joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4aa7f0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov eax, dword [ebp + 4]
add eax, eax
add eax, eax
add eax, eax
cmp eax, 0x1000
push esi
push edi
jbe 0x4aa814
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push ecx
push edx
mov eax, ebp
call fcn.004aae40
xor edi, edi
cmp eax, edi
jne 0x4aa942
push 0x14
call fcn.0044ce70
mov ebx, eax
add esp, 4
cmp ebx, edi
je 0x4aa888
mov eax, dword [esi]
mov dword [ebx + 4], edi
lea esi, [ebx + 8]
mov dword [esi + 4], edi
mov dword [esi], edi
mov dword [ebx], vtable.ytEXIFMetadata.0
mov dword [ebx + 0x10], eax
mov eax, dword [ebx]
mov edx, dword [eax + 4]
mov ecx, ebx
call edx
push edi
mov edi, dword [ebp + 4]
lea edi, [edi*8 + 8]
call fcn.00469960
mov esi, eax
test esi, esi
jne 0x4aa937
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x4aa895
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [ebp]
mov esi, dword [esp + 0x18]
mov dword [eax], ecx
mov edx, dword [ebp + 4]
mov dword [eax + 4], edx
mov ebp, dword [ebp + 4]
mov edi, dword [esi + 0x10]
add ebp, ebp
add ebp, ebp
add eax, 8
add ebp, ebp
cmp dword [edi + 0x14], 0
je 0x4aa8dd
push eax
mov eax, ebp
call fcn.00469830
cmp eax, ebp
je 0x4aa920
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
mov edi, 2
call edx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x4aa8f9
push ecx
push 1
push ebp
push eax
call fcn.0052edba
add esp, 0x10
test eax, eax
je 0x4aa8f9
xor edi, edi
jmp 0x4aa909
cmp dword [edi + 4], 0
je 0x4aa906
mov edi, 2
jmp 0x4aa909
mov edi, dword [edi + 0xc]
test edi, edi
je 0x4aa920
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [esi + 0x14]
mov eax, dword [esp + 0x24]
push ebx
push ecx
push edx
call fcn.004ab6c0
mov esi, eax
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x4aa9c0
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
cmp dword [ebp + 4], 0x1000
push esi
push edi
jbe 0x4aa9db
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
push eax
push ecx
mov eax, ebp
call fcn.004aab20
xor edi, edi
cmp eax, edi
jne 0x4aab0e
push 0x14
call fcn.0044ce70
mov ebx, eax
add esp, 4
cmp ebx, edi
je 0x4aaa5d
mov eax, dword [esi]
mov dword [ebx + 4], edi
lea esi, [ebx + 8]
mov dword [esi + 4], edi
mov dword [esi], edi
mov dword [ebx + 0x10], eax
mov dword [ebx], vtable.ytEXIFMetadata.0
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
push edi
mov edi, dword [ebp + 4]
add edi, 8
call fcn.00469960
mov esi, eax
test esi, esi
je 0x4aaa4d
mov edx, dword [ebx]
mov eax, dword [edx + 8]
mov ecx, ebx
call eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x4aaa69
mov edx, dword [ebx]
mov eax, dword [edx + 8]
mov ecx, ebx
call eax
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov ecx, dword [ebp]
mov esi, dword [esp + 0x14]
mov dword [eax], ecx
mov edx, dword [ebp + 4]
mov dword [eax + 4], edx
mov edi, dword [esi + 0x10]
mov ebp, dword [ebp + 4]
add eax, 8
cmp dword [edi + 0x14], 0
je 0x4aaaaa
push eax
mov eax, ebp
call fcn.00469830
cmp eax, ebp
je 0x4aaaec
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
mov edi, 2
call edx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x4aaac6
push ecx
push 1
push ebp
push eax
call fcn.0052edba
add esp, 0x10
test eax, eax
je 0x4aaac6
xor edi, edi
jmp 0x4aaad6
cmp dword [edi + 4], 0
je 0x4aaad3
mov edi, 2
jmp 0x4aaad6
mov edi, dword [edi + 0xc]
test edi, edi
je 0x4aaaec
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [esi + 0x14]
mov eax, dword [esp + 0x24]
push ebx
push ecx
push edx
call fcn.004ab7f0
mov esi, eax
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
Function at 0x4aab90
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov eax, dword [ebp + 4]
add eax, eax
cmp eax, 0x1000
push esi
push edi
jbe 0x4aabb0
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push ecx
push edx
mov eax, ebp
call fcn.004aa620
xor edi, edi
cmp eax, edi
jne 0x4aacd7
push 0x14
call fcn.0044ce70
mov ebx, eax
add esp, 4
cmp ebx, edi
je 0x4aac21
mov eax, dword [esi]
mov dword [ebx + 4], edi
lea esi, [ebx + 8]
mov dword [esi + 4], edi
mov dword [esi], edi
mov dword [ebx], vtable.ytEXIFMetadata.0
mov dword [ebx + 0x10], eax
mov eax, dword [ebx]
mov edx, dword [eax + 4]
mov ecx, ebx
call edx
push edi
mov edi, dword [ebp + 4]
lea edi, [edi + edi + 8]
call fcn.00469960
mov esi, eax
test esi, esi
jne 0x4aaccc
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x4aac2e
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [ebp]
mov esi, dword [esp + 0x18]
mov dword [eax], ecx
mov edx, dword [ebp + 4]
mov dword [eax + 4], edx
mov ebp, dword [ebp + 4]
mov edi, dword [esi + 0x10]
add eax, 8
add ebp, ebp
cmp dword [edi + 0x14], 0
je 0x4aac72
push eax
mov eax, ebp
call fcn.00469830
cmp eax, ebp
je 0x4aacb5
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
mov edi, 2
call edx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x4aac8e
push ecx
push 1
push ebp
push eax
call fcn.0052edba
add esp, 0x10
test eax, eax
je 0x4aac8e
xor edi, edi
jmp 0x4aac9e
cmp dword [edi + 4], 0
je 0x4aac9b
mov edi, 2
jmp 0x4aac9e
mov edi, dword [edi + 0xc]
test edi, edi
je 0x4aacb5
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [esi + 0x14]
mov eax, dword [esp + 0x24]
push ebx
push ecx
push edx
call fcn.004ab7f0
mov esi, eax
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x4aace0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov eax, dword [ebp + 4]
add eax, eax
add eax, eax
add eax, eax
cmp eax, 0x1000
push esi
push edi
jbe 0x4aad04
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push ecx
push edx
mov eax, ebp
call fcn.004aae40
xor edi, edi
cmp eax, edi
jne 0x4aae32
push 0x14
call fcn.0044ce70
mov ebx, eax
add esp, 4
cmp ebx, edi
je 0x4aad78
mov eax, dword [esi]
mov dword [ebx + 4], edi
lea esi, [ebx + 8]
mov dword [esi + 4], edi
mov dword [esi], edi
mov dword [ebx], vtable.ytEXIFMetadata.0
mov dword [ebx + 0x10], eax
mov eax, dword [ebx]
mov edx, dword [eax + 4]
mov ecx, ebx
call edx
push edi
mov edi, dword [ebp + 4]
lea edi, [edi*8 + 8]
call fcn.00469960
mov esi, eax
test esi, esi
jne 0x4aae27
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x4aad85
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [ebp]
mov esi, dword [esp + 0x18]
mov dword [eax], ecx
mov edx, dword [ebp + 4]
mov dword [eax + 4], edx
mov ebp, dword [ebp + 4]
mov edi, dword [esi + 0x10]
add ebp, ebp
add ebp, ebp
add eax, 8
add ebp, ebp
cmp dword [edi + 0x14], 0
je 0x4aadcd
push eax
mov eax, ebp
call fcn.00469830
cmp eax, ebp
je 0x4aae10
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
mov edi, 2
call edx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x4aade9
push ecx
push 1
push ebp
push eax
call fcn.0052edba
add esp, 0x10
test eax, eax
je 0x4aade9
xor edi, edi
jmp 0x4aadf9
cmp dword [edi + 4], 0
je 0x4aadf6
mov edi, 2
jmp 0x4aadf9
mov edi, dword [edi + 0xc]
test edi, edi
je 0x4aae10
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [esi + 0x14]
mov eax, dword [esp + 0x24]
push ebx
push ecx
push edx
call fcn.004ab7f0
mov esi, eax
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x4aaeb0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov eax, dword [ebp + 4]
add eax, eax
add eax, eax
cmp eax, 0x1000
push esi
push edi
jbe 0x4aaed2
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push ecx
push edx
mov eax, ebp
call fcn.004aa950
xor edi, edi
cmp eax, edi
jne 0x4aaffe
push 0x14
call fcn.0044ce70
mov ebx, eax
add esp, 4
cmp ebx, edi
je 0x4aaf46
mov eax, dword [esi]
mov dword [ebx + 4], edi
lea esi, [ebx + 8]
mov dword [esi + 4], edi
mov dword [esi], edi
mov dword [ebx], vtable.ytEXIFMetadata.0
mov dword [ebx + 0x10], eax
mov eax, dword [ebx]
mov edx, dword [eax + 4]
mov ecx, ebx
call edx
push edi
mov edi, dword [ebp + 4]
lea edi, [edi*4 + 8]
call fcn.00469960
mov esi, eax
test esi, esi
jne 0x4aaff3
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x4aaf53
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [ebp]
mov esi, dword [esp + 0x18]
mov dword [eax], ecx
mov edx, dword [ebp + 4]
mov dword [eax + 4], edx
mov ebp, dword [ebp + 4]
mov edi, dword [esi + 0x10]
add ebp, ebp
add eax, 8
add ebp, ebp
cmp dword [edi + 0x14], 0
je 0x4aaf99
push eax
mov eax, ebp
call fcn.00469830
cmp eax, ebp
je 0x4aafdc
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
mov edi, 2
call edx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x4aafb5
push ecx
push 1
push ebp
push eax
call fcn.0052edba
add esp, 0x10
test eax, eax
je 0x4aafb5
xor edi, edi
jmp 0x4aafc5
cmp dword [edi + 4], 0
je 0x4aafc2
mov edi, 2
jmp 0x4aafc5
mov edi, dword [edi + 0xc]
test edi, edi
je 0x4aafdc
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [esi + 0x14]
mov eax, dword [esp + 0x24]
push ebx
push ecx
push edx
call fcn.004ab7f0
mov esi, eax
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x4ab010
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
cmp dword [ebp + 4], 0x1000
push esi
push edi
jbe 0x4ab02b
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
push eax
push ecx
mov eax, ebp
call fcn.004a9cc0
xor edi, edi
cmp eax, edi
jne 0x4ab166
push 0x14
call fcn.0044ce70
mov ebx, eax
add esp, 4
cmp ebx, edi
je 0x4ab0ad
mov eax, dword [esi]
mov dword [ebx + 4], edi
lea esi, [ebx + 8]
mov dword [esi + 4], edi
mov dword [esi], edi
mov dword [ebx + 0x10], eax
mov dword [ebx], vtable.ytEXIFMetadata.0
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
push edi
mov edi, dword [ebp + 4]
add edi, 8
call fcn.00469960
mov esi, eax
test esi, esi
je 0x4ab09d
mov edx, dword [ebx]
mov eax, dword [edx + 8]
mov ecx, ebx
call eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x4ab0b9
mov edx, dword [ebx]
mov eax, dword [edx + 8]
mov ecx, ebx
call eax
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov ecx, dword [ebp]
mov esi, dword [esp + 0x14]
mov dword [eax], ecx
mov edx, dword [ebp + 4]
mov dword [eax + 4], edx
mov edi, dword [esi + 0x10]
mov ebp, dword [ebp + 4]
add eax, 8
cmp dword [edi + 0x14], 0
je 0x4ab0fa
push eax
mov eax, ebp
call fcn.00469830
cmp eax, ebp
je 0x4ab13c
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
mov edi, 2
call edx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x4ab116
push ecx
push 1
push ebp
push eax
call fcn.0052edba
add esp, 0x10
test eax, eax
je 0x4ab116
xor edi, edi
jmp 0x4ab126
cmp dword [edi + 4], 0
je 0x4ab123
mov edi, 2
jmp 0x4ab126
mov edi, dword [edi + 0xc]
test edi, edi
je 0x4ab13c
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
mov ecx, dword [ebx + 0xc]
call fcn.0049b5a0
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [esi + 0x14]
mov eax, dword [esp + 0x24]
push ebx
push ecx
push edx
call fcn.004ab7f0
mov esi, eax
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 0x14

Function at 0x4ab170
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov eax, dword [ebp + 4]
add eax, eax
cmp eax, 0x1000
push esi
push edi
jbe 0x4ab190
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push ecx
push edx
mov eax, ebp
call fcn.004a9d50
xor edi, edi
cmp eax, edi
jne 0x4ab2bf
push 0x14
call fcn.0044ce70
mov ebx, eax
add esp, 4
cmp ebx, edi
je 0x4ab201
mov eax, dword [esi]
mov dword [ebx + 4], edi
lea esi, [ebx + 8]
mov dword [esi + 4], edi
mov dword [esi], edi
mov dword [ebx], vtable.ytEXIFMetadata.0
mov dword [ebx + 0x10], eax
mov eax, dword [ebx]
mov edx, dword [eax + 4]
mov ecx, ebx
call edx
push edi
mov edi, dword [ebp + 4]
lea edi, [edi + edi + 8]
call fcn.00469960
mov esi, eax
test esi, esi
invalid
invalid
Function at 0x4ab2d0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov eax, dword [ebp + 4]
add eax, eax
add eax, eax
cmp eax, 0x1000
push esi
push edi
jbe 0x4ab2f2
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push ecx
push edx
mov eax, ebp
call fcn.004ab430
xor edi, edi
cmp eax, edi
jne 0x4ab426
push 0x14
call fcn.0044ce70
mov ebx, eax
add esp, 4
cmp ebx, edi
je 0x4ab366
mov eax, dword [esi]
mov dword [ebx + 4], edi
lea esi, [ebx + 8]
mov dword [esi + 4], edi
mov dword [esi], edi
mov dword [ebx], vtable.ytEXIFMetadata.0
mov dword [ebx + 0x10], eax
mov eax, dword [ebx]
mov edx, dword [eax + 4]
mov ecx, ebx
call edx
push edi
mov edi, dword [ebp + 4]
lea edi, [edi*4 + 8]
call fcn.00469960
mov esi, eax
test esi, esi
jne 0x4ab41b
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x4ab373
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [ebp]
mov esi, dword [esp + 0x18]
mov dword [eax], ecx
mov edx, dword [ebp + 4]
mov dword [eax + 4], edx
mov ebp, dword [ebp + 4]
mov edi, dword [esi + 0x10]
add ebp, ebp
add eax, 8
add ebp, ebp
cmp dword [edi + 0x14], 0
je 0x4ab3b9
push eax
mov eax, ebp
call fcn.00469830
cmp eax, ebp
je 0x4ab3fc
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
mov edi, 2
call edx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x4ab3d5
push ecx
push 1
push ebp
push eax
call fcn.0052edba
add esp, 0x10
test eax, eax
je 0x4ab3d5
xor edi, edi
jmp 0x4ab3e5
cmp dword [edi + 4], 0
je 0x4ab3e2
mov edi, 2
jmp 0x4ab3e5
mov edi, dword [edi + 0xc]
test edi, edi
je 0x4ab3fc
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [ebx + 0xc]
call fcn.0049b5a0
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [esi + 0x14]
mov eax, dword [esp + 0x24]
push ebx
push ecx
push edx
call fcn.004ab7f0
mov esi, eax
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x4ab4c0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov eax, dword [ebp + 4]
add eax, eax
add eax, eax
add eax, eax
cmp eax, 0x1000
push esi
push edi
jbe 0x4ab4e4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
push ecx
push edx
mov eax, ebp
call fcn.004ab630
xor edi, edi
cmp eax, edi
jne 0x4ab61a
push 0x14
call fcn.0044ce70
mov ebx, eax
add esp, 4
cmp ebx, edi
je 0x4ab558
mov eax, dword [esi]
mov dword [ebx + 4], edi
lea esi, [ebx + 8]
mov dword [esi + 4], edi
mov dword [esi], edi
mov dword [ebx], vtable.ytEXIFMetadata.0
mov dword [ebx + 0x10], eax
mov eax, dword [ebx]
mov edx, dword [eax + 4]
mov ecx, ebx
call edx
push edi
mov edi, dword [ebp + 4]
lea edi, [edi*8 + 8]
call fcn.00469960
mov esi, eax
test esi, esi
jne 0x4ab60f
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x4ab565
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [ebp]
mov esi, dword [esp + 0x18]
mov dword [eax], ecx
mov edx, dword [ebp + 4]
mov dword [eax + 4], edx
mov ebp, dword [ebp + 4]
mov edi, dword [esi + 0x10]
add ebp, ebp
add ebp, ebp
add eax, 8
add ebp, ebp
cmp dword [edi + 0x14], 0
je 0x4ab5ad
push eax
mov eax, ebp
call fcn.00469830
cmp eax, ebp
je 0x4ab5f0
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
mov edi, 2
call edx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x4ab5c9
push ecx
push 1
push ebp
push eax
call fcn.0052edba
add esp, 0x10
test eax, eax
je 0x4ab5c9
xor edi, edi
jmp 0x4ab5d9
cmp dword [edi + 4], 0
je 0x4ab5d6
mov edi, 2
jmp 0x4ab5d9
mov edi, dword [edi + 0xc]
test edi, edi
je 0x4ab5f0
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ecx, dword [ebx + 0xc]
call fcn.0049b5a0
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [esi + 0x14]
mov eax, dword [esp + 0x24]
push ebx
push ecx
push edx
call fcn.004ab7f0
mov esi, eax
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x4b4f90
Capabilities:
Encode data using xor

Disassembly:
mov cl, byte [edx]
xor eax, eax
test cl, cl
je 0x4b4fb4
jmp 0x4b4fa0
imul eax, eax, 0xf4243
movzx ecx, cl
add edx, 1
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x4b4fa0
ret
Function at 0x4c2850
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, eax
cmp dword [esi + 0x14], 0xca
jne 0x4c28a1
mov eax, dword [esi + 4]
mov ecx, dword [eax]
push 0x1c
push 1
push esi
call ecx
mov dword [esi + 0x188], eax
mov dword [eax], 0x4c6120
mov dword [eax + 4], 0x4c6280
mov byte [eax + 8], 0
add esp, 0xc
mov eax, esi
call fcn.004c5f60
cmp byte [esi + 0x48], 0
je 0x4c289a
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x4c291f
mov edx, dword [esi + 0x198]
cmp byte [edx + 0x10], 0
je 0x4c290c
mov eax, dword [esi + 8]
test eax, eax
je 0x4c28c6
mov eax, dword [eax]
push esi
call eax
add esp, 4
mov ecx, dword [esi + 0x198]
mov edx, dword [ecx]
push esi
call edx
add esp, 4
test eax, eax
je 0x4c2908
cmp eax, 2
je 0x4c290c
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4c28b7
cmp eax, 3
je 0x4c28ee
cmp eax, 1
jne 0x4c28b7
add dword [ecx + 4], 1
mov eax, dword [esi + 8]
mov ecx, dword [eax + 4]
cmp ecx, dword [eax + 8]
jl 0x4c28b7
mov edx, dword [esi + 0x124]
add dword [eax + 8], edx
jmp 0x4c28b7
xor al, al
pop esi
mov eax, dword [esi + 0x84]
mov dword [esi + 0x8c], eax
call fcn.004c2950
pop esi
ret
cmp eax, 0xcc
je 0x4c2941
mov ecx, dword [esi]
mov dword [ecx + 0x14], 0x16
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call edx
add esp, 4
call fcn.004c2950
pop esi
ret
Function at 0x4c7780
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x18
push esi
push edi
mov edi, dword [esp + 0x24]
cmp dword [edi + 0x54], 1
mov esi, dword [edi + 0x1b0]
mov dword [esp + 0x18], esi
jne 0x4c77a7
mov dword [esp + 8], 0x1fe
mov byte [esi + 0x1c], 1
jmp 0x4c77b3
mov dword [esp + 8], 0
mov byte [esi + 0x1c], 0
mov ecx, dword [edi + 0x6c]
mov edx, dword [esp + 8]
mov eax, dword [edi + 4]
mov eax, dword [eax + 8]
push ecx
add edx, 0x100
push edx
push 1
push edi
call eax
xor ecx, ecx
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x14]
add esp, 0x10
cmp dword [edi + 0x6c], ecx
mov dword [esp + 0x14], ecx
jle 0x4c78dc
push ebx
lea edx, [esi + 0x20]
push ebp
mov dword [esp + 0x14], edx
jmp 0x4c77f8
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
mov edi, dword [edx]
cdq
idiv edi
cmp dword [esp + 0x10], 0
mov dword [esp + 0x18], eax
je 0x4c7819
mov eax, dword [esi + 0x18]
add dword [eax + ecx*4], 0xff
lea eax, [eax + ecx*4]
mov edx, dword [esi + 0x18]
mov ebp, dword [edx + ecx*4]
lea eax, [edi + 0xfe]
lea esi, [edi + edi - 2]
cdq
idiv esi
xor ebx, ebx
mov dword [esp + 0x24], ebp
xor esi, esi
mov edx, eax
cmp esi, edx
jle 0x4c7871
mov ecx, ebx
lea ebp, [edi + edi - 2]
imul ecx, ecx, 0x1fe
jmp 0x4c7850
add ecx, 0x1fe
lea eax, [ecx + edi + 0xfe]
cdq
idiv ebp
add ebx, 1
mov edx, eax
cmp esi, edx
jg 0x4c7850
mov ecx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x24]
mov al, byte [esp + 0x18]
imul bl
mov byte [esi + ebp], al
add esi, 1
cmp esi, 0xff
jle 0x4c7836
cmp dword [esp + 0x10], 0
je 0x4c78c1
mov eax, 1
lea edx, [ebp - 1]
jmp 0x4c78a0
movzx ebx, byte [ebp]
mov byte [edx], bl
movzx ebx, byte [ebp + 0xff]
mov byte [eax + ebp + 0xff], bl
add eax, 1
sub edx, 1
cmp eax, 0xff
jle 0x4c78a0
mov eax, dword [esp + 0x2c]
add dword [esp + 0x14], 4
add ecx, 1
cmp ecx, dword [eax + 0x6c]
mov dword [esp + 0x1c], ecx
jl 0x4c77f0
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x18