joyce8/EMBER2024-capa huggingface dataset:
Function at 0x492f43
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d22c1
mov eax, dword fs:[0]
push eax
mov eax, 0x10e8
call fcn.00506f00
mov eax, dword [0x67e2d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x894], ebx
call fcn.0041279d
push eax
lea ecx, [ebp - 0x874]
call fcn.00411d94
and dword [ebp - 4], 0
lea esi, [ebx + 0x30]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebx + 0x2c], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push dword [ebx + 0x58]
lea eax, [ebp - 0x874]
push dword [ebx + 0x54]
push str.https:__my.ruanmei.com_getuserinfo.aspx_u_sp_sr_dc6
push eax
call fcn.00412690
add esp, 0x14
mov byte [ebx + 0x2c], 0
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
push eax
push eax
push eax
push 1
mov edi, eax
mov dword [ebp - 0x878], eax
push eax
mov dword [ebp - 0x880], edi
call dword [sym.imp.WININET.dll_InternetOpenW]
mov ebx, dword [ebp - 0x874]
mov esi, eax
mov dword [ebp - 0x890], esi
test esi, esi
je 0x493130
and dword [ebp - 0x884], edi
lea eax, [ebp - 0x884]
push 4
push eax
push 2
push esi
call dword [sym.imp.WININET.dll_InternetSetOptionW]
xor eax, eax
push eax
push 0x102
push eax
push eax
push ebx
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov dword [ebp - 0x87c], eax
test eax, eax
je 0x4930cf
push 0x100000
call fcn.00506f2d
mov esi, eax
mov dword [esp], 0x100000
push edi
push esi
mov dword [ebp - 0x88c], esi
call fcn.0056b050
add esp, 0xc
lea eax, [ebp - 0x878]
push eax
push 0x100000
push esi
push dword [ebp - 0x87c]
call dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [ebp - 0x878]
mov dword [ebp - 0x888], eax
test eax, eax
je 0x4930b2
lea esi, [eax + 1]
push esi
call fcn.00506f2d
push esi
mov edi, eax
push 0
push edi
mov dword [ebp - 0x880], edi
call fcn.0056b050
push dword [ebp - 0x888]
mov esi, dword [ebp - 0x88c]
push esi
push edi
call fcn.0056a550
add esp, 0x1c
test esi, esi
je 0x4930bd
push esi
call fcn.00506f36
pop ecx
push dword [ebp - 0x87c]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov esi, dword [ebp - 0x890]
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
test edi, edi
je 0x493130
cmp byte [edi], 0
je 0x493130
lea eax, [ebp - 0x10f4]
push edi
push eax
call fcn.004c7440
mov esi, eax
lea edi, [ebp - 0x870]
mov eax, dword [ebp - 0x894]
pop ecx
pop ecx
mov ecx, 0x218
push dword [eax + 0x58]
lea eax, [ebp - 0x468]
rep movsd dword es:[edi], dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x870]
mov ecx, 0x6833d0
push eax
call fcn.004db6cc
push dword [ebp - 0x880]
call fcn.00506f36
pop ecx
lea ecx, [ebx - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00506d7f
mov esp, ebp
pop ebp
ret
Function at 0x49336c
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x814
mov eax, 0x5d234d
call fcn.00506dfb
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x818]
push eax
mov eax, dword [ecx + 4]
or eax, 0x20019
push eax
push 0
push dword [ecx + 0x10]
push dword [ecx + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4933a7
xor eax, eax
jmp 0x49345d
xor edi, edi
call fcn.0041279d
push eax
lea ecx, [ebp - 0x820]
call fcn.00411d94
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea eax, [ebp - 0x814]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push eax
lea eax, [ebp - 0x810]
mov dword [ebp - 4], ecx
push eax
push ecx
jmp 0x493426
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x81c]
call fcn.00413f09
lea eax, [ebp - 0x81c]
mov byte [ebp - 4], 1
push eax
mov ecx, ebx
call fcn.0042e1b5
mov ecx, dword [ebp - 0x81c]
mov byte [ebp - 4], 0
lea ecx, [ecx - 0x10]
call fcn.00412ac4
inc edi
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x810]
push eax
push edi
push dword [ebp - 0x818]
mov dword [ebp - 0x814], 0x400
call esi
test eax, eax
je 0x4933da
push dword [ebp - 0x818]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x820]
neg eax
sbb esi, esi
add ecx, 0xfffffff0
call fcn.00412ac4
lea eax, [esi + 1]
call fcn.00506da5
ret 4
Function at 0x4937c5
Capabilities:
Create http request
Reference http user-agent string

Disassembly:
push 0x828
mov eax, 0x5d2397
call fcn.00506e69
mov esi, dword [ebp + 8]
xor ebx, ebx
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x834], esi
mov dword [ebp - 0x824], ebx
call fcn.0041279d
push eax
mov ecx, esi
call fcn.00411d94
xor eax, eax
mov dword [ebp - 0x828], 0x400
inc eax
push 0x802
mov dword [ebp - 0x824], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x818]
push ebx
push eax
call fcn.0056b050
add esp, 0xc
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x818]
push eax
push ebx
call sub.urlmon.dll_ObtainUserAgentString
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x818]
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov ebx, eax
mov dword [ebp - 0x830], ebx
test ebx, ebx
je 0x493951
push 0
push 0
push 2
push ebx
call dword [sym.imp.WININET.dll_InternetSetOptionW]
push 0
push 0x84080000
push 0x600fd8
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push 0x600fd8
push edi
push ebx
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov edi, eax
mov dword [ebp - 0x82c], edi
test edi, edi
je 0x493948
xor ecx, ecx
lea eax, [ebp - 0x81c]
push ecx
push eax
push ecx
push 0xb
push edi
mov dword [ebp - 0x81c], ecx
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
jne 0x493919
mov eax, dword [ebp - 0x81c]
test eax, eax
je 0x493919
add eax, 2
push eax
call fcn.0059b115
mov ecx, eax
mov eax, dword [ebp - 0x81c]
add eax, 2
mov dword [ebp - 0x820], ecx
push eax
push 0
push ecx
call fcn.0056b050
add esp, 0x10
lea eax, [ebp - 0x81c]
push 0
push eax
push dword [ebp - 0x820]
push 0xb
push edi
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
mov eax, dword [ebp - 0x820]
test eax, eax
je 0x493919
push eax
mov ecx, esi
call fcn.0041421f
push dword [ebp - 0x820]
call fcn.00576006
pop ecx
push edi
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call edi
jmp 0x49394e
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebx
call edi
mov eax, esi
call fcn.00506db6
ret
Function at 0x494851
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
xor esi, esi
inc esi
cmp eax, esi
jne 0x494881
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], esi
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push esi
call fcn.004adb91
cmp dword [ebp + 0xc], 0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
je 0x4948da
mov eax, esi
jmp 0x4948dc
cmp eax, 0x4a
jne 0x49489c
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], esi
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x4a
call fcn.004ad933
jmp 0x494872
mov edx, 0x113
cmp eax, edx
jne 0x4948ba
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], esi
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edx
call fcn.004bca1e
jmp 0x494872
cmp eax, 0x81b
jne 0x4948e1
xor esi, esi
push esi
push esi
push ecx
push 0x461df0
push esi
push esi
call fcn.005a2a64
mov eax, dword [ebp + 0x18]
add esp, 0x18
mov dword [eax], esi
xor eax, eax
pop esi
pop ebp
ret 0x14
mov edx, 0x81e
cmp eax, edx
jne 0x494902
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], esi
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edx
call fcn.004b23e1
jmp 0x494872
cmp eax, 0x81f
jne 0x494916
call fcn.004a68fd
mov eax, dword [ebp + 0x18]
and dword [eax], 0
jmp 0x4948da
cmp eax, 0x81d
jne 0x494924
call fcn.004ebe42
jmp 0x49490e
mov edx, 0x81c
cmp eax, edx
jne 0x494945
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], esi
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edx
call fcn.004bf920
jmp 0x494872
mov edx, 0x822
cmp eax, edx
jne 0x4948da
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], esi
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edx
call fcn.004bfad9
jmp 0x494872

Function at 0x494a59
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
cmp edi, 0x100
jne 0x494a87
cmp eax, 0x1b
jne 0x494a7f
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 0x18]
and dword [eax], 0
jmp 0x494afe
mov edx, 0x113
cmp edi, edx
jne 0x494ab5
lea ecx, [ebp + 0xc]
xor esi, esi
push ecx
push dword [ebp + 0x14]
inc esi
mov ecx, ebx
push eax
push edx
mov dword [ebp + 0xc], esi
call fcn.004bca5d
cmp dword [ebp + 0xc], 0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
je 0x494afc
mov eax, esi
jmp 0x494b16
mov edx, 0x819
cmp edi, edx
jne 0x494ad6
lea ecx, [ebp + 0xc]
xor esi, esi
push ecx
push dword [ebp + 0x14]
inc esi
mov ecx, ebx
push eax
push edx
mov dword [ebp + 0xc], esi
call fcn.004b70e2
jmp 0x494aa6
mov edx, 0x81a
cmp edi, edx
jne 0x494af7
lea ecx, [ebp + 0xc]
xor esi, esi
push ecx
push dword [ebp + 0x14]
inc esi
mov ecx, ebx
push eax
push edx
mov dword [ebp + 0xc], esi
call fcn.004b7110
jmp 0x494aa6
mov eax, dword [ebp + 0x18]
jmp 0x494afe
mov eax, ecx
push eax
push dword [ebp + 0x14]
mov ecx, ebx
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call fcn.00495115
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x495be8
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 1
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, dword [ebp + 0xc]
mov esi, eax
cmp esi, 0xffffffff
je 0x495c86
lea eax, [ebp - 0xc]
mov dword [ebp - 4], ebx
push eax
push esi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x495c76
and dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
push eax
push 0
push ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
push 0
push dword [ebp + 0xc]
call fcn.0043ac7c
mov dword [edi], eax
mov eax, dword [ebp + 0xc]
pop ecx
pop ecx
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
xor eax, eax
cmp dword [edi], ebx
pop edi
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49b3c0
Capabilities:
Check if file exists

Disassembly:
push 0x29c
mov eax, 0x5d3288
call fcn.00506dfb
lea ecx, [ebp - 0x2a8]
call fcn.0042ca82
xor edi, edi
mov dword [ebp - 4], edi
call fcn.0041279d
push eax
lea ecx, [ebp - 0x288]
call fcn.00411d94
push ecx
xor ebx, ebx
mov dword [ebp - 0x28c], esp
mov ecx, esp
inc ebx
push str.config_softmasteruserinfo.cfg
mov byte [ebp - 4], bl
call fcn.00413f09
push ecx
push esp
lea ecx, [ebp - 0x2a8]
mov byte [ebp - 4], 2
call fcn.0043944c
lea eax, [ebp - 0x284]
mov byte [ebp - 4], bl
push eax
lea ecx, [ebp - 0x2a8]
call fcn.00434114
push eax
lea ecx, [ebp - 0x288]
mov byte [ebp - 4], 3
call fcn.00411f3a
mov ecx, dword [ebp - 0x284]
mov byte [ebp - 4], bl
lea ecx, [ecx - 0x10]
call fcn.00412ac4
mov esi, dword [ebp - 0x288]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x49b534
push edi
push ebx
push str.UserInfo
push str.config_softmasteruserinfo.cfg
lea ecx, [ebp - 0x280]
call fcn.00451616
push edi
push 0x61aa5c
push str.Login
lea ecx, [ebp - 0x280]
mov byte [ebp - 4], 4
call fcn.004802a6
test eax, eax
je 0x49b529
push 0x61aa58
push str.Login
lea eax, [ebp - 0x284]
push eax
lea ecx, [ebp - 0x280]
call fcn.0048f0f8
push 0x60de38
push str.Login
lea eax, [ebp - 0x28c]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x280]
call fcn.0048f0f8
mov eax, dword [ebp - 0x284]
cmp dword [eax - 0xc], edi
mov eax, dword [ebp - 0x28c]
je 0x49b513
cmp dword [eax - 0xc], edi
je 0x49b513
lea ecx, [eax - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x284]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
lea ecx, [ebp - 0x280]
call fcn.00456baa
jmp 0x49b536
lea ecx, [eax - 0x10]
call fcn.00412ac4
mov ecx, dword [ebp - 0x284]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
lea ecx, [ebp - 0x280]
call fcn.00456baa
mov ebx, edi
lea ecx, [esi - 0x10]
call fcn.00412ac4
lea ecx, [ebp - 0x2a8]
call fcn.0042e60b
mov ecx, dword [ebp - 0x298]
add ecx, 0xfffffff0
call fcn.00412ac4
mov eax, ebx
call fcn.00506da5
ret
Function at 0x49bab6
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d340c
mov eax, dword fs:[0]
push eax
mov eax, 0x1024
call fcn.00506f00
mov eax, dword [0x67e2d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x1014]
push 5
push eax
lea ecx, [ebp + 8]
call fcn.00434d0c
push str.theme
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0042e69b
mov ecx, dword [ebp - 0x1014]
mov ebx, eax
neg ebx
mov byte [ebp - 4], 0
sbb bl, bl
lea ecx, [ecx - 0x10]
call fcn.00412ac4
add bl, 1
je 0x49bcb7
lea ecx, [ebp - 0x1030]
call fcn.0042ca82
push 0x1000
xor ebx, ebx
mov byte [ebp - 4], 2
lea eax, [ebp - 0x1010]
push ebx
push eax
call fcn.0056b050
add esp, 0xc
lea eax, [ebp - 0x1010]
push dword [ebp + 8]
push 0x800
push eax
push 0x5f1b30
push 0x6191fc
push str.VisualStyles
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x1010]
push eax
lea ecx, [ebp - 0x1014]
call fcn.00413f09
lea ecx, [ebp - 0x1014]
mov byte [ebp - 4], 3
call fcn.0043193c
push ecx
mov esi, esp
mov dword [ebp - 0x1018], esi
mov eax, dword [ebp - 0x1014]
add eax, 0xfffffff0
push eax
call fcn.00412393
add eax, 0x10
pop ecx
mov dword [esi], eax
lea ecx, [ebp - 0x1030]
lea eax, [ebp - 0x1018]
push eax
call fcn.004cd49a
push eax
lea ecx, [ebp - 0x1014]
mov byte [ebp - 4], 4
call fcn.00411f3a
mov ecx, dword [ebp - 0x1018]
add ecx, 0xfffffff0
mov byte [ebp - 4], 3
call fcn.00412ac4
push ecx
mov ecx, esp
push str._WinDir_Resources
call fcn.00413f09
lea eax, [ebp - 0x1018]
push eax
lea ecx, [ebp - 0x1030]
call fcn.004cd49a
push dword [eax]
lea ecx, [ebp - 0x1014]
mov byte [ebp - 4], 5
push str._resourcedir_
call fcn.00434b1c
mov ecx, dword [ebp - 0x1018]
mov byte [ebp - 4], 3
lea ecx, [ecx - 0x10]
call fcn.00412ac4
lea ecx, [ebp - 0x1014]
call fcn.0043193c
call fcn.0042fb20
cmp eax, 0x13
mov eax, dword [ebp - 0x1014]
jl 0x49bc92
cmp dword [eax - 0xc], ebx
je 0x49bc66
push ebx
push str._resources_themes_aero_aero.msstyles
lea ecx, [ebp - 0x1014]
call fcn.0042ea61
test eax, eax
js 0x49bc69
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 0x1014]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
lea ecx, [ebp - 0x1030]
call fcn.0042e60b
mov ecx, dword [ebp - 0x1020]
lea ecx, [ecx - 0x10]
call fcn.00412ac4
jmp 0x49bcb9
cmp dword [eax - 0xc], ebx
je 0x49bc66
push ebx
push str._resources_themeslunaluna.msstyles
lea ecx, [ebp - 0x1014]
call fcn.0042ea61
xor edx, edx
inc edx
movzx ebx, dl
xor edx, edx
test eax, eax
cmovs ebx, edx
jmp 0x49bc69
xor bl, bl
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00412ac4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00506d7f
mov esp, ebp
pop ebp
ret 4
Function at 0x49bf58
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x67e2d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor esi, esi
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x49bfdd
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebp - 0x228], ebx
je 0x49bfb3
lea eax, [ebp - 0x230]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x49bf98
jmp 0x49bfdc
call fcn.0042fb20
cmp eax, 0xd
je 0x49bfc7
call fcn.0042fb20
cmp eax, 0xe
jne 0x49bfd9
push str.conime.exe
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
xor esi, esi
inc esi
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00506d7f
mov esp, ebp
pop ebp
ret 4

Function at 0x49d250
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x67e2d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x40
push 0x617ef4
push dword [ebp + 8]
call fcn.0058832a
mov esi, eax
add esp, 0xc
test esi, esi
je 0x49d2bc
push esi
push 1
lea eax, [ebp - 0x58]
push 0x40
push eax
call fcn.005885cb
mov eax, dword [ebp - 0x1c]
push 0
add eax, 4
push eax
push esi
call fcn.00597a35
push esi
push 1
lea eax, [ebp - 0x18]
push 0x14
push eax
call fcn.005885cb
push esi
call fcn.00587fe2
mov eax, 0x14c
add esp, 0x30
cmp word [ebp - 0x18], ax
setne bl
jmp 0x49d2be
xor bl, bl
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00412ac4
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.00506d7f
mov esp, ebp
pop ebp
ret 4
Function at 0x4a1891
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push 0x10
mov eax, 0x5d39d6
call fcn.00506dc7
mov ebx, ecx
xor edi, edi
cmp dword [ebp + 8], edi
je 0x4a18c9
push edi
push dword [ebp + 8]
call fcn.004ecfb5
mov esi, eax
lea ecx, [ebx + 4]
push esi
push ecx
call fcn.0059b460
add esp, 0x10
test esi, esi
je 0x4a18c9
push esi
call fcn.00506f36
pop ecx
lea esi, [ebx + 4]
mov dword [ebx + 0x20c], edi
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4a1983
push edi
cmp dword [ebx + 0x22c], edi
je 0x4a196f
push edi
push 3
push edi
push 7
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x4a1968
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], edi
push ecx
push eax
mov dword [ebp - 0x18], edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push dword [ebp - 0x1c]
call fcn.00506f2d
mov esi, eax
mov dword [ebp - 0x14], esi
push dword [ebp - 0x1c]
mov dword [ebp - 4], edi
push edi
push esi
call fcn.0056b050
add esp, 0x10
mov dword [ebp - 0x10], edi
lea eax, [ebp - 0x10]
push edi
push eax
push dword [ebp - 0x1c]
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push dword [ebp - 0x1c]
mov ecx, ebx
push esi
call fcn.004c326b
lea ecx, [ebp - 0x14]
call fcn.00455b9d
xor eax, eax
jmp 0x4a1a06
mov ecx, dword [ebx + 0x210]
push esi
call fcn.004161e1
movzx eax, al
jmp 0x4a1a06
push 0x38
call fcn.00506ecd
pop ecx
mov dword [ebp + 8], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x4a19b1
push 0x60cf70
push str.UTF_16
push 0x60cf7c
mov ecx, eax
call fcn.00414d0c
jmp 0x4a19b3
mov eax, edi
mov ecx, dword [ebx + 0x210]
or dword [ebp - 4], 0xffffffff
push eax
call fcn.00415fc1
push 0x50
call fcn.00506ecd
pop ecx
mov dword [ebp + 8], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x4a19e9
lea ecx, [ebx + 0x108]
push ecx
mov ecx, eax
call fcn.00414f74
mov edi, eax
mov ecx, dword [ebx + 0x210]
or dword [ebp - 4], 0xffffffff
push edi
call fcn.00415fc1
mov ecx, dword [ebx + 0x210]
xor eax, eax
inc eax
mov byte [ecx + 0x45], 1
call fcn.00506d90
ret 4
Function at 0x4a1dbf
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push 0x10
mov eax, 0x5d3a88
call fcn.00506dc7
mov ebx, ecx
xor edi, edi
cmp dword [ebp + 8], edi
je 0x4a1df7
push edi
push dword [ebp + 8]
call fcn.004ecfb5
mov esi, eax
lea ecx, [ebx + 4]
push esi
push ecx
call fcn.0059b460
add esp, 0x10
test esi, esi
je 0x4a1df7
push esi
call fcn.00506f36
pop ecx
lea esi, [ebx + 4]
mov dword [ebx + 0x20c], edi
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x4a1eb1
push edi
cmp dword [ebx + 0x22c], edi
je 0x4a1e9d
push edi
push 3
push edi
push 7
push SysReAllocString
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x4a1e96
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], edi
push ecx
push eax
mov dword [ebp - 0x18], edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push dword [ebp - 0x1c]
call fcn.00506f2d
mov esi, eax
mov dword [ebp - 0x14], esi
push dword [ebp - 0x1c]
mov dword [ebp - 4], edi
push edi
push esi
call fcn.0056b050
add esp, 0x10
mov dword [ebp - 0x10], edi
lea eax, [ebp - 0x10]
push edi
push eax
push dword [ebp - 0x1c]
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push dword [ebp - 0x1c]
mov ecx, ebx
push esi
call fcn.004c326b
lea ecx, [ebp - 0x14]
call fcn.00455b9d
xor eax, eax
jmp 0x4a1f34
mov ecx, dword [ebx + 0x210]
push esi
call fcn.004161e1
movzx eax, al
jmp 0x4a1f34
push 0x38
call fcn.00506ecd
pop ecx
mov dword [ebp + 8], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x4a1edf
push 0x60cf70
push str.UTF_16
push 0x60cf7c
mov ecx, eax
call fcn.00414d0c
jmp 0x4a1ee1
mov eax, edi
mov ecx, dword [ebx + 0x210]
or dword [ebp - 4], 0xffffffff
push eax
call fcn.00415fc1
push 0x50
call fcn.00506ecd
pop ecx
mov dword [ebp + 8], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x4a1f17
lea ecx, [ebx + 0x108]
push ecx
mov ecx, eax
call fcn.00414f74
mov edi, eax
mov ecx, dword [ebx + 0x210]
or dword [ebp - 4], 0xffffffff
push edi
call fcn.00415fc1
mov ecx, dword [ebx + 0x210]
xor eax, eax
inc eax
mov byte [ecx + 0x45], 1
call fcn.00506d90
ret 4