joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47b004
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
sub esp, 0x194
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0047af14
mov edx, eax
cmp eax, 0xffffffff
je 0x47b0f8
lea edi, [ebp - 0x188]
mov ecx, 0x180
xor eax, eax
rep stosb byte es:[edi], al
mov dword [ebp - 0x188], 0x4478784d
mov dword [ebp - 0x184], 0
mov dword [ebp - 0x180], 0x4458424c
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0x178], 0x52445924
mov dword [ebp - 0x174], 0
mov dword [ebp - 0x170], 0x484c5424
mov dword [ebp - 0x16c], 0
mov dword [ebp - 0x168], 0x2441434b
mov dword [ebp - 0x164], 0
mov dword [ebp - 0x160], 0x4e41434b
mov dword [ebp - 0x15c], 0
mov dword [ebp - 0x158], 0x454f494f
mov dword [ebp - 0x154], 0
mov dword [ebp - 0x150], 0x45523430
mov dword [ebp - 0x14c], 0
mov eax, dword [ebp + edx*8 - 0x188]
mov edx, dword [ebp + edx*8 - 0x184]
add esp, 0x194
pop edi
leave
ret
xor eax, eax
xor edx, edx
add esp, 0x194
pop edi
leave
ret
Function at 0x48fac8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x18]
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x30], eax
mov byte [ebx + 0x114], 0
mov byte [ebx + 0x117], 0
mov byte [ebx + 0x116], 0
mov byte [ebx + 0x118], 0
mov eax, dword [ebx + 0x98]
cmp byte [eax + 0x61], 0
jne 0x48fbe4
mov dword [ebx + 0xc8], ecx
mov dword [esp + 4], edx
lea eax, [ebx + 0xa0]
mov dword [esp], eax
call fcn.00508d84
mov dword [esp + 4], edi
lea eax, [ebx + 0xa4]
mov dword [esp], eax
call fcn.00508d84
mov dword [esp + 4], esi
lea eax, [ebx + 0xa8]
mov dword [esp], eax
call fcn.00508d84
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 0xac], eax
mov eax, dword [ebp - 0x20]
mov dword [ebx + 0xb0], eax
mov eax, dword [ebp - 0x24]
mov dword [ebx + 0xb4], eax
mov eax, dword [ebp - 0x28]
mov dword [ebx + 0xb8], eax
mov al, byte [ebp - 0x2c]
mov byte [ebx + 0xbc], al
mov eax, dword [ebp - 0x30]
mov dword [ebx + 0x144], eax
mov byte [ebx + 0xc4], 1
mov byte [ebx + 0x119], 0
mov byte [ebx + 0xe4], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x568fb7
lea eax, [ebx + 0xe0]
mov dword [esp], eax
call fcn.00508ca0
mov dword [ebp + 8], ebx
add esp, 0x3c
pop ebx
pop esi
pop edi
leave
jmp fcn.0048f7ac
add esp, 0x3c
pop ebx
pop esi
pop edi
leave
jmp fcn.0048e3e0
Function at 0x491d18
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [ebp + 8]
xor esi, esi
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0xa8]
mov dword [esp], eax
call fcn.0044314c
mov dword [ebx + 0x5c], eax
mov dword [esp], eax
call fcn.00538984
mov dword [ebx + 0x18], eax
test eax, eax
je 0x491db6
mov dword [esp + 4], 0x569aac
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov esi, eax
test eax, eax
je 0x491dac
mov dword [esp], eax
call sub.msvcrt.dll_rewind
mov dword [esp + 0xc], esi
mov eax, dword [ebx + 0x5c]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebx + 0x18]
mov dword [esp], eax
call sub.msvcrt.dll_fread
cmp eax, dword [ebx + 0x5c]
jne 0x491de0
xor ebx, ebx
test esi, esi
je 0x491d9d
mov dword [esp], esi
call sub.msvcrt.dll_fclose
test ebx, ebx
sete al
add esp, 0x4c
pop ebx
pop esi
pop edi
leave
ret
mov al, 1
add esp, 0x4c
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp], 4
call fcn.00538b64
mov dword [eax], 5
mov dword [esp + 8], 0
mov dword [esp + 4], 0x57285c
mov dword [esp], eax
call fcn.00539374
mov dword [esp], esi
call sub.msvcrt.dll_fclose
mov dword [esp], 4
call fcn.00538b64
mov dword [eax], 6
mov dword [esp + 8], 0
mov dword [esp + 4], 0x57285c
mov dword [esp], eax
call fcn.00539374
cmp edx, 3
je 0x491e7b
cmp edx, 2
je 0x491f18
mov dword [esp], eax
call fcn.00538d08
lea eax, [ebp - 0x1b]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x569bd1
lea edi, [ebp - 0x28]
mov dword [esp], edi
call fcn.00509af0
mov dword [esp + 0xc], 0x569c48
mov dword [esp + 8], edi
mov dword [esp + 4], 8
mov eax, dword [ebx + 0xa8]
mov dword [esp], eax
call fcn.0044092c
mov dword [esp], edi
call fcn.0050a12c
call fcn.00538ed4
mov ebx, 1
jmp 0x491d91
mov dword [esp], eax
call fcn.00538d08
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x19]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x569b98
lea edi, [ebp - 0x20]
mov dword [esp], edi
call fcn.00509af0
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x569c48
mov dword [esp + 8], edi
mov dword [esp + 4], 8
mov eax, dword [ebx + 0xa8]
mov dword [esp], eax
call fcn.0044092c
mov dword [esp], edi
call fcn.0050a12c
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00490350
call fcn.00538ed4
mov ebx, dword [ebp - 0x2c]
jmp 0x491d91
mov dword [esp], eax
call fcn.00538d08
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x1a]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x569bba
lea edi, [ebp - 0x24]
mov dword [esp], edi
call fcn.00509af0
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x569c48
mov dword [esp + 8], edi
mov dword [esp + 4], 8
mov eax, dword [ebx + 0xa8]
mov dword [esp], eax
call fcn.0044092c
mov dword [esp], edi
call fcn.0050a12c
jmp 0x491e6c
Function at 0x492be8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x19]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x569c50
lea esi, [ebp - 0x24]
mov dword [esp], esi
call fcn.00509af0
mov dword [esp + 0xc], 0x569ec6
mov dword [esp + 8], esi
mov dword [esp + 4], 0x400
mov eax, dword [ebx]
mov dword [esp], eax
call fcn.0044092c
mov eax, dword [ebp - 0x24]
lea esi, [eax - 0xc]
cmp esi, 0x55a154
jne 0x492cd4
mov eax, dword [ebx + 4]
test eax, eax
je 0x492d30
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov dword [esp], eax
call fcn.0044314c
mov dword [ebx + 0x1c], eax
mov dword [esp], eax
call fcn.00538984
mov dword [ebx + 0x20], eax
test eax, eax
je 0x492d06
mov dword [esp + 4], 0x569c77
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov esi, eax
test eax, eax
je 0x492cbd
mov dword [esp], eax
call sub.msvcrt.dll_rewind
mov dword [esp + 0xc], esi
mov eax, dword [ebx + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebx + 0x20]
mov dword [esp], eax
call sub.msvcrt.dll_fread
cmp eax, dword [ebx + 0x1c]
jne 0x492d5a
mov dword [esp], esi
call sub.msvcrt.dll_fclose
mov eax, dword [ebx + 0x1c]
mov dword [ebx + 0x44], eax
mov eax, dword [ebx + 0x20]
mov dword [ebx + 0x48], eax
lea eax, [ebx + 0x44]
add esp, 0x5c
pop ebx
pop esi
pop edi
leave
ret
cmp dword [0x554500], 0
jne 0x492d8c
mov eax, dword [esi + 8]
lea edx, [eax - 1]
mov dword [esi + 8], edx
test eax, eax
jg 0x492c3e
lea eax, [ebp - 0x1d]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.005084ec
jmp 0x492c3e
mov dword [esp], 4
call fcn.00538b64
mov dword [eax], 5
mov dword [esp + 8], 0
mov dword [esp + 4], 0x57285c
mov dword [esp], eax
call fcn.00539374
mov dword [esp], 4
call fcn.00538b64
mov dword [eax], 8
mov dword [esp + 8], 0
mov dword [esp + 4], 0x57285c
mov dword [esp], eax
call fcn.00539374
mov dword [esp], esi
call sub.msvcrt.dll_fclose
mov dword [esp], 4
call fcn.00538b64
mov dword [eax], 6
mov dword [esp + 8], 0
mov dword [esp + 4], 0x57285c
mov dword [esp], eax
call fcn.00539374
mov dword [esp + 4], 0xffffffff
sub eax, 4
mov dword [esp], eax
call fcn.004dd8dc
jmp 0x492cea
Function at 0x494884
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx], eax
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.00494624
test al, al
jne 0x4948bc
add esp, 0x2c
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.00494624
test al, al
je 0x4948b1
mov eax, dword [ebp - 0x1c]
and eax, 0x20
mov dword [ebx + 0x10], eax
mov dword [ebx + 4], esi
mov dword [ebx + 8], edi
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 0xc], eax
mov dword [esp], ebx
call fcn.0049402c
test al, al
je 0x4948b1
mov dword [ebp + 8], ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
leave
jmp fcn.00493acc
Function at 0x496a6c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [ebp + 8]
xor esi, esi
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0xa8]
mov dword [esp], eax
call fcn.00454fb4
mov dword [ebx + 0x5c], eax
mov dword [esp], eax
call fcn.00538984
mov dword [ebx + 0x18], eax
test eax, eax
je 0x496b0a
mov dword [esp + 4], 0x569f94
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov esi, eax
test eax, eax
je 0x496b00
mov dword [esp], eax
call sub.msvcrt.dll_rewind
mov dword [esp + 0xc], esi
mov eax, dword [ebx + 0x5c]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebx + 0x18]
mov dword [esp], eax
call sub.msvcrt.dll_fread
cmp eax, dword [ebx + 0x5c]
jne 0x496b34
xor ebx, ebx
test esi, esi
je 0x496af1
mov dword [esp], esi
call sub.msvcrt.dll_fclose
test ebx, ebx
sete al
add esp, 0x4c
pop ebx
pop esi
pop edi
leave
ret
mov al, 1
add esp, 0x4c
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp], 4
call fcn.00538b64
mov dword [eax], 5
mov dword [esp + 8], 0
mov dword [esp + 4], 0x57285c
mov dword [esp], eax
call fcn.00539374
mov dword [esp], esi
call sub.msvcrt.dll_fclose
mov dword [esp], 4
call fcn.00538b64
mov dword [eax], 6
mov dword [esp + 8], 0
mov dword [esp + 4], 0x57285c
mov dword [esp], eax
call fcn.00539374
cmp edx, 3
je 0x496bcf
cmp edx, 2
je 0x496c6c
mov dword [esp], eax
call fcn.00538d08
lea eax, [ebp - 0x1b]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x56a0b9
lea edi, [ebp - 0x28]
mov dword [esp], edi
call fcn.00509af0
mov dword [esp + 0xc], 0x56a130
mov dword [esp + 8], edi
mov dword [esp + 4], 8
mov eax, dword [ebx + 0xa8]
mov dword [esp], eax
call fcn.00452794
mov dword [esp], edi
call fcn.0050a12c
call fcn.00538ed4
mov ebx, 1
jmp 0x496ae5
mov dword [esp], eax
call fcn.00538d08
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x19]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x56a080
lea edi, [ebp - 0x20]
mov dword [esp], edi
call fcn.00509af0
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x56a130
mov dword [esp + 8], edi
mov dword [esp + 4], 8
mov eax, dword [ebx + 0xa8]
mov dword [esp], eax
call fcn.00452794
mov dword [esp], edi
call fcn.0050a12c
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00495174
call fcn.00538ed4
mov ebx, dword [ebp - 0x2c]
jmp 0x496ae5
mov dword [esp], eax
call fcn.00538d08
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x1a]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x56a0a2
lea edi, [ebp - 0x24]
mov dword [esp], edi
call fcn.00509af0
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x56a130
mov dword [esp + 8], edi
mov dword [esp + 4], 8
mov eax, dword [ebx + 0xa8]
mov dword [esp], eax
call fcn.00452794
mov dword [esp], edi
call fcn.0050a12c
jmp 0x496bc0
Function at 0x497b04
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x19]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x56a144
lea esi, [ebp - 0x24]
mov dword [esp], esi
call fcn.00509af0
mov dword [esp + 0xc], 0x56a3b8
mov dword [esp + 8], esi
mov dword [esp + 4], 0x400
mov eax, dword [ebx]
mov dword [esp], eax
call fcn.00452794
mov eax, dword [ebp - 0x24]
lea esi, [eax - 0xc]
cmp esi, 0x55a154
jne 0x497bf0
mov eax, dword [ebx + 4]
test eax, eax
je 0x497c4c
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov dword [esp], eax
call fcn.00454fb4
mov dword [ebx + 0x1c], eax
mov dword [esp], eax
call fcn.00538984
mov dword [ebx + 0x20], eax
test eax, eax
je 0x497c22
mov dword [esp + 4], 0x56a16b
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov esi, eax
test eax, eax
je 0x497bd9
mov dword [esp], eax
call sub.msvcrt.dll_rewind
mov dword [esp + 0xc], esi
mov eax, dword [ebx + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebx + 0x20]
mov dword [esp], eax
call sub.msvcrt.dll_fread
cmp eax, dword [ebx + 0x1c]
jne 0x497c76
mov dword [esp], esi
call sub.msvcrt.dll_fclose
mov eax, dword [ebx + 0x1c]
mov dword [ebx + 0x44], eax
mov eax, dword [ebx + 0x20]
mov dword [ebx + 0x48], eax
lea eax, [ebx + 0x44]
add esp, 0x5c
pop ebx
pop esi
pop edi
leave
ret
cmp dword [0x554500], 0
jne 0x497ca8
mov eax, dword [esi + 8]
lea edx, [eax - 1]
mov dword [esi + 8], edx
test eax, eax
jg 0x497b5a
lea eax, [ebp - 0x1d]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.005084ec
jmp 0x497b5a
mov dword [esp], 4
call fcn.00538b64
mov dword [eax], 5
mov dword [esp + 8], 0
mov dword [esp + 4], 0x57285c
mov dword [esp], eax
call fcn.00539374
mov dword [esp], 4
call fcn.00538b64
mov dword [eax], 8
mov dword [esp + 8], 0
mov dword [esp + 4], 0x57285c
mov dword [esp], eax
call fcn.00539374
mov dword [esp], esi
call sub.msvcrt.dll_fclose
mov dword [esp], 4
call fcn.00538b64
mov dword [eax], 6
mov dword [esp + 8], 0
mov dword [esp + 4], 0x57285c
mov dword [esp], eax
call fcn.00539374
mov dword [esp + 4], 0xffffffff
sub eax, 4
mov dword [esp], eax
call fcn.004dd8dc
jmp 0x497c06
Function at 0x49979c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx], eax
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.0049953c
test al, al
jne 0x4997d4
add esp, 0x2c
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.0049953c
test al, al
je 0x4997c9
mov eax, dword [ebp - 0x1c]
and eax, 0x20
mov dword [ebx + 0x10], eax
mov dword [ebx + 4], esi
mov dword [ebx + 8], edi
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 0xc], eax
mov dword [esp], ebx
call fcn.00498f44
test al, al
je 0x4997c9
mov dword [ebp + 8], ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
leave
jmp fcn.004989e8
Function at 0x49a12c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [ebp + 8]
xor esi, esi
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0xb4]
mov dword [esp], eax
call fcn.0046dd98
mov dword [ebx + 0x60], eax
mov dword [esp], eax
call fcn.00538984
mov dword [ebx + 0x18], eax
test eax, eax
je 0x49a1ca
mov dword [esp + 4], 0x56a45f
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov esi, eax
test eax, eax
je 0x49a1c0
mov dword [esp], eax
call sub.msvcrt.dll_rewind
mov dword [esp + 0xc], esi
mov eax, dword [ebx + 0x60]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebx + 0x18]
mov dword [esp], eax
call sub.msvcrt.dll_fread
cmp eax, dword [ebx + 0x60]
jne 0x49a1f4
xor ebx, ebx
test esi, esi
je 0x49a1b1
mov dword [esp], esi
call sub.msvcrt.dll_fclose
test ebx, ebx
sete al
add esp, 0x4c
pop ebx
pop esi
pop edi
leave
ret
mov al, 1
add esp, 0x4c
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp], 4
call fcn.00538b64
mov dword [eax], 5
mov dword [esp + 8], 0
mov dword [esp + 4], 0x57285c
mov dword [esp], eax
call fcn.00539374
mov dword [esp], esi
call sub.msvcrt.dll_fclose
mov dword [esp], 4
call fcn.00538b64
mov dword [eax], 6
mov dword [esp + 8], 0
mov dword [esp + 4], 0x57285c
mov dword [esp], eax
call fcn.00539374
cmp edx, 3
je 0x49a28f
cmp edx, 2
je 0x49a32c
mov dword [esp], eax
call fcn.00538d08
lea eax, [ebp - 0x1b]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x56a49d
lea edi, [ebp - 0x28]
mov dword [esp], edi
call fcn.00509af0
mov dword [esp + 0xc], 0x56a64f
mov dword [esp + 8], edi
mov dword [esp + 4], 8
mov eax, dword [ebx + 0xb4]
mov dword [esp], eax
call fcn.0046b578
mov dword [esp], edi
call fcn.0050a12c
call fcn.00538ed4
mov ebx, 1
jmp 0x49a1a5
mov dword [esp], eax
call fcn.00538d08
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x19]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x56a464
lea edi, [ebp - 0x20]
mov dword [esp], edi
call fcn.00509af0
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x56a64f
mov dword [esp + 8], edi
mov dword [esp + 4], 8
mov eax, dword [ebx + 0xb4]
mov dword [esp], eax
call fcn.0046b578
mov dword [esp], edi
call fcn.0050a12c
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00499fc4
call fcn.00538ed4
mov ebx, dword [ebp - 0x2c]
jmp 0x49a1a5
mov dword [esp], eax
call fcn.00538d08
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x1a]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x56a486
lea edi, [ebp - 0x24]
mov dword [esp], edi
call fcn.00509af0
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x56a64f
mov dword [esp + 8], edi
mov dword [esp + 4], 8
mov eax, dword [ebx + 0xb4]
mov dword [esp], eax
call fcn.0046b578
mov dword [esp], edi
call fcn.0050a12c
jmp 0x49a280
Function at 0x49ccb4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x19]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x56a664
lea esi, [ebp - 0x24]
mov dword [esp], esi
call fcn.00509af0
mov dword [esp + 0xc], 0x56a8d8
mov dword [esp + 8], esi
mov dword [esp + 4], 0x400
mov eax, dword [ebx]
mov dword [esp], eax
call fcn.0046b578
mov eax, dword [ebp - 0x24]
lea esi, [eax - 0xc]
cmp esi, 0x55a154
jne 0x49cda0
mov eax, dword [ebx + 4]
test eax, eax
je 0x49cdfc
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov dword [esp], eax
call fcn.0046dd98
mov dword [ebx + 0x1c], eax
mov dword [esp], eax
call fcn.00538984
mov dword [ebx + 0x20], eax
test eax, eax
je 0x49cdd2
mov dword [esp + 4], 0x56a68b
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov esi, eax
test eax, eax
je 0x49cd89
mov dword [esp], eax
call sub.msvcrt.dll_rewind
mov dword [esp + 0xc], esi
mov eax, dword [ebx + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebx + 0x20]
mov dword [esp], eax
call sub.msvcrt.dll_fread
cmp eax, dword [ebx + 0x1c]
jne 0x49ce26
mov dword [esp], esi
call sub.msvcrt.dll_fclose
mov eax, dword [ebx + 0x1c]
mov dword [ebx + 0x44], eax
mov eax, dword [ebx + 0x20]
mov dword [ebx + 0x48], eax
lea eax, [ebx + 0x44]
add esp, 0x5c
pop ebx
pop esi
pop edi
leave
ret
cmp dword [0x554500], 0
jne 0x49ce58
mov eax, dword [esi + 8]
lea edx, [eax - 1]
mov dword [esi + 8], edx
test eax, eax
jg 0x49cd0a
lea eax, [ebp - 0x1d]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.005084ec
jmp 0x49cd0a
mov dword [esp], 4
call fcn.00538b64
mov dword [eax], 5
mov dword [esp + 8], 0
mov dword [esp + 4], 0x57285c
mov dword [esp], eax
call fcn.00539374
mov dword [esp], 4
call fcn.00538b64
mov dword [eax], 8
mov dword [esp + 8], 0
mov dword [esp + 4], 0x57285c
mov dword [esp], eax
call fcn.00539374
mov dword [esp], esi
call sub.msvcrt.dll_fclose
mov dword [esp], 4
call fcn.00538b64
mov dword [eax], 6
mov dword [esp + 8], 0
mov dword [esp + 4], 0x57285c
mov dword [esp], eax
call fcn.00539374
mov dword [esp + 4], 0xffffffff
sub eax, 4
mov dword [esp], eax
call fcn.004dd8dc
jmp 0x49cdb6
Function at 0x49e94c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx], eax
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.0049e6ec
test al, al
jne 0x49e984
add esp, 0x2c
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.0049e6ec
test al, al
je 0x49e979
mov eax, dword [ebp - 0x1c]
and eax, 0x20
mov dword [ebx + 0x10], eax
mov dword [ebx + 4], esi
mov dword [ebx + 8], edi
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 0xc], eax
mov dword [esp], ebx
call fcn.0049e0f4
test al, al
je 0x49e979
mov dword [ebp + 8], ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
leave
jmp fcn.0049db98
Function at 0x4a192c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [ebp + 8]
xor esi, esi
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0xa8]
mov dword [esp], eax
call fcn.0047ab2c
mov dword [ebx + 0x5c], eax
mov dword [esp], eax
call fcn.00538984
mov dword [ebx + 0x18], eax
test eax, eax
je 0x4a19ca
mov dword [esp + 4], 0x56aa90
mov eax, dword [ebx]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov esi, eax
test eax, eax
je 0x4a19c0
mov dword [esp], eax
call sub.msvcrt.dll_rewind
mov dword [esp + 0xc], esi
mov eax, dword [ebx + 0x5c]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebx + 0x18]
mov dword [esp], eax
call sub.msvcrt.dll_fread
cmp eax, dword [ebx + 0x5c]
jne 0x4a19f4
xor ebx, ebx
test esi, esi
je 0x4a19b1
mov dword [esp], esi
call sub.msvcrt.dll_fclose
test ebx, ebx
sete al
add esp, 0x4c
pop ebx
pop esi
pop edi
leave
ret
mov al, 1
add esp, 0x4c
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp], 4
call fcn.00538b64
mov dword [eax], 5
mov dword [esp + 8], 0
mov dword [esp + 4], 0x57285c
mov dword [esp], eax
call fcn.00539374
mov dword [esp], esi
call sub.msvcrt.dll_fclose
mov dword [esp], 4
call fcn.00538b64
mov dword [eax], 6
mov dword [esp + 8], 0
mov dword [esp + 4], 0x57285c
mov dword [esp], eax
call fcn.00539374
cmp edx, 3
je 0x4a1a8f
cmp edx, 2
je 0x4a1b2c
mov dword [esp], eax
call fcn.00538d08
lea eax, [ebp - 0x1b]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x56abb5
lea edi, [ebp - 0x28]
mov dword [esp], edi
call fcn.00509af0
mov dword [esp + 0xc], 0x56ac2c
mov dword [esp + 8], edi
mov dword [esp + 4], 8
mov eax, dword [ebx + 0xa8]
mov dword [esp], eax
call fcn.0047830c
mov dword [esp], edi
call fcn.0050a12c
call fcn.00538ed4
mov ebx, 1
jmp 0x4a19a5
mov dword [esp], eax
call fcn.00538d08
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x19]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x56ab7c
lea edi, [ebp - 0x20]
mov dword [esp], edi
call fcn.00509af0
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x56ac2c
mov dword [esp + 8], edi
mov dword [esp + 4], 8
mov eax, dword [ebx + 0xa8]
mov dword [esp], eax
call fcn.0047830c
mov dword [esp], edi
call fcn.0050a12c
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.0049ff64
call fcn.00538ed4
mov ebx, dword [ebp - 0x2c]
jmp 0x4a19a5
mov dword [esp], eax
call fcn.00538d08
mov edx, dword [eax]
mov dword [esp], eax
call dword [edx + 8]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x1a]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x56ab9e
lea edi, [ebp - 0x24]
mov dword [esp], edi
call fcn.00509af0
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x56ac2c
mov dword [esp + 8], edi
mov dword [esp + 4], 8
mov eax, dword [ebx + 0xa8]
mov dword [esp], eax
call fcn.0047830c
mov dword [esp], edi
call fcn.0050a12c
jmp 0x4a1a80