 0
push esi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x2c], 1
call fcn.0042cf60
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], 0xffffffff
call fcn.0042bba0
push 0xa
mov ecx, esi
call fcn.004168e0
test al, al
je 0x44b646
push 0x497870
push 0x483438
mov ecx, esi
call fcn.00417850
push 0x497870
push 0x48cdd0
mov ecx, esi
call fcn.00417850
push str.user_agent
mov ecx, ebp
call fcn.00418450
test al, al
jne 0x44b676
push str.accept
mov ecx, ebp
call fcn.00418450
test al, al
jne 0x44b676
push str.accept_charset
mov ecx, ebp
call fcn.00418450
test al, al
je 0x44b67a
mov byte [edi + 8], 1
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x1c
ret 8
Function at 0x44c4f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46e8c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
mov ebx, dword [esp + 0x20]
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
mov byte [ebx], 0
call fcn.0041e470
push 0x4e24
mov dword [esp + 0x1c], 0
call fcn.0045d8e0
add esp, 4
mov edi, eax
mov eax, dword [esp + 0x24]
lea ecx, [esi + 0xed]
push eax
push ebx
lea edx, [esp + 0x30]
push ecx
push edx
push edi
mov ecx, esi
mov dword [esp + 0x3c], 0x4e20
call fcn.0044c5b0
mov esi, dword [esp + 0x20]
mov bl, al
test bl, bl
je 0x44c56f
mov eax, dword [esp + 0x28]
test eax, eax
je 0x44c56f
push eax
push edi
mov ecx, esi
call fcn.00423270
push edi
call fcn.0045cfdf
add esp, 4
mov ecx, esi
call fcn.004226e0
test eax, eax
je 0x44c585
mov bl, 1
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0xffffffff
call fcn.0041e4b0
mov ecx, dword [esp + 0x10]
pop edi
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
Function at 0x4523d0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x46eca8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
mov ebx, dword [esp + 0x38]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
lea eax, [esp + 0xc]
push edi
mov edi, dword [esp + 0x48]
xor esi, esi
push eax
lea ecx, [esp + 0x18]
push esi
push ecx
push esi
push edi
push ebx
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 1
call ebp
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x48], eax
test ecx, ecx
je 0x452444
push ecx
call fcn.0045d8e0
add esp, 4
lea edx, [esp + 0x10]
mov esi, eax
lea eax, [esp + 0x14]
push edx
push esi
push eax
push 0
push edi
push ebx
call ebp
mov eax, esi
jmp 0x4524a5
test eax, eax
je 0x452440
mov esi, dword [esp + 0x4c]
test esi, esi
je 0x4524a3
lea ecx, [esp + 0x18]
call fcn.00416ed0
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x3c], 0
push ecx
lea ecx, [esp + 0x1c]
call fcn.00418230
mov ebx, dword [esi]
lea ecx, [esp + 0x18]
call fcn.00422700
push eax
push str.RegistryQueryError
mov ecx, esi
call dword [ebx + 0x28]
mov edx, dword [esi]
push edi
push str.ValueName
mov ecx, esi
call dword [edx + 0x28]
lea ecx, [esp + 0x18]
mov dword [esp + 0x3c], 0xffffffff
call fcn.004171c0
xor eax, eax
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret 0xc
Function at 0x453720
Capabilities:
Encode data using xor
Encrypt data using blowfish

Disassembly:
sub esp, 0x4c
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov ecx, 0x10
mov eax, dword [ebp + 8]
lea edi, [esp + 0x1c]
cdq
and edx, 7
lea esi, [ebp + 0x14]
add eax, edx
mov ebx, eax
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, esi
sar ebx, 3
call fcn.004226e0
cmp eax, 0x40
mov ecx, esi
jbe 0x453774
call fcn.00422700
test eax, eax
je 0x4537a5
mov ecx, esi
call fcn.00422700
mov ecx, 0x10
mov esi, eax
lea edi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
jmp 0x4537a5
call fcn.00422700
test eax, eax
je 0x4537a5
mov ecx, esi
call fcn.004226e0
mov ecx, esi
mov edi, eax
call fcn.00422700
mov esi, eax
mov eax, edi
lea edi, [esp + 0x1c]
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov ecx, dword [ebp]
mov edx, dword [eax + 0x491a88]
mov dword [eax + ecx], edx
add eax, 4
cmp eax, 0x48
jl 0x4537a7
xor eax, eax
mov ecx, 0x100
mov edx, dword [ebp + 4]
mov esi, dword [eax + 0x491ad0]
mov dword [edx + eax], esi
add eax, 4
dec ecx
jne 0x4537c2
cmp eax, 0x1000
jl 0x4537bd
xor esi, esi
xor edi, edi
mov eax, dword [ebp]
lea ecx, [edi + eax]
lea eax, [esi + 1]
cdq
idiv ebx
mov dword [esp + 0x18], ecx
xor ecx, ecx
lea eax, [esi + 2]
add edi, 4
mov cl, byte [esp + edx + 0x1c]
cdq
idiv ebx
mov ch, byte [esp + esi + 0x1c]
xor eax, eax
shl ecx, 8
mov al, byte [esp + edx + 0x1c]
or ecx, eax
lea eax, [esi + 3]
cdq
idiv ebx
xor eax, eax
shl ecx, 8
mov al, byte [esp + edx + 0x1c]
or ecx, eax
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
xor edx, ecx
mov dword [eax], edx
lea eax, [esi + 4]
cdq
idiv ebx
cmp edi, 0x48
mov esi, edx
jl 0x4537df
xor esi, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, ebp
call fcn.00452f20
mov eax, dword [ebp]
mov ecx, dword [esp + 0x10]
mov dword [esi + eax], ecx
mov edx, dword [ebp]
mov eax, dword [esp + 0x14]
mov dword [esi + edx + 4], eax
add esi, 8
cmp esi, 0x48
jl 0x45383f
mov esi, 4
mov edi, 0x80
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, ebp
call fcn.00452f20
mov eax, dword [ebp + 4]
mov ecx, dword [esp + 0x10]
mov dword [esi + eax - 4], ecx
mov edx, dword [ebp + 4]
mov eax, dword [esp + 0x14]
mov dword [esi + edx], eax
add esi, 8
dec edi
jne 0x453877
cmp esi, 0x1004
jl 0x453872
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret
Function at 0x454af0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 4]
push edi
cmp eax, 0xffffffff
jne 0x454b0d
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x18
ret 0x10
mov ebp, dword [esp + 0x2c]
mov esi, dword [ebx + 8]
xor edi, edi
lea ecx, [esp + 0x1c]
mov edx, dword [ebp]
push edi
push ecx
push edx
push eax
mov dword [esp + 0x2c], edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
mov dword [ebx + 8], eax
jne 0x454b42
mov dword [ebx + 8], esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x18
ret 0x10
mov eax, dword [ebp]
mov ecx, dword [esp + 0x38]
mov dword [ebx + 8], eax
call fcn.004226d0
push 0x4e20
xor esi, esi
call fcn.0045d8e0
mov ecx, dword [ebx + 8]
add esp, 4
lea edx, [esp + 0x10]
mov ebp, eax
mov eax, dword [ebx + 4]
push edi
push edx
push 0x4e20
push ebp
push eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x454ba0
push ebp
call fcn.0045cfdf
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
mov eax, dword [esp + 0x10]
cmp eax, edi
jne 0x454bbd
push ebp
call fcn.0045cfdf
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
cmp eax, 4
jge 0x454bd7
push ebp
call fcn.0045cfdf
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
mov ecx, dword [ebx + 8]
mov edx, dword [esp + 0x30]
add ecx, eax
mov dword [esp + 0x14], eax
mov dword [ebx + 8], ecx
mov edi, dword [ebp]
cmp edi, edx
mov ecx, ebp
je 0x454c95
mov edi, dword [ecx]
cmp edi, dword [esp + 0x34]
je 0x454c95
cmp eax, 4
jl 0x454c19
mov edi, dword [esp + 0x18]
dec eax
inc esi
inc edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edi
lea ecx, [esi + ebp]
jmp 0x454c8d
test eax, eax
je 0x454c47
mov ecx, eax
add esi, ebp
mov edx, ecx
lea edi, [esp + 0x20]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
lea esi, [esp + 0x20]
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, 0x4e20
lea ecx, [esp + 0x10]
push 0
sub edx, eax
push ecx
mov ecx, dword [ebx + 4]
add eax, ebp
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x454ca1
mov eax, dword [esp + 0x10]
test eax, eax
je 0x454ca1
mov edx, dword [ebx + 8]
mov ecx, dword [esp + 0x14]
add edx, eax
xor esi, esi
add ecx, eax
mov dword [ebx + 8], edx
mov edx, dword [esp + 0x30]
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
mov ecx, ebp
cmp dword [ecx], edx
jne 0x454bf4
mov eax, dword [ecx]
cmp eax, edx
je 0x454cb6
cmp eax, dword [esp + 0x34]
je 0x454cb6
push ebp
call fcn.0045cfdf
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
add eax, edx
mov edx, dword [esp + 0x2c]
push 4
push ecx
mov ecx, dword [esp + 0x40]
mov dword [edx], eax
call fcn.00423270
push ebp
call fcn.0045cfdf
add esp, 4
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
Function at 0x454cf0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov eax, dword [ebp + 4]
cmp eax, 0xffffffff
je 0x454e8c
mov edi, dword [esp + 0x2c]
mov esi, dword [ebp + 8]
lea ecx, [esp + 0x1c]
push 0
mov edx, dword [edi]
push ecx
push edx
push eax
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0x454d3c
mov dword [ebp + 8], esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x18
ret 0xc
mov eax, dword [edi]
mov ecx, dword [esp + 0x34]
mov dword [ebp + 8], eax
call fcn.004226d0
push 0x4e40
xor esi, esi
call fcn.0045d8e0
mov ecx, dword [ebp + 8]
add esp, 4
mov ebx, eax
xor eax, eax
lea edx, [esp + 0x10]
push eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 4]
push edx
push 0x4e20
push ebx
push eax
mov dword [esp + 0x38], ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x454e83
mov eax, dword [esp + 0x10]
test eax, eax
je 0x454e83
cmp eax, 4
jl 0x454e83
mov ecx, dword [ebp + 8]
mov edx, dword [esp + 0x30]
add ecx, eax
mov dword [esp + 0x14], eax
mov dword [ebp + 8], ecx
cmp dword [ebx], edx
mov ecx, ebx
je 0x454e52
cmp eax, 4
jle 0x454dd2
mov edi, dword [esp + 0x18]
dec eax
inc esi
inc edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edi
lea ecx, [ebx + esi]
jmp 0x454e46
test eax, eax
je 0x454e00
mov ecx, eax
add esi, ebx
mov edx, ecx
lea edi, [esp + 0x20]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
lea esi, [esp + 0x20]
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, 0x4e20
lea ecx, [esp + 0x10]
push 0
sub edx, eax
push ecx
mov ecx, dword [ebp + 4]
add eax, ebx
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x454e83
mov eax, dword [esp + 0x10]
test eax, eax
je 0x454e83
mov edx, dword [ebp + 8]
mov ecx, dword [esp + 0x14]
add edx, eax
xor esi, esi
add ecx, eax
mov dword [ebp + 8], edx
mov edx, dword [esp + 0x30]
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
mov ecx, ebx
cmp dword [ecx], edx
jne 0x454db9
mov edi, dword [esp + 0x2c]
cmp dword [ecx], edx
jne 0x454e83
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
push 4
add edx, eax
push ecx
mov ecx, dword [esp + 0x3c]
mov dword [edi], edx
call fcn.00423270
push ebx
call fcn.0045cfdf
add esp, 4
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0xc
push ebx
call fcn.0045cfdf
add esp, 4
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x18
ret 0xc