joyce8/EMBER2024-capa huggingface dataset:
Function at 0x74e180
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
dec eax
push esi
cmp eax, 8
push edi
ja case.default.0x74e192
jmp dword [eax*4 + 0x74e388]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 1
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 2
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 4
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov eax, dword [esp + 0x14]
push ebp
lea ecx, [esp + 0x1c]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, 0x870c08
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
mov ecx, ebx
push ebp
call fcn.00401b40
test al, al
je 0x74e26f
mov edi, dword [ebx + 4]
mov ecx, ebp
mov edx, ecx
mov esi, 0x870c08
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 4]
mov dword [ebx + 8], ebp
mov byte [eax + ebp], 0
mov esi, dword [esp + 0x10]
pop ebp
test esi, esi
jle 0x74e370
cmp esi, 0xffffffff
jne 0x74e286
call fcn.007a02eb
mov ecx, ebx
call fcn.00405090
cmp eax, esi
jae 0x74e296
call fcn.007a02eb
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x74e2bb
mov al, byte [ecx - 1]
test al, al
je 0x74e2bb
cmp al, 0xff
je 0x74e2bb
test esi, esi
jne 0x74e2df
dec al
push esi
mov byte [ecx - 1], al
mov ecx, ebx
call fcn.00404e60
jmp 0x74e309
test esi, esi
jne 0x74e2ca
push 1
mov ecx, ebx
call fcn.00404e60
jmp 0x74e309
mov eax, dword [ebx + 0xc]
cmp eax, 0x1f
ja 0x74e2d6
cmp eax, esi
jae 0x74e2e7
push 1
mov ecx, ebx
call fcn.00404e60
push esi
mov ecx, ebx
call fcn.00401c60
mov edi, dword [ebx + 4]
mov ecx, esi
mov edx, ecx
mov eax, 0x20202020
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx + 4]
mov dword [ebx + 8], esi
mov byte [eax + esi], 0
mov eax, dword [ebx + 4]
test eax, eax
je 0x74e338
mov al, byte [eax - 1]
test al, al
je 0x74e328
cmp al, 0xff
je 0x74e328
mov ecx, dword [ebx + 8]
push 0
push ecx
mov ecx, ebx
call fcn.00401b40
mov eax, dword [ebx + 4]
test eax, eax
je 0x74e333
mov byte [eax - 1], 0xff
mov ebx, dword [ebx + 4]
jmp 0x74e33d
mov ebx, 0x7e5658
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push 0
push edx
push eax
push ebx
jmp 0x74e365
lea edx, [esp + 0x18]
push 0
push edx
push 4
jmp 0x74e360
lea edx, [esp + 0x18]
push 0
push edx
push 8
mov eax, dword [esp + 0x28]
push eax
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
Function at 0x74e600
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
dec eax
push esi
cmp eax, 8
push edi
ja case.default.0x74e612
jmp dword [eax*4 + 0x74e808]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 1
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 2
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 4
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov eax, dword [esp + 0x14]
push ebp
lea ecx, [esp + 0x1c]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, 0x870c08
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
mov ecx, ebx
push ebp
call fcn.00401b40
test al, al
je 0x74e6ef
mov edi, dword [ebx + 4]
mov ecx, ebp
mov edx, ecx
mov esi, 0x870c08
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 4]
mov dword [ebx + 8], ebp
mov byte [eax + ebp], 0
mov esi, dword [esp + 0x10]
pop ebp
test esi, esi
jle 0x74e7f0
cmp esi, 0xffffffff
jne 0x74e706
call fcn.007a02eb
mov ecx, ebx
call fcn.00405090
cmp eax, esi
jae 0x74e716
call fcn.007a02eb
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x74e73b
mov al, byte [ecx - 1]
test al, al
je 0x74e73b
cmp al, 0xff
je 0x74e73b
test esi, esi
jne 0x74e75f
dec al
push esi
mov byte [ecx - 1], al
mov ecx, ebx
call fcn.00404e60
jmp 0x74e789
test esi, esi
jne 0x74e74a
push 1
mov ecx, ebx
call fcn.00404e60
jmp 0x74e789
mov eax, dword [ebx + 0xc]
cmp eax, 0x1f
ja 0x74e756
cmp eax, esi
jae 0x74e767
push 1
mov ecx, ebx
call fcn.00404e60
push esi
mov ecx, ebx
call fcn.00401c60
mov edi, dword [ebx + 4]
mov ecx, esi
mov edx, ecx
mov eax, 0x20202020
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx + 4]
mov dword [ebx + 8], esi
mov byte [eax + esi], 0
mov eax, dword [ebx + 4]
test eax, eax
je 0x74e7b8
mov al, byte [eax - 1]
test al, al
je 0x74e7a8
cmp al, 0xff
je 0x74e7a8
mov ecx, dword [ebx + 8]
push 0
push ecx
mov ecx, ebx
call fcn.00401b40
mov eax, dword [ebx + 4]
test eax, eax
je 0x74e7b3
mov byte [eax - 1], 0xff
mov ebx, dword [ebx + 4]
jmp 0x74e7bd
mov ebx, 0x7e5658
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push 0
push edx
push eax
push ebx
jmp 0x74e7e5
lea edx, [esp + 0x18]
push 0
push edx
push 4
jmp 0x74e7e0
lea edx, [esp + 0x18]
push 0
push edx
push 8
mov eax, dword [esp + 0x28]
push eax
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
Function at 0x74ea80
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
dec eax
push esi
cmp eax, 8
push edi
ja case.default.0x74ea92
jmp dword [eax*4 + 0x74ec88]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 1
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 2
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 4
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov eax, dword [esp + 0x14]
push ebp
lea ecx, [esp + 0x1c]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, 0x870c08
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
mov ecx, ebx
push ebp
call fcn.00401b40
test al, al
je 0x74eb6f
mov edi, dword [ebx + 4]
mov ecx, ebp
mov edx, ecx
mov esi, 0x870c08
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 4]
mov dword [ebx + 8], ebp
mov byte [eax + ebp], 0
mov esi, dword [esp + 0x10]
pop ebp
test esi, esi
jle 0x74ec70
cmp esi, 0xffffffff
jne 0x74eb86
call fcn.007a02eb
mov ecx, ebx
call fcn.00405090
cmp eax, esi
jae 0x74eb96
call fcn.007a02eb
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x74ebbb
mov al, byte [ecx - 1]
test al, al
je 0x74ebbb
cmp al, 0xff
je 0x74ebbb
test esi, esi
jne 0x74ebdf
dec al
push esi
mov byte [ecx - 1], al
mov ecx, ebx
call fcn.00404e60
jmp 0x74ec09
test esi, esi
jne 0x74ebca
push 1
mov ecx, ebx
call fcn.00404e60
jmp 0x74ec09
mov eax, dword [ebx + 0xc]
cmp eax, 0x1f
ja 0x74ebd6
cmp eax, esi
jae 0x74ebe7
push 1
mov ecx, ebx
call fcn.00404e60
push esi
mov ecx, ebx
call fcn.00401c60
mov edi, dword [ebx + 4]
mov ecx, esi
mov edx, ecx
mov eax, 0x20202020
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx + 4]
mov dword [ebx + 8], esi
mov byte [eax + esi], 0
mov eax, dword [ebx + 4]
test eax, eax
je 0x74ec38
mov al, byte [eax - 1]
test al, al
je 0x74ec28
cmp al, 0xff
je 0x74ec28
mov ecx, dword [ebx + 8]
push 0
push ecx
mov ecx, ebx
call fcn.00401b40
mov eax, dword [ebx + 4]
test eax, eax
je 0x74ec33
mov byte [eax - 1], 0xff
mov ebx, dword [ebx + 4]
jmp 0x74ec3d
mov ebx, 0x7e5658
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push 0
push edx
push eax
push ebx
jmp 0x74ec65
lea edx, [esp + 0x18]
push 0
push edx
push 4
jmp 0x74ec60
lea edx, [esp + 0x18]
push 0
push edx
push 8
mov eax, dword [esp + 0x28]
push eax
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
Function at 0x74ef00
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
dec eax
push esi
cmp eax, 8
push edi
ja case.default.0x74ef12
jmp dword [eax*4 + 0x74f108]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 1
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 2
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 4
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov eax, dword [esp + 0x14]
push ebp
lea ecx, [esp + 0x1c]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, 0x870c08
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
mov ecx, ebx
push ebp
call fcn.00401b40
test al, al
je 0x74efef
mov edi, dword [ebx + 4]
mov ecx, ebp
mov edx, ecx
mov esi, 0x870c08
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 4]
mov dword [ebx + 8], ebp
mov byte [eax + ebp], 0
mov esi, dword [esp + 0x10]
pop ebp
test esi, esi
jle 0x74f0f0
cmp esi, 0xffffffff
jne 0x74f006
call fcn.007a02eb
mov ecx, ebx
call fcn.00405090
cmp eax, esi
jae 0x74f016
call fcn.007a02eb
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x74f03b
mov al, byte [ecx - 1]
test al, al
je 0x74f03b
cmp al, 0xff
je 0x74f03b
test esi, esi
jne 0x74f05f
dec al
push esi
mov byte [ecx - 1], al
mov ecx, ebx
call fcn.00404e60
jmp 0x74f089
test esi, esi
jne 0x74f04a
push 1
mov ecx, ebx
call fcn.00404e60
jmp 0x74f089
mov eax, dword [ebx + 0xc]
cmp eax, 0x1f
ja 0x74f056
cmp eax, esi
jae 0x74f067
push 1
mov ecx, ebx
call fcn.00404e60
push esi
mov ecx, ebx
call fcn.00401c60
mov edi, dword [ebx + 4]
mov ecx, esi
mov edx, ecx
mov eax, 0x20202020
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx + 4]
mov dword [ebx + 8], esi
mov byte [eax + esi], 0
mov eax, dword [ebx + 4]
test eax, eax
je 0x74f0b8
mov al, byte [eax - 1]
test al, al
je 0x74f0a8
cmp al, 0xff
je 0x74f0a8
mov ecx, dword [ebx + 8]
push 0
push ecx
mov ecx, ebx
call fcn.00401b40
mov eax, dword [ebx + 4]
test eax, eax
je 0x74f0b3
mov byte [eax - 1], 0xff
mov ebx, dword [ebx + 4]
jmp 0x74f0bd
mov ebx, 0x7e5658
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push 0
push edx
push eax
push ebx
jmp 0x74f0e5
lea edx, [esp + 0x18]
push 0
push edx
push 4
jmp 0x74f0e0
lea edx, [esp + 0x18]
push 0
push edx
push 8
mov eax, dword [esp + 0x28]
push eax
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
Function at 0x74f380
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
dec eax
push esi
cmp eax, 8
push edi
ja case.default.0x74f392
jmp dword [eax*4 + 0x74f588]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 1
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 2
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 4
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov eax, dword [esp + 0x14]
push ebp
lea ecx, [esp + 0x1c]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, 0x870c08
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
mov ecx, ebx
push ebp
call fcn.00401b40
test al, al
je 0x74f46f
mov edi, dword [ebx + 4]
mov ecx, ebp
mov edx, ecx
mov esi, 0x870c08
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 4]
mov dword [ebx + 8], ebp
mov byte [eax + ebp], 0
mov esi, dword [esp + 0x10]
pop ebp
test esi, esi
jle 0x74f570
cmp esi, 0xffffffff
jne 0x74f486
call fcn.007a02eb
mov ecx, ebx
call fcn.00405090
cmp eax, esi
jae 0x74f496
call fcn.007a02eb
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x74f4bb
mov al, byte [ecx - 1]
test al, al
je 0x74f4bb
cmp al, 0xff
je 0x74f4bb
test esi, esi
jne 0x74f4df
dec al
push esi
mov byte [ecx - 1], al
mov ecx, ebx
call fcn.00404e60
jmp 0x74f509
test esi, esi
jne 0x74f4ca
push 1
mov ecx, ebx
call fcn.00404e60
jmp 0x74f509
mov eax, dword [ebx + 0xc]
cmp eax, 0x1f
ja 0x74f4d6
cmp eax, esi
jae 0x74f4e7
push 1
mov ecx, ebx
call fcn.00404e60
push esi
mov ecx, ebx
call fcn.00401c60
mov edi, dword [ebx + 4]
mov ecx, esi
mov edx, ecx
mov eax, 0x20202020
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx + 4]
mov dword [ebx + 8], esi
mov byte [eax + esi], 0
mov eax, dword [ebx + 4]
test eax, eax
je 0x74f538
mov al, byte [eax - 1]
test al, al
je 0x74f528
cmp al, 0xff
je 0x74f528
mov ecx, dword [ebx + 8]
push 0
push ecx
mov ecx, ebx
call fcn.00401b40
mov eax, dword [ebx + 4]
test eax, eax
je 0x74f533
mov byte [eax - 1], 0xff
mov ebx, dword [ebx + 4]
jmp 0x74f53d
mov ebx, 0x7e5658
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push 0
push edx
push eax
push ebx
jmp 0x74f565
lea edx, [esp + 0x18]
push 0
push edx
push 4
jmp 0x74f560
lea edx, [esp + 0x18]
push 0
push edx
push 8
mov eax, dword [esp + 0x28]
push eax
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
Function at 0x74f800
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
dec eax
push esi
cmp eax, 8
push edi
ja case.default.0x74f812
jmp dword [eax*4 + 0x74fa08]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 1
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 2
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 4
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov eax, dword [esp + 0x14]
push ebp
lea ecx, [esp + 0x1c]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, 0x870c08
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
mov ecx, ebx
push ebp
call fcn.00401b40
test al, al
je 0x74f8ef
mov edi, dword [ebx + 4]
mov ecx, ebp
mov edx, ecx
mov esi, 0x870c08
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 4]
mov dword [ebx + 8], ebp
mov byte [eax + ebp], 0
mov esi, dword [esp + 0x10]
pop ebp
test esi, esi
jle 0x74f9f0
cmp esi, 0xffffffff
jne 0x74f906
call fcn.007a02eb
mov ecx, ebx
call fcn.00405090
cmp eax, esi
jae 0x74f916
call fcn.007a02eb
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x74f93b
mov al, byte [ecx - 1]
test al, al
je 0x74f93b
cmp al, 0xff
je 0x74f93b
test esi, esi
jne 0x74f95f
dec al
push esi
mov byte [ecx - 1], al
mov ecx, ebx
call fcn.00404e60
jmp 0x74f989
test esi, esi
jne 0x74f94a
push 1
mov ecx, ebx
call fcn.00404e60
jmp 0x74f989
mov eax, dword [ebx + 0xc]
cmp eax, 0x1f
ja 0x74f956
cmp eax, esi
jae 0x74f967
push 1
mov ecx, ebx
call fcn.00404e60
push esi
mov ecx, ebx
call fcn.00401c60
mov edi, dword [ebx + 4]
mov ecx, esi
mov edx, ecx
mov eax, 0x20202020
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx + 4]
mov dword [ebx + 8], esi
mov byte [eax + esi], 0
mov eax, dword [ebx + 4]
test eax, eax
je 0x74f9b8
mov al, byte [eax - 1]
test al, al
je 0x74f9a8
cmp al, 0xff
je 0x74f9a8
mov ecx, dword [ebx + 8]
push 0
push ecx
mov ecx, ebx
call fcn.00401b40
mov eax, dword [ebx + 4]
test eax, eax
je 0x74f9b3
mov byte [eax - 1], 0xff
mov ebx, dword [ebx + 4]
jmp 0x74f9bd
mov ebx, 0x7e5658
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push 0
push edx
push eax
push ebx
jmp 0x74f9e5
lea edx, [esp + 0x18]
push 0
push edx
push 4
jmp 0x74f9e0
lea edx, [esp + 0x18]
push 0
push edx
push 8
mov eax, dword [esp + 0x28]
push eax
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
Function at 0x74fc80
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
dec eax
push esi
cmp eax, 8
push edi
ja case.default.0x74fc92
jmp dword [eax*4 + 0x74fe88]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 1
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 2
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
push 4
push edx
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
mov eax, dword [esp + 0x14]
push ebp
lea ecx, [esp + 0x1c]
push 0
push ecx
lea edx, [esp + 0x18]
push 4
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, 0x870c08
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov ebp, ecx
mov ecx, ebx
push ebp
call fcn.00401b40
test al, al
je 0x74fd6f
mov edi, dword [ebx + 4]
mov ecx, ebp
mov edx, ecx
mov esi, 0x870c08
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 4]
mov dword [ebx + 8], ebp
mov byte [eax + ebp], 0
mov esi, dword [esp + 0x10]
pop ebp
test esi, esi
jle 0x74fe70
cmp esi, 0xffffffff
jne 0x74fd86
call fcn.007a02eb
mov ecx, ebx
call fcn.00405090
cmp eax, esi
jae 0x74fd96
call fcn.007a02eb
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x74fdbb
mov al, byte [ecx - 1]
test al, al
je 0x74fdbb
cmp al, 0xff
je 0x74fdbb
test esi, esi
jne 0x74fddf
dec al
push esi
mov byte [ecx - 1], al
mov ecx, ebx
call fcn.00404e60
jmp 0x74fe09
test esi, esi
jne 0x74fdca
push 1
mov ecx, ebx
call fcn.00404e60
jmp 0x74fe09
mov eax, dword [ebx + 0xc]
cmp eax, 0x1f
ja 0x74fdd6
cmp eax, esi
jae 0x74fde7
push 1
mov ecx, ebx
call fcn.00404e60
push esi
mov ecx, ebx
call fcn.00401c60
mov edi, dword [ebx + 4]
mov ecx, esi
mov edx, ecx
mov eax, 0x20202020
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx + 4]
mov dword [ebx + 8], esi
mov byte [eax + esi], 0
mov eax, dword [ebx + 4]
test eax, eax
je 0x74fe38
mov al, byte [eax - 1]
test al, al
je 0x74fe28
cmp al, 0xff
je 0x74fe28
mov ecx, dword [ebx + 8]
push 0
push ecx
mov ecx, ebx
call fcn.00401b40
mov eax, dword [ebx + 4]
test eax, eax
je 0x74fe33
mov byte [eax - 1], 0xff
mov ebx, dword [ebx + 4]
jmp 0x74fe3d
mov ebx, 0x7e5658
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x18]
push 0
push edx
push eax
push ebx
jmp 0x74fe65
lea edx, [esp + 0x18]
push 0
push edx
push 4
jmp 0x74fe60
lea edx, [esp + 0x18]
push 0
push edx
push 8
mov eax, dword [esp + 0x28]
push eax
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.kernel32.dll_ReadFile]
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc