joyce8/EMBER2024-capa huggingface dataset:
Function at 0x750100
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
dec eax
push esi
cmp eax, 8
push edi
ja case.default.0x750112
jmp dword [eax*4 + 0x750308]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 1
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 2
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 4
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov eax, dword [esp + 0x14]
push ebp
lea ecx, [esp + 0x1c]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, 0x870c08
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
mov ecx, ebx
push ebp
call fcn.00401b40
test al, al
je 0x7501ef
mov edi, dword [ebx + 4]
mov ecx, ebp
mov edx, ecx
mov esi, 0x870c08
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 4]
mov dword [ebx + 8], ebp
mov byte [eax + ebp], 0
mov esi, dword [esp + 0x10]
pop ebp
test esi, esi
jle 0x7502f0
cmp esi, 0xffffffff
jne 0x750206
call fcn.007a02eb
mov ecx, ebx
call fcn.00405090
cmp eax, esi
jae 0x750216
call fcn.007a02eb
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x75023b
mov al, byte [ecx - 1]
test al, al
je 0x75023b
cmp al, 0xff
je 0x75023b
test esi, esi
jne 0x75025f
dec al
push esi
mov byte [ecx - 1], al
mov ecx, ebx
call fcn.00404e60
jmp 0x750289
test esi, esi
jne 0x75024a
push 1
mov ecx, ebx
call fcn.00404e60
jmp 0x750289
mov eax, dword [ebx + 0xc]
cmp eax, 0x1f
ja 0x750256
cmp eax, esi
jae 0x750267
push 1
mov ecx, ebx
call fcn.00404e60
push esi
mov ecx, ebx
call fcn.00401c60
mov edi, dword [ebx + 4]
mov ecx, esi
mov edx, ecx
mov eax, 0x20202020
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx + 4]
mov dword [ebx + 8], esi
mov byte [eax + esi], 0
mov eax, dword [ebx + 4]
test eax, eax
je 0x7502b8
mov al, byte [eax - 1]
test al, al
je 0x7502a8
cmp al, 0xff
je 0x7502a8
mov ecx, dword [ebx + 8]
push 0
push ecx
mov ecx, ebx
call fcn.00401b40
mov eax, dword [ebx + 4]
test eax, eax
je 0x7502b3
mov byte [eax - 1], 0xff
mov ebx, dword [ebx + 4]
jmp 0x7502bd
mov ebx, 0x7e5658
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push 0
push edx
push eax
push ebx
jmp 0x7502e5
lea edx, [esp + 0x18]
push 0
push edx
push 4
jmp 0x7502e0
lea edx, [esp + 0x18]
push 0
push edx
push 8
mov eax, dword [esp + 0x28]
push eax
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
Function at 0x750580
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
dec eax
push esi
cmp eax, 8
push edi
ja case.default.0x750592
jmp dword [eax*4 + 0x750788]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 1
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 2
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 4
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov eax, dword [esp + 0x14]
push ebp
lea ecx, [esp + 0x1c]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, 0x870c08
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
mov ecx, ebx
push ebp
call fcn.00401b40
test al, al
je 0x75066f
mov edi, dword [ebx + 4]
mov ecx, ebp
mov edx, ecx
mov esi, 0x870c08
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 4]
mov dword [ebx + 8], ebp
mov byte [eax + ebp], 0
mov esi, dword [esp + 0x10]
pop ebp
test esi, esi
jle 0x750770
cmp esi, 0xffffffff
jne 0x750686
call fcn.007a02eb
mov ecx, ebx
call fcn.00405090
cmp eax, esi
jae 0x750696
call fcn.007a02eb
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x7506bb
mov al, byte [ecx - 1]
test al, al
je 0x7506bb
cmp al, 0xff
je 0x7506bb
test esi, esi
jne 0x7506df
dec al
push esi
mov byte [ecx - 1], al
mov ecx, ebx
call fcn.00404e60
jmp 0x750709
test esi, esi
jne 0x7506ca
push 1
mov ecx, ebx
call fcn.00404e60
jmp 0x750709
mov eax, dword [ebx + 0xc]
cmp eax, 0x1f
ja 0x7506d6
cmp eax, esi
jae 0x7506e7
push 1
mov ecx, ebx
call fcn.00404e60
push esi
mov ecx, ebx
call fcn.00401c60
mov edi, dword [ebx + 4]
mov ecx, esi
mov edx, ecx
mov eax, 0x20202020
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx + 4]
mov dword [ebx + 8], esi
mov byte [eax + esi], 0
mov eax, dword [ebx + 4]
test eax, eax
je 0x750738
mov al, byte [eax - 1]
test al, al
je 0x750728
cmp al, 0xff
je 0x750728
mov ecx, dword [ebx + 8]
push 0
push ecx
mov ecx, ebx
call fcn.00401b40
mov eax, dword [ebx + 4]
test eax, eax
je 0x750733
mov byte [eax - 1], 0xff
mov ebx, dword [ebx + 4]
jmp 0x75073d
mov ebx, 0x7e5658
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push 0
push edx
push eax
push ebx
jmp 0x750765
lea edx, [esp + 0x18]
push 0
push edx
push 4
jmp 0x750760
lea edx, [esp + 0x18]
push 0
push edx
push 8
mov eax, dword [esp + 0x28]
push eax
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
Function at 0x750a00
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
dec eax
push esi
cmp eax, 8
push edi
ja case.default.0x750a12
jmp dword [eax*4 + 0x750c08]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 1
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 2
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 4
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov eax, dword [esp + 0x14]
push ebp
lea ecx, [esp + 0x1c]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, 0x870c08
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
mov ecx, ebx
push ebp
call fcn.00401b40
test al, al
je 0x750aef
mov edi, dword [ebx + 4]
mov ecx, ebp
mov edx, ecx
mov esi, 0x870c08
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 4]
mov dword [ebx + 8], ebp
mov byte [eax + ebp], 0
mov esi, dword [esp + 0x10]
pop ebp
test esi, esi
jle 0x750bf0
cmp esi, 0xffffffff
jne 0x750b06
call fcn.007a02eb
mov ecx, ebx
call fcn.00405090
cmp eax, esi
jae 0x750b16
call fcn.007a02eb
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x750b3b
mov al, byte [ecx - 1]
test al, al
je 0x750b3b
cmp al, 0xff
je 0x750b3b
test esi, esi
jne 0x750b5f
dec al
push esi
mov byte [ecx - 1], al
mov ecx, ebx
call fcn.00404e60
jmp 0x750b89
test esi, esi
jne 0x750b4a
push 1
mov ecx, ebx
call fcn.00404e60
jmp 0x750b89
mov eax, dword [ebx + 0xc]
cmp eax, 0x1f
ja 0x750b56
cmp eax, esi
jae 0x750b67
push 1
mov ecx, ebx
call fcn.00404e60
push esi
mov ecx, ebx
call fcn.00401c60
mov edi, dword [ebx + 4]
mov ecx, esi
mov edx, ecx
mov eax, 0x20202020
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx + 4]
mov dword [ebx + 8], esi
mov byte [eax + esi], 0
mov eax, dword [ebx + 4]
test eax, eax
je 0x750bb8
mov al, byte [eax - 1]
test al, al
je 0x750ba8
cmp al, 0xff
je 0x750ba8
mov ecx, dword [ebx + 8]
push 0
push ecx
mov ecx, ebx
call fcn.00401b40
mov eax, dword [ebx + 4]
test eax, eax
je 0x750bb3
mov byte [eax - 1], 0xff
mov ebx, dword [ebx + 4]
jmp 0x750bbd
mov ebx, 0x7e5658
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push 0
push edx
push eax
push ebx
jmp 0x750be5
lea edx, [esp + 0x18]
push 0
push edx
push 4
jmp 0x750be0
lea edx, [esp + 0x18]
push 0
push edx
push 8
mov eax, dword [esp + 0x28]
push eax
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
Function at 0x750e80
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
dec eax
push esi
cmp eax, 8
push edi
ja case.default.0x750e92
jmp dword [eax*4 + 0x751088]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 1
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 2
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 4
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov eax, dword [esp + 0x14]
push ebp
lea ecx, [esp + 0x1c]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, 0x870c08
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
mov ecx, ebx
push ebp
call fcn.00401b40
test al, al
je 0x750f6f
mov edi, dword [ebx + 4]
mov ecx, ebp
mov edx, ecx
mov esi, 0x870c08
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 4]
mov dword [ebx + 8], ebp
mov byte [eax + ebp], 0
mov esi, dword [esp + 0x10]
pop ebp
test esi, esi
jle 0x751070
cmp esi, 0xffffffff
jne 0x750f86
call fcn.007a02eb
mov ecx, ebx
call fcn.00405090
cmp eax, esi
jae 0x750f96
call fcn.007a02eb
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x750fbb
mov al, byte [ecx - 1]
test al, al
je 0x750fbb
cmp al, 0xff
je 0x750fbb
test esi, esi
jne 0x750fdf
dec al
push esi
mov byte [ecx - 1], al
mov ecx, ebx
call fcn.00404e60
jmp 0x751009
test esi, esi
jne 0x750fca
push 1
mov ecx, ebx
call fcn.00404e60
jmp 0x751009
mov eax, dword [ebx + 0xc]
cmp eax, 0x1f
ja 0x750fd6
cmp eax, esi
jae 0x750fe7
push 1
mov ecx, ebx
call fcn.00404e60
push esi
mov ecx, ebx
call fcn.00401c60
mov edi, dword [ebx + 4]
mov ecx, esi
mov edx, ecx
mov eax, 0x20202020
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx + 4]
mov dword [ebx + 8], esi
mov byte [eax + esi], 0
mov eax, dword [ebx + 4]
test eax, eax
je 0x751038
mov al, byte [eax - 1]
test al, al
je 0x751028
cmp al, 0xff
je 0x751028
mov ecx, dword [ebx + 8]
push 0
push ecx
mov ecx, ebx
call fcn.00401b40
mov eax, dword [ebx + 4]
test eax, eax
je 0x751033
mov byte [eax - 1], 0xff
mov ebx, dword [ebx + 4]
jmp 0x75103d
mov ebx, 0x7e5658
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push 0
push edx
push eax
push ebx
jmp 0x751065
lea edx, [esp + 0x18]
push 0
push edx
push 4
jmp 0x751060
lea edx, [esp + 0x18]
push 0
push edx
push 8
mov eax, dword [esp + 0x28]
push eax
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
Function at 0x751300
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
dec eax
push esi
cmp eax, 8
push edi
ja case.default.0x751312
jmp dword [eax*4 + 0x751508]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 1
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 2
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 4
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov eax, dword [esp + 0x14]
push ebp
lea ecx, [esp + 0x1c]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, 0x870c08
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
mov ecx, ebx
push ebp
call fcn.00401b40
test al, al
je 0x7513ef
mov edi, dword [ebx + 4]
mov ecx, ebp
mov edx, ecx
mov esi, 0x870c08
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 4]
mov dword [ebx + 8], ebp
mov byte [eax + ebp], 0
mov esi, dword [esp + 0x10]
pop ebp
test esi, esi
jle 0x7514f0
cmp esi, 0xffffffff
jne 0x751406
call fcn.007a02eb
mov ecx, ebx
call fcn.00405090
cmp eax, esi
jae 0x751416
call fcn.007a02eb
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x75143b
mov al, byte [ecx - 1]
test al, al
je 0x75143b
cmp al, 0xff
je 0x75143b
test esi, esi
jne 0x75145f
dec al
push esi
mov byte [ecx - 1], al
mov ecx, ebx
call fcn.00404e60
jmp 0x751489
test esi, esi
jne 0x75144a
push 1
mov ecx, ebx
call fcn.00404e60
jmp 0x751489
mov eax, dword [ebx + 0xc]
cmp eax, 0x1f
ja 0x751456
cmp eax, esi
jae 0x751467
push 1
mov ecx, ebx
call fcn.00404e60
push esi
mov ecx, ebx
call fcn.00401c60
mov edi, dword [ebx + 4]
mov ecx, esi
mov edx, ecx
mov eax, 0x20202020
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx + 4]
mov dword [ebx + 8], esi
mov byte [eax + esi], 0
mov eax, dword [ebx + 4]
test eax, eax
je 0x7514b8
mov al, byte [eax - 1]
test al, al
je 0x7514a8
cmp al, 0xff
je 0x7514a8
mov ecx, dword [ebx + 8]
push 0
push ecx
mov ecx, ebx
call fcn.00401b40
mov eax, dword [ebx + 4]
test eax, eax
je 0x7514b3
mov byte [eax - 1], 0xff
mov ebx, dword [ebx + 4]
jmp 0x7514bd
mov ebx, 0x7e5658
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push 0
push edx
push eax
push ebx
jmp 0x7514e5
lea edx, [esp + 0x18]
push 0
push edx
push 4
jmp 0x7514e0
lea edx, [esp + 0x18]
push 0
push edx
push 8
mov eax, dword [esp + 0x28]
push eax
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
Function at 0x751780
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
dec eax
push esi
cmp eax, 8
push edi
ja case.default.0x751792
jmp dword [eax*4 + 0x751988]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 1
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 2
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 4
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov eax, dword [esp + 0x14]
push ebp
lea ecx, [esp + 0x1c]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, 0x870c08
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
mov ecx, ebx
push ebp
call fcn.00401b40
test al, al
je 0x75186f
mov edi, dword [ebx + 4]
mov ecx, ebp
mov edx, ecx
mov esi, 0x870c08
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 4]
mov dword [ebx + 8], ebp
mov byte [eax + ebp], 0
mov esi, dword [esp + 0x10]
pop ebp
test esi, esi
jle 0x751970
cmp esi, 0xffffffff
jne 0x751886
call fcn.007a02eb
mov ecx, ebx
call fcn.00405090
cmp eax, esi
jae 0x751896
call fcn.007a02eb
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x7518bb
mov al, byte [ecx - 1]
test al, al
je 0x7518bb
cmp al, 0xff
je 0x7518bb
test esi, esi
jne 0x7518df
dec al
push esi
mov byte [ecx - 1], al
mov ecx, ebx
call fcn.00404e60
jmp 0x751909
test esi, esi
jne 0x7518ca
push 1
mov ecx, ebx
call fcn.00404e60
jmp 0x751909
mov eax, dword [ebx + 0xc]
cmp eax, 0x1f
ja 0x7518d6
cmp eax, esi
jae 0x7518e7
push 1
mov ecx, ebx
call fcn.00404e60
push esi
mov ecx, ebx
call fcn.00401c60
mov edi, dword [ebx + 4]
mov ecx, esi
mov edx, ecx
mov eax, 0x20202020
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx + 4]
mov dword [ebx + 8], esi
mov byte [eax + esi], 0
mov eax, dword [ebx + 4]
test eax, eax
je 0x751938
mov al, byte [eax - 1]
test al, al
je 0x751928
cmp al, 0xff
je 0x751928
mov ecx, dword [ebx + 8]
push 0
push ecx
mov ecx, ebx
call fcn.00401b40
mov eax, dword [ebx + 4]
test eax, eax
je 0x751933
mov byte [eax - 1], 0xff
mov ebx, dword [ebx + 4]
jmp 0x75193d
mov ebx, 0x7e5658
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push 0
push edx
push eax
push ebx
jmp 0x751965
lea edx, [esp + 0x18]
push 0
push edx
push 4
jmp 0x751960
lea edx, [esp + 0x18]
push 0
push edx
push 8
mov eax, dword [esp + 0x28]
push eax
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
Function at 0x752310
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x7e2112
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 8], edi
xor ebp, ebp
cmp edi, ebp
mov dword [esp + 0x14], ebp
je 0x75249e
push ebx
push esi
mov esi, dword [esp + 0x28]
add edi, 4
mov dword [esp + 0x28], edi
mov eax, dword [esi]
mov dword [edi - 4], eax
mov ecx, dword [esi + 4]
mov dword [edi], ecx
mov dl, byte [esi + 8]
lea eax, [esi + 0xc]
mov byte [edi + 4], dl
lea ecx, [edi + 8]
mov dl, byte [eax]
mov byte [ecx], dl
mov dword [ecx + 4], ebp
mov dword [ecx + 8], ebp
mov dword [ecx + 0xc], ebp
mov edx, dword [0x7e565c]
push edx
push ebp
push eax
call fcn.00404c60
mov al, byte [esi + 0x1c]
lea ebx, [esi + 0x1c]
lea ebp, [edi + 0x18]
mov byte [esp + 0x1c], 1
push 0
mov ecx, ebp
mov byte [ebp], al
call fcn.00404e60
mov ecx, dword [0x7e565c]
push ecx
push 0
push ebx
mov ecx, ebp
call fcn.00404c60
mov edx, dword [esi + 0x2c]
mov byte [esp + 0x1c], 2
mov dword [edi + 0x28], edx
mov al, byte [esi + 0x30]
mov byte [edi + 0x2c], al
mov ecx, dword [esi + 0x34]
mov dword [edi + 0x30], ecx
mov edx, dword [esi + 0x38]
mov dword [edi + 0x34], edx
mov eax, dword [esi + 0x3c]
mov dword [edi + 0x38], eax
mov ecx, dword [esi + 0x40]
mov dword [edi + 0x3c], ecx
mov dl, byte [esi + 0x44]
mov byte [edi + 0x40], dl
mov al, byte [esi + 0x45]
mov byte [edi + 0x41], al
mov cl, byte [esi + 0x46]
mov byte [edi + 0x42], cl
mov dl, byte [esi + 0x47]
mov byte [edi + 0x43], dl
mov al, byte [esi + 0x48]
mov byte [edi + 0x44], al
mov cx, word [esi + 0x4a]
mov word [edi + 0x46], cx
mov dx, word [esi + 0x4c]
mov word [edi + 0x48], dx
mov ax, word [esi + 0x4e]
mov word [edi + 0x4a], ax
mov cx, word [esi + 0x50]
mov word [edi + 0x4c], cx
mov dx, word [esi + 0x52]
mov word [edi + 0x4e], dx
mov eax, dword [esi + 0x54]
mov dword [edi + 0x50], eax
mov ecx, dword [esi + 0x58]
mov dword [edi + 0x54], ecx
mov dx, word [esi + 0x5c]
mov word [edi + 0x58], dx
mov al, byte [esi + 0x5e]
mov byte [edi + 0x5a], al
mov ecx, dword [esi + 0x60]
mov dword [edi + 0x5c], ecx
mov edx, dword [esi + 0x64]
mov dword [edi + 0x60], edx
mov al, byte [esi + 0x68]
mov byte [edi + 0x64], al
mov cl, byte [esi + 0x69]
mov byte [edi + 0x65], cl
mov dl, byte [esi + 0x6a]
mov byte [edi + 0x66], dl
mov al, byte [esi + 0x6b]
mov byte [edi + 0x67], al
mov cl, byte [esi + 0x6c]
mov byte [edi + 0x68], cl
mov dl, byte [esi + 0x6d]
mov byte [edi + 0x69], dl
mov al, byte [esi + 0x6e]
mov byte [edi + 0x6a], al
mov cl, byte [esi + 0x6f]
mov byte [edi + 0x6b], cl
mov dl, byte [esi + 0x70]
mov byte [edi + 0x6c], dl
mov al, byte [esi + 0x71]
mov byte [edi + 0x6d], al
mov cl, byte [esi + 0x72]
mov byte [edi + 0x6e], cl
pop esi
pop ebx
mov byte [esp + 0x14], 0
pop edi
mov dword [esp + 0x10], 0xffffffff
pop ebp
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x14], 0xffffffff
pop edi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret